> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Legacy Authorization (Abac) Disabled

### More Info:

Legacy Authorization, Also Known As Attribute-Based Access Control (Abac) Has Been Superseded By Role-Based Access Control (Rbac) And Is Not Under Active Development. Rbac Is The Recommended Way To Manage Permissions In Kubernetes

### Risk Level

Low

### Address

Security

### Compliance Standards

* CIS GKE

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. **Identify all GKE clusters to review** (run on any machine with `gcloud` configured):
           ```bash theme={null}
           gcloud container clusters list --project YOUR_PROJECT_ID --format="table(name,location,status)"
           ```
           Repeat the following steps for each cluster shown.

        2. **Check whether ABAC (legacy authorization) is enabled** for a given cluster (any machine with `gcloud`):
           ```bash theme={null}
           CLUSTER_NAME="your-cluster-name"
           LOCATION="your-cluster-location"
           PROJECT_ID="YOUR_PROJECT_ID"

           gcloud container clusters describe "$CLUSTER_NAME" \
             --location "$LOCATION" \
             --project "$PROJECT_ID" \
             --format json | jq '.legacyAbac'
           ```
           Interpret the result:
           * If `null` or `{}` → ABAC not configured (effectively disabled).
           * If it contains `"enabled": true` → ABAC is enabled and should be reviewed/disabled.

        3. **Review for any remaining ABAC-dependent workloads or processes** (any machine with `kubectl` access to the cluster):
           * List current RBAC bindings:
             ```bash theme={null}
             kubectl get clusterrolebindings,rolebindings -A
             ```
           * Confirm that users/service accounts relying on cluster access are granted permissions via RBAC (ClusterRoleBindings/RoleBindings) and not via any out-of-band ABAC files or legacy documentation.
           * Check internal docs / automation (CI/CD, scripts) for any references to “ABAC” or expectations of blanket access.

        4. **Decide whether it is safe to disable ABAC**:
           * If all access is covered by RBAC and no known dependency on ABAC remains, proceed to disable ABAC.
           * If there is uncertainty, plan a maintenance window and communicate the change, since disabling ABAC can remove broad implicit access that some legacy clients may rely on.

        5. **Disable Legacy Authorization (ABAC) on the cluster** (any machine with `gcloud`):
           ```bash theme={null}
           gcloud container clusters update "$CLUSTER_NAME" \
             --location "$LOCATION" \
             --project "$PROJECT_ID" \
             --no-enable-legacy-authorization
           ```
           Note: This is a control-plane configuration change; allow time for the update to complete and monitor for access issues.

        6. **Verify ABAC is disabled** (any machine with `gcloud`):
           ```bash theme={null}
           gcloud container clusters describe "$CLUSTER_NAME" \
             --location "$LOCATION" \
             --project "$PROJECT_ID" \
             --format json | jq '.legacyAbac'
           ```
           Confirm the output is `null` or an empty object and that there is no `"enabled": true` field.
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot disable Legacy Authorization (ABAC) because this setting is managed on the GKE control-plane via Google Cloud (gcloud/console/IaC), not through Kubernetes API objects. To remediate this finding, follow the guidance in the **Manual Steps** section using the Google Cloud configuration surface.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Report Legacy ABAC (legacyAbac) status for all GKE clusters in a project (or all projects).
        # REQUIREMENTS:
        #   - gcloud
        #   - jq
        #   - (optional) GNU parallel or xargs for speed
        #
        # USAGE EXAMPLES:
        #   Check all clusters in the current gcloud project:
        #     ./check_gke_abac.sh
        #
        #   Check all clusters in a specific project:
        #     ./check_gke_abac.sh --project my-project-id
        #
        #   Check all clusters in all accessible projects:
        #     ./check_gke_abac.sh --all-projects
        #
        # OUTPUT:
        #   CSV: project_id,location,cluster_name,legacyAbac.enabled
        #   A line with "true" in the last column indicates a PROBLEM per CIS (ABAC enabled).
        #

        set -euo pipefail

        PROJECT=""
        ALL_PROJECTS="false"

        while [[ $# -gt 0 ]]; do
          case "$1" in
            --project)
              PROJECT="$2"
              shift 2
              ;;
            --all-projects)
              ALL_PROJECTS="true"
              shift
              ;;
            *)
              echo "Unknown argument: $1" >&2
              exit 1
              ;;
          esac
        done

        # Determine project list
        if [[ "${ALL_PROJECTS}" == "true" ]]; then
          mapfile -t PROJECTS < <(gcloud projects list --format="value(projectId)")
        else
          if [[ -z "${PROJECT}" ]]; then
            PROJECT="$(gcloud config get-value project 2>/dev/null || true)"
            if [[ -z "${PROJECT}" || "${PROJECT}" == "(unset)" ]]; then
              echo "No project set. Use --project or 'gcloud config set project ...'." >&2
              exit 1
            fi
          fi
          PROJECTS=("${PROJECT}")
        fi

        echo "project_id,location,cluster_name,legacyAbac.enabled"

        for P in "${PROJECTS[@]}"; do
          # List all clusters (regional and zonal) in the project
          mapfile -t CLUSTERS < <(
            gcloud container clusters list \
              --project "${P}" \
              --format="value(name,location)" || true
          )

          if [[ ${#CLUSTERS[@]} -eq 0 ]]; then
            continue
          fi

          for ROW in "${CLUSTERS[@]}"; do
            # ROW is "<name>  <location>"
            CLUSTER_NAME="$(awk '{print $1}' <<< "${ROW}")"
            LOCATION="$(awk '{print $2}' <<< "${ROW}")"

            # Describe the cluster and extract legacyAbac.enabled (may be null if never set)
            LEGACY_ABAC_ENABLED="$(
              gcloud container clusters describe "${CLUSTER_NAME}" \
                --location "${LOCATION}" \
                --project "${P}" \
                --format=json \
                | jq -r '.legacyAbac.enabled // "false"'
            )"

            echo "${P},${LOCATION},${CLUSTER_NAME},${LEGACY_ABAC_ENABLED}"
          done
        done
        ```

        **How to run (any machine with gcloud access):**

        1. Save as `check_gke_abac.sh` and make it executable:
           ```bash theme={null}
           chmod +x ./check_gke_abac.sh
           ```
        2. Run for your project:
           ```bash theme={null}
           ./check_gke_abac.sh --project YOUR_PROJECT_ID
           ```
           or for all projects you can see:
           ```bash theme={null}
           ./check_gke_abac.sh --all-projects
           ```

        **How to interpret output (problem indication):**

        * Output line format:
          ```text theme={null}
          project_id,location,cluster_name,legacyAbac.enabled
          ```
        * Any line where `legacyAbac.enabled` is `true` indicates a **problem** for CIS GKE 5.8.4 (Legacy Authorization / ABAC is enabled and should be reviewed and disabled if not strictly required).
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control](https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control)