> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Use Of Vpc-Native Clusters

### More Info:

Create Alias Ips For The Node Network Cidr Range In Order To Subsequently Configure Ipbased Policies And Firewalling For Pods. A Cluster That Uses Alias Ips Is Called A Vpc-Native Cluster

### Risk Level

Low

### Address

Security

### Compliance Standards

* CIS GKE

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. **Identify whether the cluster is VPC-native (Alias IP enabled)**
           * Run on: any machine with `gcloud` and project access.
           * Command (replace with actual values; these are the only variables you must resolve yourself):
             ```bash theme={null}
             gcloud container clusters describe <CLUSTER_NAME> --location <LOCATION> --project <PROJECT_ID> \
               --format json | jq '.ipAllocationPolicy'
             ```
           * Confirm: `"useIpAliases": true` is present. If so, the cluster is already VPC-native and no further action is required.

        2. **If `useIpAliases` is false or missing, confirm business and network requirements**
           * Review with platform/network/security owners:
             * Need for pod-level IP-based firewalling (e.g., Cloud Armor, VPC firewall rules by pod IP).
             * Need for IP-based policies in service meshes or network appliances.
             * Current reliance on routes-based clusters or node IP-based controls that may change with VPC-native.
           * Decide whether the cluster must be migrated to VPC-native, or whether a non–VPC-native configuration is an intentional, documented exception.

        3. **Assess feasibility and impact of migrating to a VPC-native cluster**
           * Check cluster version and provider docs to confirm supported migration paths (some clusters cannot be converted in-place and require recreation).
           * Identify dependencies:
             * Any tooling that assumes pod IPs come from node CIDRs or uses node routes.
             * Network policies, firewall rules, or peering configurations that may need updates for pod CIDRs.
           * Decide:
             * Migrate/replace the existing cluster with a new VPC-native cluster, or
             * Keep current cluster as-is and record a risk acceptance/exception.

        4. **If choosing to create a new VPC-native cluster, design IP ranges**
           * On any machine with `gcloud`, list existing subnets and ranges to avoid overlap:
             ```bash theme={null}
             gcloud compute networks subnets list --project <PROJECT_ID> \
               --format="table(name,region,ipCidrRange,secondaryIpRanges)"
             ```
           * With your network team, select:
             * Primary subnet range for nodes.
             * Secondary ranges for pods and services (non-overlapping with each other and with other networks).

        5. **Create or define the VPC-native cluster configuration**
           * For ad-hoc/console-aligned work, the minimal CLI example is:
             ```bash theme={null}
             gcloud container clusters create <NEW_CLUSTER_NAME> --location <LOCATION> --project <PROJECT_ID> \
               --enable-ip-alias \
               --network <VPC_NETWORK_NAME> \
               --subnetwork <SUBNET_NAME> \
               --cluster-secondary-range-name <POD_SECONDARY_RANGE_NAME> \
               --services-secondary-range-name <SERVICE_SECONDARY_RANGE_NAME>
             ```
           * For IaC (Terraform, Deployment Manager, etc.), ensure the equivalent options are set to enable IP aliases and specify secondary ranges.

        6. **Verify the new or updated cluster and decommission the old one (if applicable)**
           * Verification command (on any machine with `gcloud`):
             ```bash theme={null}
             gcloud container clusters describe <TARGET_CLUSTER_NAME> --location <LOCATION> --project <PROJECT_ID> \
               --format json | jq '.ipAllocationPolicy'
             ```
           * Confirm `"useIpAliases": true` and that `clusterIpv4CidrBlock` / `servicesIpv4CidrBlock` (or their range names) match the intended secondary ranges.
           * After safely migrating workloads to the VPC-native cluster and validating connectivity and policies, plan and execute decommissioning of the legacy non–VPC-native cluster if it is no longer required.
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot enable VPC-native (Alias IP) networking because this setting is defined at cluster creation time in the GKE control plane configuration. To address this finding, use the Google Cloud Console, gcloud CLI, or your IaC pipeline as described in the Manual Steps section.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Audit VPC-native (Alias IP) usage for all GKE clusters in one or more projects.
        # REQUIREMENTS:
        #   - gcloud SDK installed and authenticated
        #   - jq installed
        #
        # USAGE EXAMPLES:
        #   Check all projects visible to your account:
        #     ./audit_gke_vpc_native.sh
        #
        #   Check specific projects:
        #     ./audit_gke_vpc_native.sh proj-1 proj-2

        set -euo pipefail

        # Colors for readability (can be removed if undesired)
        RED="$(printf '\033[31m')"
        GREEN="$(printf '\033[32m')"
        YELLOW="$(printf '\033[33m')"
        RESET="$(printf '\033[0m')"

        # If no project IDs passed, use all currently accessible projects
        if [ "$#" -gt 0 ]; then
          PROJECTS=("$@")
        else
          echo "No projects specified; discovering all accessible projects via gcloud..."
          mapfile -t PROJECTS < <(gcloud projects list --format='value(projectId)')
        fi

        if [ "${#PROJECTS[@]}" -eq 0 ]; then
          echo "No projects found. Exiting." >&2
          exit 1
        fi

        echo "Auditing GKE clusters for VPC-native (Alias IP) usage..."
        echo

        for PROJECT in "${PROJECTS[@]}"; do
          echo "=== Project: ${PROJECT} ==="

          # List all clusters (zonal and regional)
          mapfile -t CLUSTERS < <(
            gcloud container clusters list \
              --project "${PROJECT}" \
              --format='value(name,location)' 2>/dev/null || true
          )

          if [ "${#CLUSTERS[@]}" -eq 0 ]; then
            echo "  No clusters found."
            echo
            continue
          fi

          printf "  %-30s %-20s %-12s %-10s\n" "CLUSTER" "LOCATION" "VPC_NATIVE" "STATUS"

          for LINE in "${CLUSTERS[@]}"; do
            # LINE format: "<name> <location>"
            CLUSTER_NAME="$(awk '{print $1}' <<< "${LINE}")"
            LOCATION="$(awk '{print $2}' <<< "${LINE}")"

            # Describe cluster and extract useIpAliases flag
            USE_IP_ALIASES="$(
              gcloud container clusters describe "${CLUSTER_NAME}" \
                --location "${LOCATION}" \
                --project "${PROJECT}" \
                --format=json 2>/dev/null | \
              jq -r '.ipAllocationPolicy.useIpAliases // "false"' 2>/dev/null || echo "unknown"
            )"

            if [ "${USE_IP_ALIASES}" = "true" ]; then
              STATUS="${GREEN}OK${RESET}"
              VPC_NATIVE="true"
            elif [ "${USE_IP_ALIASES}" = "false" ]; then
              STATUS="${RED}NOT_VPC_NATIVE${RESET}"
              VPC_NATIVE="false"
            else
              STATUS="${YELLOW}UNKNOWN${RESET}"
              VPC_NATIVE="unknown"
            fi

            printf "  %-30s %-20s %-12s %-10b\n" "${CLUSTER_NAME}" "${LOCATION}" "${VPC_NATIVE}" "${STATUS}"
          done

          echo
        done

        cat <<'EOF'
        INTERPRETATION:
          - VPC_NATIVE = true, STATUS = OK
              Cluster is VPC-native (uses Alias IPs) and aligns with CIS GKE 5.6.2.
          - VPC_NATIVE = false, STATUS = NOT_VPC_NATIVE
              Cluster is NOT VPC-native. This is a finding and requires manual review:
                * Decide whether to recreate/migrate the cluster with --enable-ip-alias.
                * Assess impact on network policies, firewall rules, and IP planning.
          - VPC_NATIVE = unknown, STATUS = UNKNOWN
              Script could not reliably determine the setting (check permissions / API availability).

        NOTE:
          Enabling Alias IP cannot be flipped on for an existing non–VPC-native cluster.
          Remediation typically involves creating a new cluster with:
            gcloud container clusters create <cluster_name> --location <location> --enable-ip-alias
          and migrating workloads. This decision must be made manually per cluster.
        EOF
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://cloud.google.com/kubernetes-engine/docs/how-to/alias-ips](https://cloud.google.com/kubernetes-engine/docs/how-to/alias-ips)