Skip to main content

Ensure Legacy Authorization (Abac) Disabled

More Info:​

Legacy Authorization, Also Known As Attribute-Based Access Control (Abac) Has Been Superseded By Role-Based Access Control (Rbac) And Is Not Under Active Development. Rbac Is The Recommended Way To Manage Permissions In Kubernetes

Risk Level​

Low

Address​

Security

Compliance Standards​

  • CIS GKE

Triage and Remediation​

Remediation​

Manual Steps

  1. Identify all GKE clusters to review (run on any machine with gcloud configured):

    gcloud container clusters list --project YOUR_PROJECT_ID --format="table(name,location,status)"

    Repeat the following steps for each cluster shown.

  2. Check whether ABAC (legacy authorization) is enabled for a given cluster (any machine with gcloud):

    CLUSTER_NAME="your-cluster-name"
    LOCATION="your-cluster-location"
    PROJECT_ID="YOUR_PROJECT_ID"

    gcloud container clusters describe "$CLUSTER_NAME" \
      --location "$LOCATION" \
      --project "$PROJECT_ID" \
      --format json | jq '.legacyAbac'

    Interpret the result:

    • If null or {} → ABAC not configured (effectively disabled).
    • If it contains "enabled": true → ABAC is enabled and should be reviewed/disabled.

  3. Review for any remaining ABAC-dependent workloads or processes (any machine with kubectl access to the cluster):

    • List current RBAC bindings: 
      kubectl get clusterrolebindings,rolebindings -A
    • Confirm that users/service accounts relying on cluster access are granted permissions via RBAC (ClusterRoleBindings/RoleBindings) and not via any out-of-band ABAC files or legacy documentation.
    • Check internal docs / automation (CI/CD, scripts) for any references to “ABAC” or expectations of blanket access.

  4. Decide whether it is safe to disable ABAC:

    • If all access is covered by RBAC and no known dependency on ABAC remains, proceed to disable ABAC.
    • If there is uncertainty, plan a maintenance window and communicate the change, since disabling ABAC can remove broad implicit access that some legacy clients may rely on.

  5. Disable Legacy Authorization (ABAC) on the cluster (any machine with gcloud):

    gcloud container clusters update "$CLUSTER_NAME" \
      --location "$LOCATION" \
      --project "$PROJECT_ID" \
      --no-enable-legacy-authorization

    Note: This is a control-plane configuration change; allow time for the update to complete and monitor for access issues.

  6. Verify ABAC is disabled (any machine with gcloud):

    gcloud container clusters describe "$CLUSTER_NAME" \
      --location "$LOCATION" \
      --project "$PROJECT_ID" \
      --format json | jq '.legacyAbac'

    Confirm the output is null or an empty object and that there is no "enabled": true field.

Using kubectl

kubectl cannot disable Legacy Authorization (ABAC) because this setting is managed on the GKE control-plane via Google Cloud (gcloud/console/IaC), not through Kubernetes API objects. To remediate this finding, follow the guidance in the Manual Steps section using the Google Cloud configuration surface.

Automation
#!/usr/bin/env bash
#
# Report Legacy ABAC (legacyAbac) status for all GKE clusters in a project (or all projects).
# REQUIREMENTS:
#   - gcloud
#   - jq
#   - (optional) GNU parallel or xargs for speed
#
# USAGE EXAMPLES:
#   Check all clusters in the current gcloud project:
#     ./check_gke_abac.sh
#
#   Check all clusters in a specific project:
#     ./check_gke_abac.sh --project my-project-id
#
#   Check all clusters in all accessible projects:
#     ./check_gke_abac.sh --all-projects
#
# OUTPUT:
#   CSV: project_id,location,cluster_name,legacyAbac.enabled
#   A line with "true" in the last column indicates a PROBLEM per CIS (ABAC enabled).
#

set -euo pipefail

PROJECT=""
ALL_PROJECTS="false"

while [[ $# -gt 0 ]]; do
  case "$1" in
    --project)
      PROJECT="$2"
      shift 2
      ;;
    --all-projects)
      ALL_PROJECTS="true"
      shift
      ;;
    *)
      echo "Unknown argument: $1" >&2
      exit 1
      ;;
  esac
done

# Determine project list
if [[ "${ALL_PROJECTS}" == "true" ]]; then
  mapfile -t PROJECTS < <(gcloud projects list --format="value(projectId)")
else
  if [[ -z "${PROJECT}" ]]; then
    PROJECT="$(gcloud config get-value project 2>/dev/null || true)"
    if [[ -z "${PROJECT}" || "${PROJECT}" == "(unset)" ]]; then
      echo "No project set. Use --project or 'gcloud config set project ...'." >&2
      exit 1
    fi
  fi
  PROJECTS=("${PROJECT}")
fi

echo "project_id,location,cluster_name,legacyAbac.enabled"

for P in "${PROJECTS[@]}"; do
  # List all clusters (regional and zonal) in the project
  mapfile -t CLUSTERS < <(
    gcloud container clusters list \
      --project "${P}" \
      --format="value(name,location)" || true
  )

  if [[ ${#CLUSTERS[@]} -eq 0 ]]; then
    continue
  fi

  for ROW in "${CLUSTERS[@]}"; do
    # ROW is "<name>  <location>"
    CLUSTER_NAME="$(awk '{print $1}' <<< "${ROW}")"
    LOCATION="$(awk '{print $2}' <<< "${ROW}")"

    # Describe the cluster and extract legacyAbac.enabled (may be null if never set)
    LEGACY_ABAC_ENABLED="$(
      gcloud container clusters describe "${CLUSTER_NAME}" \
        --location "${LOCATION}" \
        --project "${P}" \
        --format=json \
        | jq -r '.legacyAbac.enabled // "false"'
    )"

    echo "${P},${LOCATION},${CLUSTER_NAME},${LEGACY_ABAC_ENABLED}"
  done
done

How to run (any machine with gcloud access):

  1. Save as check_gke_abac.sh and make it executable: 
    chmod +x ./check_gke_abac.sh
  2. Run for your project: 
    ./check_gke_abac.sh --project YOUR_PROJECT_ID
    or for all projects you can see: 
    ./check_gke_abac.sh --all-projects

How to interpret output (problem indication):

  • Output line format: 
    project_id,location,cluster_name,legacyAbac.enabled
  • Any line where legacyAbac.enabled is true indicates a problem for CIS GKE 5.8.4 (Legacy Authorization / ABAC is enabled and should be reviewed and disabled if not strictly required).

Additional Reading:​