Skip to main content

Private Cluster Should Be Enabled

More Info:​

Ensures private cluster is enabled for all Kubernetes clusters. Kubernetes private clusters only have internal ip ranges, which ensures that their workloads are isolated from the public internet.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • HITRUST CSF
  • NIST CSF
  • PCI
  • SOC2

Triage and Remediation​

Remediation​

Using Console

To remediate the "Private Cluster Should Be Enabled" misconfiguration in GCP using the GCP console, follow these steps:

  1. Open the GCP Console and navigate to the Kubernetes Engine page.
  2. Select the cluster that you want to remediate and click on the "Edit" button.
  3. Scroll down to the "Networking" section and click on "Show advanced options".
  4. Under "Private cluster", select the checkbox for "Enable private endpoint".
  5. Optionally, you can also enable "Private nodes" and "Private endpoint with DNS zone".
  6. Click on "Save" to apply the changes.

By enabling private endpoint in GCP Kubernetes Engine, you are ensuring that your cluster is only accessible from a private IP address range and not from the public internet. This will help to protect your cluster from unauthorized access and potential security threats.

Using CLI

To remediate the misconfiguration "Private Cluster Should Be Enabled" for GCP using GCP CLI, follow the below steps:

  1. Open the GCP Console and navigate to the Google Kubernetes Engine (GKE) cluster that needs to be remediated.

  2. Open the Cloud Shell by clicking on the icon on the top right corner of the console.

  3. In the Cloud Shell, run the following command to enable private cluster:

gcloud container clusters update [CLUSTER_NAME] --enable-private-nodes --master-ipv4-cidr [MASTER_CIDR] --enable-private-endpoint

Replace [CLUSTER_NAME] with the name of the GKE cluster that needs to be remediated and [MASTER_CIDR] with the IP range for the master node.

  1. If you want to enable private nodes for an existing cluster, run the following command:
gcloud container clusters update [CLUSTER_NAME] --enable-private-nodes
  1. If you want to enable private endpoint for an existing cluster, run the following command:
gcloud container clusters update [CLUSTER_NAME] --enable-private-endpoint
  1. Verify that the private endpoint is enabled by running the following command:
gcloud container clusters describe [CLUSTER_NAME] --format='get(privateClusterConfig.enablePrivateEndpoint)'

The output should be true.

  1. Verify that private nodes are enabled by running the following command:
gcloud container clusters describe [CLUSTER_NAME] --format='get(privateClusterConfig.enablePrivateNodes)'

The output should be true.

By following the above steps, you can remediate the misconfiguration "Private Cluster Should Be Enabled" for GCP using GCP CLI.

Using Python

To remediate the misconfiguration of "Private Cluster Should Be Enabled" in GCP using Python, you can follow the below steps:

  1. Import the necessary libraries:
from google.cloud import container_v1
from google.oauth2 import service_account
  1. Set up the credentials for authentication:
credentials = service_account.Credentials.from_service_account_file('path/to/service_account.json')
  1. Initialize the client for GCP Container API:
client = container_v1.ClusterManagerClient(credentials=credentials)
  1. Get the current state of the cluster:
cluster = client.get_cluster('projects/{project_id}/locations/{zone}/clusters/{cluster_name}')
  1. Check if the cluster is private:
if cluster.private_cluster_config.enable_private_nodes:
    print('Cluster is already private')
else:
    print('Cluster is not private')
  1. If the cluster is not private, enable private cluster:
cluster.private_cluster_config.enable_private_nodes = True
update_request = container_v1.UpdateClusterRequest(cluster=cluster, update_mask={'paths': ['private_cluster_config.enable_private_nodes']})
operation = client.update_cluster(update_request)
  1. Wait for the operation to complete:
operation.result()

By following these steps, you can remediate the misconfiguration of "Private Cluster Should Be Enabled" in GCP using Python.

Using Terraform
resource "google_container_cluster" "PRIVATE_CLUSTER" {
  name     = "PRIVATE_CLUSTER_NAME"            # replace with your cluster name
  location = "GCP_REGION_OR_ZONE"              # e.g. "us-central1" or "us-central1-a"

  network    = "PROJECT_NETWORK_SELF_LINK"     # e.g. "projects/PROJECT_ID/global/networks/NETWORK_NAME"
  subnetwork = "PROJECT_SUBNETWORK_SELF_LINK"  # e.g. "projects/PROJECT_ID/regions/REGION/subnetworks/SUBNET_NAME"

  remove_default_node_pool = true
  initial_node_count       = 1

  private_cluster_config {
    enable_private_nodes    = true
    enable_private_endpoint = false           # set to true if you also want a private control plane endpoint
    master_ipv4_cidr_block  = "172.16.0.0/28" # pick a /28 CIDR that does not overlap your pod/service ranges
  }

  ip_allocation_policy {
    cluster_secondary_range_name  = "CLUSTER_POD_RANGE_NAME"    # replace with your pod range name
    services_secondary_range_name = "CLUSTER_SERVICE_RANGE_NAME" # replace with your service range name
  }

  # add any other existing settings (addons, logging, monitoring, etc.) here
}

Enabling private_cluster_config.enable_private_nodes = true on a cluster that was not created as private generally forces replacement of the google_container_cluster (cluster recreation/outage), so plan carefully before applying.

After updating your Terraform, terraform plan should show the google_container_cluster either being created with private_cluster_config.enable_private_nodes = true or being replaced with that argument set to true.

Additional Reading:​