Consider GKE Sandbox For Running Untrusted Workloads

More Info:

Use GKE Sandbox to restrict untrusted workloads as an additional layer of protection when running in a multi-tenant environment.

Risk Level

High

Address

Security, Reliability, Operational Excellence, Performance Efficiency

Compliance Standards

CISGKE

Triage and Remediation

Remediation

Using Console

Using CLI

The misconfiguration of using GKE Sandbox for running untrusted workloads can be remediated in GCP using the following steps through GCP CLI:

Firstly, check if there are any workloads running on GKE Sandbox that are untrusted. This can be done by running the following command in GCP CLI:
```
gcloud alpha container node-pools describe [NODE_POOL_NAME] --cluster=[CLUSTER_NAME] --zone=[ZONE]
```
Replace [NODE_POOL_NAME], [CLUSTER_NAME] and [ZONE] with the corresponding values for your GKE Sandbox.
If there are any workloads running on GKE Sandbox that are untrusted, create a new node pool with the appropriate security settings. This can be done by running the following command in GCP CLI:
```
gcloud beta container node-pools create [NEW_NODE_POOL_NAME] --cluster=[CLUSTER_NAME] --zone=[ZONE] --sandbox=unconfined
```
Replace [NEW_NODE_POOL_NAME], [CLUSTER_NAME] and [ZONE] with the corresponding values for your GKE Sandbox. The --sandbox=unconfined flag will create a new node pool with unrestricted sandboxing, which is suitable for running untrusted workloads.
Migrate the workloads from the old node pool to the new node pool. This can be done by running the following command in GCP CLI:
```
kubectl drain [NODE_NAME] --ignore-daemonsets --delete-local-data
```
Replace [NODE_NAME] with the name of the node that is running the untrusted workload. This command will safely evict all the pods running on the node.
Delete the old node pool. This can be done by running the following command in GCP CLI:
```
gcloud beta container node-pools delete [NODE_POOL_NAME] --cluster=[CLUSTER_NAME] --zone=[ZONE]
```
Replace [NODE_POOL_NAME], [CLUSTER_NAME] and [ZONE] with the corresponding values for your GKE Sandbox.

By following these steps, you can remediate the misconfiguration of using GKE Sandbox for running untrusted workloads in GCP using GCP CLI.

Using Python

To remediate the misconfiguration “Consider GKE Sandbox For Running Untrusted Workloads” for GCP using Python, follow the below steps:

Install the necessary libraries:

pip install google-auth google-auth-oauthlib google-auth-httplib2 google-cloud-container

Set the project ID and cluster name for which you want to enable GKE Sandbox.
```
project_id = "your-project-id"
cluster_name = "your-cluster-name"
```

Authenticate using your Google Cloud credentials:

from google.oauth2 import service_account

credentials = service_account.Credentials.from_service_account_file('path/to/your/credentials.json')

Enable GKE Sandbox for the cluster:

from google.cloud import container_v1

client = container_v1.ClusterManagerClient(credentials=credentials)

cluster = client.get_cluster(project_id, "us-central1", cluster_name)

if not cluster.sandbox_config:
    sandbox_config = container_v1.SandboxConfig(pod_sandbox_spec=container_v1.PodSandboxConfig())
    cluster.sandbox_config = sandbox_config
    update_request = container_v1.UpdateClusterRequest(cluster=cluster, update_mask={"paths": ["sandbox_config"]})
    operation = client.update_cluster(update_request)
    operation.result()

Verify that GKE Sandbox is enabled:

cluster = client.get_cluster(project_id, "us-central1", cluster_name)

if cluster.sandbox_config:
    print("GKE Sandbox is enabled for the cluster.")
else:
    print("GKE Sandbox is not enabled for the cluster.")

By following these steps, you can remediate the misconfiguration “Consider GKE Sandbox For Running Untrusted Workloads” for GCP using Python.

Additional Reading:

https://cloud.google.com/kubernetes-engine/docs/how-to/sandbox-pods

GCP Introduction

GCP Pricing

GCP Threats

GCP Misconfigurations

Resources

GCP Threats

Consider GKE Sandbox For Running Untrusted Workloads

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

GCP Introduction

GCP Pricing

GCP Threats

GCP Misconfigurations

Resources

GCP Threats

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​Additional Reading:

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading: