Skip to main content

Ensure Use Of Vpc-Native Clusters

More Info:​

Create Alias Ips For The Node Network Cidr Range In Order To Subsequently Configure Ipbased Policies And Firewalling For Pods. A Cluster That Uses Alias Ips Is Called A Vpc-Native Cluster

Risk Level​

Low

Address​

Security

Compliance Standards​

  • CIS GKE

Triage and Remediation​

Remediation​

Manual Steps

  1. Identify whether the cluster is VPC-native (Alias IP enabled)

    • Run on: any machine with gcloud and project access.
    • Command (replace with actual values; these are the only variables you must resolve yourself): 
      gcloud container clusters describe <CLUSTER_NAME> --location <LOCATION> --project <PROJECT_ID> \
        --format json | jq '.ipAllocationPolicy'
    • Confirm: "useIpAliases": true is present. If so, the cluster is already VPC-native and no further action is required.

  2. If useIpAliases is false or missing, confirm business and network requirements

    • Review with platform/network/security owners:
      • Need for pod-level IP-based firewalling (e.g., Cloud Armor, VPC firewall rules by pod IP).
      • Need for IP-based policies in service meshes or network appliances.
      • Current reliance on routes-based clusters or node IP-based controls that may change with VPC-native.
    • Decide whether the cluster must be migrated to VPC-native, or whether a non–VPC-native configuration is an intentional, documented exception.

  3. Assess feasibility and impact of migrating to a VPC-native cluster

    • Check cluster version and provider docs to confirm supported migration paths (some clusters cannot be converted in-place and require recreation).
    • Identify dependencies:
      • Any tooling that assumes pod IPs come from node CIDRs or uses node routes.
      • Network policies, firewall rules, or peering configurations that may need updates for pod CIDRs.
    • Decide:
      • Migrate/replace the existing cluster with a new VPC-native cluster, or
      • Keep current cluster as-is and record a risk acceptance/exception.

  4. If choosing to create a new VPC-native cluster, design IP ranges

    • On any machine with gcloud, list existing subnets and ranges to avoid overlap: 
      gcloud compute networks subnets list --project <PROJECT_ID> \
        --format="table(name,region,ipCidrRange,secondaryIpRanges)"
    • With your network team, select:
      • Primary subnet range for nodes.
      • Secondary ranges for pods and services (non-overlapping with each other and with other networks).

  5. Create or define the VPC-native cluster configuration

    • For ad-hoc/console-aligned work, the minimal CLI example is: 
      gcloud container clusters create <NEW_CLUSTER_NAME> --location <LOCATION> --project <PROJECT_ID> \
        --enable-ip-alias \
        --network <VPC_NETWORK_NAME> \
        --subnetwork <SUBNET_NAME> \
        --cluster-secondary-range-name <POD_SECONDARY_RANGE_NAME> \
        --services-secondary-range-name <SERVICE_SECONDARY_RANGE_NAME>
    • For IaC (Terraform, Deployment Manager, etc.), ensure the equivalent options are set to enable IP aliases and specify secondary ranges.

  6. Verify the new or updated cluster and decommission the old one (if applicable)

    • Verification command (on any machine with gcloud): 
      gcloud container clusters describe <TARGET_CLUSTER_NAME> --location <LOCATION> --project <PROJECT_ID> \
        --format json | jq '.ipAllocationPolicy'
    • Confirm "useIpAliases": true and that clusterIpv4CidrBlock / servicesIpv4CidrBlock (or their range names) match the intended secondary ranges.
    • After safely migrating workloads to the VPC-native cluster and validating connectivity and policies, plan and execute decommissioning of the legacy non–VPC-native cluster if it is no longer required.
Using kubectl

kubectl cannot enable VPC-native (Alias IP) networking because this setting is defined at cluster creation time in the GKE control plane configuration. To address this finding, use the Google Cloud Console, gcloud CLI, or your IaC pipeline as described in the Manual Steps section.

Automation
#!/usr/bin/env bash
#
# Audit VPC-native (Alias IP) usage for all GKE clusters in one or more projects.
# REQUIREMENTS:
#   - gcloud SDK installed and authenticated
#   - jq installed
#
# USAGE EXAMPLES:
#   Check all projects visible to your account:
#     ./audit_gke_vpc_native.sh
#
#   Check specific projects:
#     ./audit_gke_vpc_native.sh proj-1 proj-2

set -euo pipefail

# Colors for readability (can be removed if undesired)
RED="$(printf '\033[31m')"
GREEN="$(printf '\033[32m')"
YELLOW="$(printf '\033[33m')"
RESET="$(printf '\033[0m')"

# If no project IDs passed, use all currently accessible projects
if [ "$#" -gt 0 ]; then
  PROJECTS=("$@")
else
  echo "No projects specified; discovering all accessible projects via gcloud..."
  mapfile -t PROJECTS < <(gcloud projects list --format='value(projectId)')
fi

if [ "${#PROJECTS[@]}" -eq 0 ]; then
  echo "No projects found. Exiting." >&2
  exit 1
fi

echo "Auditing GKE clusters for VPC-native (Alias IP) usage..."
echo

for PROJECT in "${PROJECTS[@]}"; do
  echo "=== Project: ${PROJECT} ==="

  # List all clusters (zonal and regional)
  mapfile -t CLUSTERS < <(
    gcloud container clusters list \
      --project "${PROJECT}" \
      --format='value(name,location)' 2>/dev/null || true
  )

  if [ "${#CLUSTERS[@]}" -eq 0 ]; then
    echo "  No clusters found."
    echo
    continue
  fi

  printf "  %-30s %-20s %-12s %-10s\n" "CLUSTER" "LOCATION" "VPC_NATIVE" "STATUS"

  for LINE in "${CLUSTERS[@]}"; do
    # LINE format: "<name> <location>"
    CLUSTER_NAME="$(awk '{print $1}' <<< "${LINE}")"
    LOCATION="$(awk '{print $2}' <<< "${LINE}")"

    # Describe cluster and extract useIpAliases flag
    USE_IP_ALIASES="$(
      gcloud container clusters describe "${CLUSTER_NAME}" \
        --location "${LOCATION}" \
        --project "${PROJECT}" \
        --format=json 2>/dev/null | \
      jq -r '.ipAllocationPolicy.useIpAliases // "false"' 2>/dev/null || echo "unknown"
    )"

    if [ "${USE_IP_ALIASES}" = "true" ]; then
      STATUS="${GREEN}OK${RESET}"
      VPC_NATIVE="true"
    elif [ "${USE_IP_ALIASES}" = "false" ]; then
      STATUS="${RED}NOT_VPC_NATIVE${RESET}"
      VPC_NATIVE="false"
    else
      STATUS="${YELLOW}UNKNOWN${RESET}"
      VPC_NATIVE="unknown"
    fi

    printf "  %-30s %-20s %-12s %-10b\n" "${CLUSTER_NAME}" "${LOCATION}" "${VPC_NATIVE}" "${STATUS}"
  done

  echo
done

cat <<'EOF'
INTERPRETATION:
  - VPC_NATIVE = true, STATUS = OK
      Cluster is VPC-native (uses Alias IPs) and aligns with CIS GKE 5.6.2.
  - VPC_NATIVE = false, STATUS = NOT_VPC_NATIVE
      Cluster is NOT VPC-native. This is a finding and requires manual review:
        * Decide whether to recreate/migrate the cluster with --enable-ip-alias.
        * Assess impact on network policies, firewall rules, and IP planning.
  - VPC_NATIVE = unknown, STATUS = UNKNOWN
      Script could not reliably determine the setting (check permissions / API availability).

NOTE:
  Enabling Alias IP cannot be flipped on for an existing non–VPC-native cluster.
  Remediation typically involves creating a new cluster with:
    gcloud container clusters create <cluster_name> --location <location> --enable-ip-alias
  and migrating workloads. This decision must be made manually per cluster.
EOF

Additional Reading:​