> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Shielded Nodes Should Be Used For Kubernetes Cluster ### More Info: Ensure that shielded nodes are used in node pools ### Risk Level Medium ### Address Operational Excellence, Reliability, Security ### Compliance Standards * CIS GKE ### Triage and Remediation ### Remediation To remediate the misconfiguration of not using Shielded Nodes for a Kubernetes Cluster in GCP, you can follow the below steps using GCP console: 1. Go to the GCP Console and select the Kubernetes Engine from the navigation menu. 2. Select the Kubernetes Cluster for which you want to enable Shielded Nodes. 3. Click on the Edit button at the top of the page. 4. Scroll down to the Node Pools section and click on the node pool name for which you want to enable Shielded Nodes. 5. In the Node Pool edit page, scroll down to the Security section and enable the Shielded Nodes option. 6. Click on the Save button to save the changes. After completing these steps, Shielded Nodes will be enabled for the selected node pool in your Kubernetes Cluster. You can repeat these steps for all the node pools in your cluster to ensure that all nodes are using Shielded Nodes. # To remediate the misconfiguration of using shielded nodes for a Kubernetes cluster on GCP using GCP CLI, you can follow the below steps: 1. First, you need to check if the Kubernetes cluster is using shielded nodes or not. To check this, run the following command: ``` gcloud container clusters describe [CLUSTER-NAME] --zone [ZONE] | grep -i shielded ``` 2. If the output of the above command shows that shielded nodes are not enabled, then you can enable it by running the following command: ``` gcloud beta container clusters update [CLUSTER-NAME] --zone [ZONE] --update-shielded-nodes ``` 3. If the output of the above command shows an error message saying that the beta component is not enabled, then you need to enable it by running the following command: ``` gcloud components install beta ``` 4. Once the beta component is installed, you can run the previous command again to enable the shielded nodes. 5. After enabling the shielded nodes, you can verify it by running the first command again. The output should show that shielded nodes are enabled for the Kubernetes cluster. By following the above steps, you can remediate the misconfiguration of not using shielded nodes for a Kubernetes cluster on GCP using GCP CLI. To remediate the misconfiguration of not using shielded nodes for a Kubernetes cluster in GCP using Python, follow these steps: 1. Install the Google Cloud SDK and Python client library using the following commands: ``` curl https://sdk.cloud.google.com | bash exec -l $SHELL gcloud init pip install google-cloud ``` 2. Create a new GCP project or select an existing project to work with. 3. Enable the necessary APIs for the project using the following command: ``` gcloud services enable container.googleapis.com ``` 4. Authenticate the SDK using the following command: ``` gcloud auth login ``` 5. Create a new Kubernetes cluster using the following command: ``` gcloud container clusters create [CLUSTER_NAME] --shielded-secure-boot --shielded-integrity-monitoring ``` 6. Verify that the shielded nodes are enabled for the cluster using the following command: ``` gcloud container clusters describe [CLUSTER_NAME] --format='get(shieldedNodes.enabled)' ``` This command should return "True" indicating that the shielded nodes are enabled for the cluster. 7. If you have an existing cluster, you can update the cluster to enable shielded nodes using the following command: ``` gcloud container clusters update [CLUSTER_NAME] --shielded-secure-boot --shielded-integrity-monitoring ``` This command will update the existing cluster to enable shielded nodes. By following these steps, the misconfiguration of not using shielded nodes for a Kubernetes cluster in GCP can be remediated using Python. ```hcl theme={null} resource "google_container_cluster" "GKE_CLUSTER" { name = "GKE_CLUSTER_NAME" # Replace with your cluster name location = "GCP_REGION_OR_ZONE" # e.g. "us-central1" or "us-central1-a" # ...other required arguments (network, subnetwork, ip_allocation_policy, etc.) remove_default_node_pool = true initial_node_count = 1 # Optional but recommended: enforce shielded nodes at cluster level so all new node pools inherit it enable_shielded_nodes = true } resource "google_container_node_pool" "GKE_NODE_POOL" { name = "GKE_NODE_POOL_NAME" # Replace with your node pool name cluster = google_container_cluster.GKE_CLUSTER.name location = google_container_cluster.GKE_CLUSTER.location node_count = 3 node_config { machine_type = "e2-medium" # Replace as needed shielded_instance_config { enable_secure_boot = true } # ...any other node_config settings (oauth_scopes, service_account, etc.) } # ...any autoscaling / management blocks as needed } ``` Enabling `shielded_instance_config.enable_secure_boot = true` on an existing node pool forces recreation of the nodes in that pool (the node pool may be replaced depending on current settings), which is a disruptive change for workloads running on those nodes. To verify, `terraform plan` should show the `google_container_node_pool` (and optionally `google_container_cluster`) gaining `shielded_instance_config.enable_secure_boot = true`, with node recreation indicated in the plan. ### Additional Reading: * [https://cloud.google.com/kubernetes-engine/docs/how-to/shielded-gke-nodes](https://cloud.google.com/kubernetes-engine/docs/how-to/shielded-gke-nodes)