> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Authentication Using Client Certificates Is Disabled

### More Info:

Disable client certificate authentication for the cluster, as client certs cannot be easily revoked and are a weak long-lived credential. Rely on short-lived IAM-based authentication instead.

### Risk Level

Critical

### Address

Security

### Compliance Standards

* CIS GKE

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. **Identify clusters and current client certificate setting**
           * Run on: any machine with `gcloud` access
           * Command:
             ```bash theme={null}
             gcloud container clusters list --project YOUR_PROJECT_ID --format="table(name,location,master_version,endpoint)"
             ```
             For each cluster:
             ```bash theme={null}
             CLUSTER_NAME="YOUR_CLUSTER_NAME"
             LOCATION="YOUR_CLUSTER_LOCATION"   # e.g. us-central1, us-central1-c
             PROJECT_ID="YOUR_PROJECT_ID"

             gcloud container clusters describe "$CLUSTER_NAME" \
               --location "$LOCATION" \
               --project "$PROJECT_ID" \
               --format=json | jq '.masterAuth'
             ```
             Note whether `.masterAuth.clientKey` and `.masterAuth.clientCertificate` are null/empty or contain data.

        2. **Determine if client certificates are in active use**
           * Run on: any machine with `kubectl` access
           * For each context using this cluster, inspect user auth type:
             ```bash theme={null}
             kubectl config view --minify --raw
             ```
             Check under `users[].user` for `client-certificate` / `client-key` fields.
           * On admin workstations or CI/CD configs, search for kubeconfigs with client certs:
             ```bash theme={null}
             grep -R "client-certificate" -n ~/.kube 2>/dev/null || true
             grep -R "client-key" -n ~/.kube 2>/dev/null || true
             ```
             Document any automation or users that still rely on client cert auth.

        3. **Decide whether the cluster can be recreated without client certificates**
           * Review:
             * Whether you rely exclusively on GKE IAM / `gke-gcloud-auth-plugin` (preferred).
             * Any legacy tooling that cannot use IAM-based auth.
           * If any critical dependency requires client certificates and cannot be migrated, plan a migration first before proceeding.

        4. **Plan and perform cluster recreation with `--no-issue-client-certificate` (if acceptable)**
           * Design a migration: node pools, workloads, storage (PVs), and network settings (VPC, firewall rules, authorized networks).
           * Create a new cluster without client certificates:
             ```bash theme={null}
             NEW_CLUSTER_NAME="NEW_CLUSTER_NAME"
             LOCATION="YOUR_CLUSTER_LOCATION"
             PROJECT_ID="YOUR_PROJECT_ID"

             gcloud container clusters create "$NEW_CLUSTER_NAME" \
               --location "$LOCATION" \
               --project "$PROJECT_ID" \
               --no-issue-client-certificate \
               # add your existing cluster options here (network, subnetwork, master-authorized-networks, release-channel, etc.)
             ```
           * Recreate node pools, migrate workloads (e.g., via `kubectl apply` or GitOps), and rebind IAM and RBAC as needed.
           * Once validated, decommission the old cluster:
             ```bash theme={null}
             OLD_CLUSTER_NAME="OLD_CLUSTER_NAME"

             gcloud container clusters delete "$OLD_CLUSTER_NAME" \
               --location "$LOCATION" \
               --project "$PROJECT_ID"
             ```

        5. **Update all access methods to use IAM-based authentication**
           * Ensure `gcloud` and `gke-gcloud-auth-plugin` are installed and enabled on admin/CI machines:
             ```bash theme={null}
             gcloud components install gke-gcloud-auth-plugin
             gcloud container clusters get-credentials "$NEW_CLUSTER_NAME" \
               --location "$LOCATION" \
               --project "$PROJECT_ID"
             ```
           * Confirm kubeconfig users no longer reference client certificates:
             ```bash theme={null}
             kubectl config view --raw
             ```
             Verify user entries rely on `auth-provider: gcp` or `exec` with `gke-gcloud-auth-plugin`.

        6. **Verify remediation**
           * Run on: any machine with `gcloud` access
           * Command for each active cluster:
             ```bash theme={null}
             gcloud container clusters describe "$CLUSTER_NAME" \
               --location "$LOCATION" \
               --project "$PROJECT_ID" \
               --format=json | jq '.masterAuth.clientKey, .masterAuth.clientCertificate'
             ```
           * The values should be `null` (or absent) for clusters where client certificate authentication is disabled.
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot disable client certificate authentication, because this setting is managed at the GKE control-plane / cloud provider configuration layer (via gcloud, console, or IaC). Refer to the Manual Steps section for guidance on reviewing and recreating the cluster with `--no-issue-client-certificate`.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Report whether GKE clusters are issuing client certificates (CIS GKE 5.8.1)
        # Requires: gcloud, jq
        #
        # Run location: any machine with gcloud access to the projects you want to audit.

        set -euo pipefail

        # --- CONFIGURATION ---
        # Comma-separated list of GCP projects to check
        PROJECTS="my-project-1,my-project-2"   # <-- EDIT THIS

        IFS=',' read -r -a PROJECT_ARR <<< "$PROJECTS"

        echo "Checking client certificate issuance on GKE clusters (CIS GKE 5.8.1)"
        echo "Problematic state: masterAuth.clientKey != null (client certs enabled)"
        echo

        for PROJECT in "${PROJECT_ARR[@]}"; do
          echo "==== Project: $PROJECT ===="

          # List all clusters in the project (all locations)
          CLUSTERS_JSON=$(gcloud container clusters list \
            --project "$PROJECT" \
            --format json 2>/dev/null || echo "[]")

          CLUSTER_COUNT=$(echo "$CLUSTERS_JSON" | jq 'length')
          if [ "$CLUSTER_COUNT" -eq 0 ]; then
            echo "  No clusters found."
            echo
            continue
          fi

          echo "$CLUSTERS_JSON" | jq -r '.[] | "\(.name) \(.location)"' | while read -r CLUSTER_NAME LOCATION; do
            # Describe cluster to get masterAuth.clientKey
            DESC=$(gcloud container clusters describe "$CLUSTER_NAME" \
              --location "$LOCATION" \
              --project "$PROJECT" \
              --format json 2>/dev/null || echo "{}")

            CLIENT_KEY=$(echo "$DESC" | jq -r '.masterAuth.clientKey // "null"')

            if [ "$CLIENT_KEY" != "null" ] && [ "$CLIENT_KEY" != "" ]; then
              STATUS="NON-COMPLIANT"
              NOTE="(client certificate authentication ENABLED)"
            else
              STATUS="OK"
              NOTE="(client certificate authentication DISABLED)"
            fi

            echo "  Cluster: $CLUSTER_NAME"
            echo "    Location      : $LOCATION"
            echo "    Status        : $STATUS"
            echo "    clientKey set : $CLIENT_KEY"
            echo "    Note          : $NOTE"
            echo
          done
        done

        cat <<'EOF'
        Interpretation:

        - COMPLIANT / desired:
            masterAuth.clientKey == null
          In the script output this appears as:
            Status        : OK
            clientKey set : null
            Note          : (client certificate authentication DISABLED)

        - PROBLEM / needs review:
            masterAuth.clientKey != null
          In the script output this appears as:
            Status        : NON-COMPLIANT
            clientKey set : <base64-encoded key material>
            Note          : (client certificate authentication ENABLED)

        For NON-COMPLIANT clusters, review whether they should be replaced with
        new clusters created using:
          gcloud container clusters create CLUSTER_NAME --no-issue-client-certificate
        EOF
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>