Secure Boot Should Be Enabled For Kubernetes Node Pools
More Info:
Ensure that kubernetes node pools have secure boot enabledRisk Level
MediumAddress
Security, Reliability, Operational ExcellenceCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “Secure Boot Should Be Enabled For Kubernetes Node Pools” for GCP using GCP console, follow the below steps:
- Open the GCP console and navigate to the Kubernetes Engine page.
- Click on the name of the cluster for which you want to enable Secure Boot.
- Click on the “Nodes” tab and select the node pool for which you want to enable Secure Boot.
- Click on the “Edit” button at the top of the page.
- In the “Node pool details” section, scroll down to the “Security” section.
- Check the box next to “Enable secure boot”.
- Click on the “Save” button at the bottom of the page.
Using CLI
Using CLI
To remediate the misconfiguration “Secure Boot Should Be Enabled For Kubernetes Node Pools” for GCP using GCP CLI, you can follow the below steps:
- Open the Cloud Shell in GCP Console.
-
Run the following command to get the list of node pools in your GKE cluster:
Replace [CLUSTER_NAME] with the name of your GKE cluster and [ZONE] with the zone in which your cluster is located.
-
For each node pool, run the following command to enable secure boot:
Replace [NODE_POOL_NAME] with the name of the node pool.
-
Verify that secure boot is enabled for the node pool by running the following command:
If the output shows “secureBoot: true”, then secure boot is enabled for the node pool.
- Repeat steps 3-4 for all the node pools in your GKE cluster.
Using Python
Using Python
To remediate the misconfiguration “Secure Boot Should Be Enabled For Kubernetes Node Pools” for GCP using Python, you can follow these steps:
- Install the Google Cloud SDK and Python client library for GCP.
- Create a new Python script and import the necessary libraries:
- Authenticate with GCP using the following code:
- Get the list of node pools in your GCP project using the following code:
- For each node pool, check if Secure Boot is enabled. If it is not enabled, update the node pool with Secure Boot enabled using the following code:
- Save the Python script and run it to remediate the misconfiguration.