K8s Use VPC Native Clusters Remediation

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration of not using VPC-Native Clusters in GCP, you can follow the below steps using the GCP console:

Open the GCP console and navigate to the Kubernetes Engine page.
Select your cluster that you want to make VPC-native.
Click on the "Edit" button at the top of the page.
Scroll down to the "Networking" section and click on "Enable VPC-native (using alias IP)".
Select the VPC network that you want to use for your cluster.
Select the subnet that you want to use for your cluster.
Click on the "Save" button at the bottom of the page to apply the changes.
Verify that the VPC-native configuration is applied by checking the "Networking" section of your cluster details page.

By following these steps, you will be able to remediate the misconfiguration of not using VPC-Native Clusters in GCP and ensure that your cluster is using VPC-native networking.

Using CLI

To remediate the misconfiguration "Ensure Use Of VPC-Native Clusters" for GCP using GCP CLI, follow the below steps:

Open the GCP Cloud Shell.
Run the following command to enable VPC-native clusters for the default network:

gcloud container clusters update [CLUSTER_NAME] --zone [ZONE] --enable-ip-alias

Replace [CLUSTER_NAME] with the name of the cluster that you want to update and [ZONE] with the zone in which the cluster is located.

Run the following command to verify that the VPC-native clusters are enabled:

gcloud container clusters describe [CLUSTER_NAME] --zone [ZONE] | grep -i ipallocationpolicy

This command will display the IP allocation policy for the cluster. If the IP allocation policy is "Use IP aliases", then VPC-native clusters are enabled.

Repeat the above steps for all the GCP clusters in your environment.

By following the above steps, you can ensure the use of VPC-native clusters in GCP using GCP CLI.

Using Python

To remediate the misconfiguration "Ensure Use Of VPC-Native Clusters" for GCP using Python, you can follow the below steps:

Install the necessary Python libraries:

pip install google-auth google-auth-oauthlib google-auth-httplib2 google-cloud-container google-cloud-storage

Authenticate with GCP using a service account:

from google.oauth2 import service_account

credentials = service_account.Credentials.from_service_account_file('path/to/service_account.json')

Import the necessary libraries:

from google.cloud import container_v1
from google.cloud.container_v1.types import Cluster

client = container_v1.ClusterManagerClient(credentials=credentials)

Get the list of existing clusters in the project:

project_id = 'your-project-id'
zone = 'your-zone'

cluster_list = client.list_clusters(project_id, zone)

Check if each cluster is VPC-native or not:

for cluster in cluster_list.clusters:
    if not cluster.ip_allocation_policy.use_ip_aliases:
        # Update the cluster to use VPC-native
        cluster.ip_allocation_policy.use_ip_aliases = True
        update_request = Cluster(name=cluster.name, ip_allocation_policy=cluster.ip_allocation_policy)
        operation = client.update_cluster(project_id, zone, update_request)
        operation.result()

After running the script, all the clusters that are not VPC-native would be updated to use VPC-native.

Note: Make sure to replace 'your-project-id' and 'your-zone' with the actual project ID and zone where your GKE clusters are located. Also, make sure to have the necessary permissions to update the clusters.

Using Terraform

resource "google_container_cluster" "GKE_CLUSTER" {
  name     = "GKE_CLUSTER_NAME"          # <-- replace with your cluster name
  location = "GCP_REGION_OR_ZONE"        # <-- e.g. "us-central1" (regional) or "us-central1-a" (zonal)

  network    = "projects/PROJECT_ID/global/networks/VPC_NAME"              # <-- replace
  subnetwork = "projects/PROJECT_ID/regions/REGION/subnetworks/SUBNET_NAME" # <-- replace

  # This enables a VPC-native (Alias IP) cluster
  networking_mode = "VPC_NATIVE"

  ip_allocation_policy {
    # EITHER reference existing secondary ranges on the subnetwork:
    cluster_secondary_range_name  = "PODS_SECONDARY_RANGE_NAME"     # <-- replace with pods secondary range name
    services_secondary_range_name = "SERVICES_SECONDARY_RANGE_NAME" # <-- replace with services secondary range name

    # OR, if you want GKE to create ranges automatically instead, comment the above
    # two lines and use explicit CIDR blocks like:
    # cluster_ipv4_cidr_block  = "10.20.0.0/14"
    # services_ipv4_cidr_block = "10.24.0.0/20"
  }

  # ...other cluster settings...
}

Enabling networking_mode = "VPC_NATIVE" and ip_allocation_policy on an existing routes-based (non–VPC-native) cluster forces replacement of the cluster; plan for downtime and stateful workloads accordingly, as there is no in-place conversion.

Verification: terraform plan should show networking_mode changing to VPC_NATIVE (if it was ROUTES before) and an ip_allocation_policy block being added, and for an existing routes-based cluster it will show the cluster resource being destroyed and recreated.

Triage and Remediation​

Remediation​

Triage and Remediation

Remediation