Skip to main content

Basic Authentication Using Static Passwords Is Disabled

More Info:​

Kubernetes provides the option to use client certificates for user authentication. However as there is no way to revoke these certificates when a user leaves an organization or loses their credential, they are not suitable for this purpose. It is not possible to fully disable client certificate use within a cluster as it is used for component to component authentication.

Risk Level​

Low

Address​

Security

Compliance Standards​

  • CIS GKE

Triage and Remediation​

Remediation​

Manual Steps

  1. Identify clusters that may allow Basic Authentication

    • On any machine with gcloud configured for the project: 
      gcloud config get-value project
      gcloud container clusters list --format="table(name,location,masterAuth.username,masterAuth.clientCertificate)"
    • Note any cluster where masterAuth.username is non-empty; these are candidates for static basic auth.

  2. Confirm Basic Authentication status for a specific cluster

    • For each cluster of concern, run: 
      gcloud container clusters describe CLUSTER_NAME \
        --region=REGION \
        --format="yaml(masterAuth)"
    • Review masterAuth.username and masterAuth.password. If they are set, the cluster has (or had) static basic auth configured.

  3. Review how users and automation currently access the cluster

    • On any machine with kubectl access to the cluster, check current kubeconfig contexts and auth: 
      kubectl config view --minify --raw
    • Confirm that users and CI/CD systems are using supported mechanisms (e.g., GKE/OIDC, Google accounts/service accounts via gcloud, Workload Identity), not embedded static usernames/passwords to reach the master endpoint.

  4. Decide whether it is safe to disable Basic Authentication

    • If you find any consumers still using basic auth (username/password in scripts, tools, or kubeconfigs), plan to migrate them to supported authentication (GCP IAM + gcloud, OIDC, or service accounts) before proceeding.
    • If all access paths are migrated or confirmed not to rely on static basic auth, proceed to disable it.

  5. Disable Basic Authentication for the cluster

    • From any machine with gcloud access and appropriate IAM permissions: 
      gcloud container clusters update CLUSTER_NAME \
        --region=REGION \
        --no-enable-basic-auth
    • Be aware this changes master authentication behavior; any remaining clients using static username/password to reach the control plane will fail after this change.

  6. Verify that Basic Authentication is disabled

    • Re-describe the cluster and confirm there is no static basic auth configured: 
      gcloud container clusters describe CLUSTER_NAME \
        --region=REGION \
        --format="yaml(masterAuth)"
    • Ensure masterAuth.username and masterAuth.password are empty or not present, and that no clients can successfully authenticate using old static credentials.
Using kubectl

kubectl cannot disable basic authentication using static passwords because this setting is only configurable at the managed control-plane / cloud provider level (for GKE, via gcloud, console, or IaC). Refer to the Manual Steps section for how to review and update the cluster configuration to disable basic auth.

Automation
#!/usr/bin/env bash
#
# Check GKE clusters for Basic Authentication (static password) usage
# Requires:
#   - gcloud installed and authenticated
#   - jq installed
#
# Run on: any machine with gcloud access to the relevant project(s)

set -euo pipefail

PROJECTS=("$@")

if [ "${#PROJECTS[@]}" -eq 0 ]; then
  echo "Usage: $0 PROJECT_ID [PROJECT_ID_2 ...]" >&2
  exit 1
fi

for PROJECT in "${PROJECTS[@]}"; do
  echo "=== Project: ${PROJECT} ==="
  CLUSTERS_JSON=$(gcloud container clusters list \
    --project="${PROJECT}" \
    --format=json 2>/dev/null || echo "[]")

  CLUSTER_COUNT=$(echo "${CLUSTERS_JSON}" | jq 'length')
  if [ "${CLUSTER_COUNT}" -eq 0 ]; then
    echo "  No GKE clusters found."
    continue
  fi

  echo "${CLUSTERS_JSON}" | jq -r '.[] | @base64' | while read -r ROW; do
    _jq() { echo "${ROW}" | base64 --decode | jq -r "${1}"; }

    NAME=$(_jq '.name')
    LOCATION=$(_jq '.location')
    MASTER_AUTH=$(_jq '.masterAuth')

    echo "  Cluster: ${NAME} (${LOCATION})"

    # masterAuth.username and masterAuth.password are deprecated but still
    # indicate legacy Basic Auth if set.
    USERNAME=$(echo "${MASTER_AUTH}" | jq -r '.username // ""')
    PASSWORD=$(echo "${MASTER_AUTH}" | jq -r '.password // ""')

    CLIENT_CERT_CONFIG=$(echo "${MASTER_AUTH}" | jq '.clientCertificateConfig // {}')
    ISSUE_CLIENT_CERT=$(echo "${CLIENT_CERT_CONFIG}" | jq -r '.issueClientCertificate // false')

    # Report state
    if [ -n "${USERNAME}" ] || [ -n "${PASSWORD}" ]; then
      echo "    [PROBLEM] Basic Auth static credentials present:"
      echo "      masterAuth.username: '${USERNAME}'"
      echo "      masterAuth.password: '${PASSWORD:+<non-empty>}'"
      echo "    This indicates Basic Authentication using static passwords is ENABLED."
    else
      echo "    [OK] No static Basic Auth username/password configured."
    fi

    if [ "${ISSUE_CLIENT_CERT}" = "true" ]; then
      echo "    [INFO] Client certificates are issued for cluster users (issueClientCertificate=true)."
    else
      echo "    [INFO] Client certificates are NOT issued for cluster users (issueClientCertificate=false)."
    fi

    echo
  done
done

Explanation of output indicating a problem:

  • For any cluster where the script prints:

    • [PROBLEM] Basic Auth static credentials present: followed by non-empty masterAuth.username or a non-empty password placeholder (<non-empty>),

    that cluster is using legacy Basic Authentication with static credentials and should be reviewed and remediated (e.g., by recreating or updating the cluster with --no-enable-basic-auth according to your change process).