Private Cluster Should Be Enabled
More Info:
Ensures private cluster is enabled for all Kubernetes clusters. Kubernetes private clusters only have internal ip ranges, which ensures that their workloads are isolated from the public internet.Risk Level
MediumAddress
SecurityCompliance Standards
HITRUST, SOC2, NISTCSF, PCIDSSTriage and Remediation
Remediation
Using Console
Using Console
To remediate the “Private Cluster Should Be Enabled” misconfiguration in GCP using the GCP console, follow these steps:
- Open the GCP Console and navigate to the Kubernetes Engine page.
- Select the cluster that you want to remediate and click on the “Edit” button.
- Scroll down to the “Networking” section and click on “Show advanced options”.
- Under “Private cluster”, select the checkbox for “Enable private endpoint”.
- Optionally, you can also enable “Private nodes” and “Private endpoint with DNS zone”.
- Click on “Save” to apply the changes.
Using CLI
Using CLI
To remediate the misconfiguration “Private Cluster Should Be Enabled” for GCP using GCP CLI, follow the below steps:Replace The output should be The output should be
- Open the GCP Console and navigate to the Google Kubernetes Engine (GKE) cluster that needs to be remediated.
- Open the Cloud Shell by clicking on the icon on the top right corner of the console.
- In the Cloud Shell, run the following command to enable private cluster:
[CLUSTER_NAME] with the name of the GKE cluster that needs to be remediated and [MASTER_CIDR] with the IP range for the master node.- If you want to enable private nodes for an existing cluster, run the following command:
- If you want to enable private endpoint for an existing cluster, run the following command:
- Verify that the private endpoint is enabled by running the following command:
true.- Verify that private nodes are enabled by running the following command:
true.By following the above steps, you can remediate the misconfiguration “Private Cluster Should Be Enabled” for GCP using GCP CLI.Using Python
Using Python
To remediate the misconfiguration of “Private Cluster Should Be Enabled” in GCP using Python, you can follow the below steps:By following these steps, you can remediate the misconfiguration of “Private Cluster Should Be Enabled” in GCP using Python.
- Import the necessary libraries:
- Set up the credentials for authentication:
- Initialize the client for GCP Container API:
- Get the current state of the cluster:
- Check if the cluster is private:
- If the cluster is not private, enable private cluster:
- Wait for the operation to complete: