Skip to main content

Shielded Nodes Should Be Used For Kubernetes Cluster

More Info:​

Ensure that shielded nodes are used in node pools

Risk Level​

Medium

Address​

Operational Excellence, Reliability, Security

Compliance Standards​

  • CIS GKE

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration of not using Shielded Nodes for a Kubernetes Cluster in GCP, you can follow the below steps using GCP console:

  1. Go to the GCP Console and select the Kubernetes Engine from the navigation menu.
  2. Select the Kubernetes Cluster for which you want to enable Shielded Nodes.
  3. Click on the Edit button at the top of the page.
  4. Scroll down to the Node Pools section and click on the node pool name for which you want to enable Shielded Nodes.
  5. In the Node Pool edit page, scroll down to the Security section and enable the Shielded Nodes option.
  6. Click on the Save button to save the changes.

After completing these steps, Shielded Nodes will be enabled for the selected node pool in your Kubernetes Cluster. You can repeat these steps for all the node pools in your cluster to ensure that all nodes are using Shielded Nodes.

Using CLI

To remediate the misconfiguration of using shielded nodes for a Kubernetes cluster on GCP using GCP CLI, you can follow the below steps:

  1. First, you need to check if the Kubernetes cluster is using shielded nodes or not. To check this, run the following command:
gcloud container clusters describe [CLUSTER-NAME] --zone [ZONE] | grep -i shielded
  1. If the output of the above command shows that shielded nodes are not enabled, then you can enable it by running the following command:
gcloud beta container clusters update [CLUSTER-NAME] --zone [ZONE] --update-shielded-nodes
  1. If the output of the above command shows an error message saying that the beta component is not enabled, then you need to enable it by running the following command:
gcloud components install beta

  1. Once the beta component is installed, you can run the previous command again to enable the shielded nodes.

  2. After enabling the shielded nodes, you can verify it by running the first command again. The output should show that shielded nodes are enabled for the Kubernetes cluster.

By following the above steps, you can remediate the misconfiguration of not using shielded nodes for a Kubernetes cluster on GCP using GCP CLI.

Using Python

To remediate the misconfiguration of not using shielded nodes for a Kubernetes cluster in GCP using Python, follow these steps:

  1. Install the Google Cloud SDK and Python client library using the following commands:
curl https://sdk.cloud.google.com | bash
exec -l $SHELL
gcloud init
pip install google-cloud

  1. Create a new GCP project or select an existing project to work with.

  2. Enable the necessary APIs for the project using the following command:

gcloud services enable container.googleapis.com
  1. Authenticate the SDK using the following command:
gcloud auth login
  1. Create a new Kubernetes cluster using the following command:
gcloud container clusters create [CLUSTER_NAME] --shielded-secure-boot --shielded-integrity-monitoring
  1. Verify that the shielded nodes are enabled for the cluster using the following command:
gcloud container clusters describe [CLUSTER_NAME] --format='get(shieldedNodes.enabled)'

This command should return "True" indicating that the shielded nodes are enabled for the cluster.

  1. If you have an existing cluster, you can update the cluster to enable shielded nodes using the following command:
gcloud container clusters update [CLUSTER_NAME] --shielded-secure-boot --shielded-integrity-monitoring

This command will update the existing cluster to enable shielded nodes.

By following these steps, the misconfiguration of not using shielded nodes for a Kubernetes cluster in GCP can be remediated using Python.

Using Terraform
resource "google_container_cluster" "GKE_CLUSTER" {
  name     = "GKE_CLUSTER_NAME"          # Replace with your cluster name
  location = "GCP_REGION_OR_ZONE"        # e.g. "us-central1" or "us-central1-a"

  # ...other required arguments (network, subnetwork, ip_allocation_policy, etc.)

  remove_default_node_pool = true
  initial_node_count       = 1

  # Optional but recommended: enforce shielded nodes at cluster level so all new node pools inherit it
  enable_shielded_nodes = true
}

resource "google_container_node_pool" "GKE_NODE_POOL" {
  name       = "GKE_NODE_POOL_NAME"      # Replace with your node pool name
  cluster    = google_container_cluster.GKE_CLUSTER.name
  location   = google_container_cluster.GKE_CLUSTER.location

  node_count = 3

  node_config {
    machine_type = "e2-medium"           # Replace as needed

    shielded_instance_config {
      enable_secure_boot = true
    }

    # ...any other node_config settings (oauth_scopes, service_account, etc.)
  }

  # ...any autoscaling / management blocks as needed
}

Enabling shielded_instance_config.enable_secure_boot = true on an existing node pool forces recreation of the nodes in that pool (the node pool may be replaced depending on current settings), which is a disruptive change for workloads running on those nodes.

To verify, terraform plan should show the google_container_node_pool (and optionally google_container_cluster) gaining shielded_instance_config.enable_secure_boot = true, with node recreation indicated in the plan.

Additional Reading:​