Manage Kubernetes RBAC Users With Google Groups
More Info:
Cluster Administrators should leverage G Suite Groups and Cloud IAM to assign Kubernetes user roles to a collection of users, instead of to individual emails using only Cloud IAM.Risk Level
LowAddress
Security, Reliability, Operational Excellence, Performance EfficiencyCompliance Standards
SOC2, CISGKETriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “Manage Kubernetes RBAC Users With Google Groups” in GCP using GCP console, follow the below steps:
- Go to the GCP console and navigate to the Kubernetes Engine section.
- Select the cluster for which you want to manage RBAC users.
- Click on the “Security” tab and then select “Identity and Access Management”.
- In the “Identity and Access Management” section, click on the “Add” button.
- Add the Google group that you want to use for managing RBAC users.
- Click on the “Role” drop-down and select the appropriate role that you want to assign to the group.
- Click on the “Save” button to save the changes.
Using CLI
Using CLI
The misconfiguration is related to managing Kubernetes RBAC Users with Google Groups. To remediate this issue, follow the below steps:
- Open the Google Cloud Console and navigate to the Kubernetes Engine.
- Select the cluster for which you want to manage the Kubernetes RBAC users.
- Click on the “Edit” button to edit the cluster.
- In the “Security” tab, select the “Security” option.
- In the “Security” section, click on the “Edit” button to edit the security settings.
- In the “Edit Security” section, scroll down to the “Kubernetes RBAC” section.
- Under the “Kubernetes RBAC” section, select the “Google Groups” option.
- Enter the name of the Google Group you want to use to manage the Kubernetes RBAC users.
- Click on the “Save” button to save the changes.
- Now, all the users in the Google Group will have the same access as the Kubernetes RBAC users.
- Open the GCP CLI and navigate to the Kubernetes Engine.
- Run the following command to set the Kubernetes RBAC users with Google Groups:
- Replace [CLUSTER_NAME] with the name of your cluster, [ZONE] with the zone where your cluster is located, and [GOOGLE_GROUP_NAME] with the name of the Google Group you want to use to manage the Kubernetes RBAC users.
- Once the command is executed successfully, all the users in the Google Group will have the same access as the Kubernetes RBAC users.
Using Python
Using Python
To remediate the misconfiguration “Manage Kubernetes RBAC Users With Google Groups” for GCP using Python, you can follow the below steps:
- Install the required libraries:
- Set up authentication by creating a service account and downloading the JSON key file.
- Create a Python script with the following code:
-
Replace the placeholders
<PROJECT_ID>,<ZONE>,<CLUSTER_NAME>,<GROUP_EMAIL>, and<PATH_TO_JSON_KEY_FILE>with the appropriate values. - Run the Python script to add the Google group to the Kubernetes RBAC configuration.