> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Kubernetes Web UI Is Disabled

### More Info:

Disable the Kubernetes Dashboard (Web UI) add-on, which has historically been an attack vector for privilege escalation. Cluster management should use the CLI or console instead.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS GKE

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. **Identify clusters to review**
           * On any machine with `gcloud` configured, list clusters and note their names and locations:
             ```bash theme={null}
             gcloud container clusters list --project PROJECT_ID
             ```

        2. **Check the Dashboard addon status for each cluster**
           * For each cluster, run:
             ```bash theme={null}
             gcloud container clusters describe CLUSTER_NAME \
               --location LOCATION \
               --project PROJECT_ID \
               --format='json' | jq '.addonsConfig.kubernetesDashboard'
             ```
           * Record whether `.disabled` is `true` or `false` (or if the field is missing).

        3. **Decide whether the Dashboard is required**
           * For any cluster where the Dashboard is not explicitly disabled, confirm with cluster owners:
             * Whether anyone relies on the in‑cluster Kubernetes Dashboard for operations.
             * Whether all required management can be done via `kubectl` and cloud console.
           * If there is no documented, approved use case, plan to disable it.

        4. **Disable the Dashboard where not needed**
           * For each cluster where the Dashboard should be disabled, run:
             ```bash theme={null}
             gcloud container clusters update CLUSTER_NAME \
               --location LOCATION \
               --project PROJECT_ID \
               --update-addons=KubernetesDashboard=DISABLED
             ```
           * Note: this is a control plane configuration change; coordinate with operations if you have strict change windows.

        5. **Handle exceptions (if you must keep it)**
           * If a cluster must keep the Dashboard:
             * Document the business justification and owner.
             * Ensure access is tightly controlled (e.g., strong authn/z, least-privilege RBAC, network restrictions).
             * Set a review date for decommissioning or replacing it.

        6. **Verify remediation**
           * Re-run the audit for each cluster intended to have the Dashboard disabled:
             ```bash theme={null}
             gcloud container clusters describe CLUSTER_NAME \
               --location LOCATION \
               --project PROJECT_ID \
               --format='json' | jq '.addonsConfig.kubernetesDashboard'
             ```
           * Confirm that the output shows the Dashboard configuration present with `"disabled": true` (or equivalent indication that it is disabled).
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot enable or disable the managed Kubernetes Dashboard addon in GKE; that setting is controlled only via the GCP console, gcloud CLI, or your IaC for the cluster configuration. See the Manual Steps section for how to review and change the addon state at the cloud provider level.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        # Report Kubernetes Dashboard (Web UI) status for all GKE clusters in a project.
        # Usage: ./check_gke_dashboard.sh <GCP_PROJECT_ID>

        set -euo pipefail

        PROJECT_ID="${1:-}"

        if [[ -z "$PROJECT_ID" ]]; then
          echo "Usage: $0 <GCP_PROJECT_ID>" >&2
          exit 1
        fi

        echo "Checking Kubernetes Dashboard addon status in project: ${PROJECT_ID}"
        echo

        # List all clusters (both zonal and regional)
        mapfile -t CLUSTERS < <(
          gcloud container clusters list \
            --project "${PROJECT_ID}" \
            --format 'value(name,location)'
        )

        if [[ "${#CLUSTERS[@]}" -eq 0 ]]; then
          echo "No GKE clusters found in project ${PROJECT_ID}"
          exit 0
        fi

        printf "%-40s %-20s %-12s\n" "CLUSTER_NAME" "LOCATION" "DASHBOARD"
        printf "%-40s %-20s %-12s\n" "------------" "--------" "---------"

        for ENTRY in "${CLUSTERS[@]}"; do
          CLUSTER_NAME="$(awk '{print $1}' <<< "${ENTRY}")"
          LOCATION="$(awk '{print $2}' <<< "${ENTRY}")"

          # Query the addonsConfig.kubernetesDashboard field
          RAW=$(
            gcloud container clusters describe "${CLUSTER_NAME}" \
              --location "${LOCATION}" \
              --project "${PROJECT_ID}" \
              --format json | \
            jq -r '.addonsConfig.kubernetesDashboard // empty'
          )

          # Default to DISABLED if field is entirely absent
          if [[ -z "${RAW}" || "${RAW}" == "null" ]]; then
            STATUS="DISABLED (implicit)"
          else
            ENABLED=$(jq -r '.disabled // false | not' <<< "${RAW}")
            # ENABLED will be "true" if dashboard is enabled, "false" otherwise
            if [[ "${ENABLED}" == "true" ]]; then
              STATUS="ENABLED"
            else
              STATUS="DISABLED"
            fi
          fi

          printf "%-40s %-20s %-12s\n" "${CLUSTER_NAME}" "${LOCATION}" "${STATUS}"
        done

        cat <<'EOF'

        Interpretation:
        - Any row with DASHBOARD = "ENABLED" indicates a problem for CIS GKE 5.10.1:
          the Kubernetes Web UI (Dashboard) is enabled and should be reviewed/disabled.
        - Rows with "DISABLED" or "DISABLED (implicit)" are compliant for this control.
        EOF
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>