Ensure Legacy Authorization (Abac) Disabled

#!/usr/bin/env bash
#
# Report Legacy ABAC (legacyAbac) status for all GKE clusters in a project (or all projects).
# REQUIREMENTS:
#   - gcloud
#   - jq
#   - (optional) GNU parallel or xargs for speed
#
# USAGE EXAMPLES:
#   Check all clusters in the current gcloud project:
#     ./check_gke_abac.sh
#
#   Check all clusters in a specific project:
#     ./check_gke_abac.sh --project my-project-id
#
#   Check all clusters in all accessible projects:
#     ./check_gke_abac.sh --all-projects
#
# OUTPUT:
#   CSV: project_id,location,cluster_name,legacyAbac.enabled
#   A line with "true" in the last column indicates a PROBLEM per CIS (ABAC enabled).
#

set -euo pipefail

PROJECT=""
ALL_PROJECTS="false"

while [[ $# -gt 0 ]]; do
  case "$1" in
    --project)
      PROJECT="$2"
      shift 2
      ;;
    --all-projects)
      ALL_PROJECTS="true"
      shift
      ;;
    *)
      echo "Unknown argument: $1" >&2
      exit 1
      ;;
  esac
done

# Determine project list
if [[ "${ALL_PROJECTS}" == "true" ]]; then
  mapfile -t PROJECTS < <(gcloud projects list --format="value(projectId)")
else
  if [[ -z "${PROJECT}" ]]; then
    PROJECT="$(gcloud config get-value project 2>/dev/null || true)"
    if [[ -z "${PROJECT}" || "${PROJECT}" == "(unset)" ]]; then
      echo "No project set. Use --project or 'gcloud config set project ...'." >&2
      exit 1
    fi
  fi
  PROJECTS=("${PROJECT}")
fi

echo "project_id,location,cluster_name,legacyAbac.enabled"

for P in "${PROJECTS[@]}"; do
  # List all clusters (regional and zonal) in the project
  mapfile -t CLUSTERS < <(
    gcloud container clusters list \
      --project "${P}" \
      --format="value(name,location)" || true
  )

  if [[ ${#CLUSTERS[@]} -eq 0 ]]; then
    continue
  fi

  for ROW in "${CLUSTERS[@]}"; do
    # ROW is "<name>  <location>"
    CLUSTER_NAME="$(awk '{print $1}' <<< "${ROW}")"
    LOCATION="$(awk '{print $2}' <<< "${ROW}")"

    # Describe the cluster and extract legacyAbac.enabled (may be null if never set)
    LEGACY_ABAC_ENABLED="$(
      gcloud container clusters describe "${CLUSTER_NAME}" \
        --location "${LOCATION}" \
        --project "${P}" \
        --format=json \
        | jq -r '.legacyAbac.enabled // "false"'
    )"

    echo "${P},${LOCATION},${CLUSTER_NAME},${LEGACY_ABAC_ENABLED}"
  done
done