Ensure Legacy Authorization (ABAC) Is Disabled

More Info:

Disable legacy ABAC authorization so access is governed by RBAC, which offers finer-grained and safer permission control. ABAC grants broad access and is deprecated.

Risk Level

High

Address

Security

Compliance Standards

• CIS GKE

Triage and Remediation

Remediation

Remediation

Manual Steps

1. From any machine with gcloud access, confirm the current ABAC setting for the cluster:

   gcloud container clusters describe CLUSTER_NAME \
     --location LOCATION \
     --project PROJECT_ID \
     --format json | jq '.legacyAbac'

   Review:

   • If the field is null or "enabled": false, legacy ABAC is not in use.
   • If "enabled": true, ABAC is enabled and should be reviewed/disabled.

2. If ABAC is enabled, identify teams or systems that might depend on it by reviewing existing RBAC configuration from any machine with kubectl access:

   kubectl get clusterrole,clusterrolebinding,role,rolebinding -A -o wide

   Assess whether all needed access appears to be represented in RBAC (roles and bindings) rather than undocumented ABAC policies.

3. Still from a machine with gcloud access, capture and review the full cluster configuration for context (e.g., for change review / change ticket):

   gcloud container clusters describe CLUSTER_NAME \
     --location LOCATION \
     --project PROJECT_ID \
     --format yaml > cluster-config-before-abac-disable.yaml

   Store this output as evidence and for rollback analysis.

4. If you determine there is no required dependency on ABAC (or you have confirmed equivalent RBAC rules exist), plan a change window because this is a control-plane configuration change. Then, from a machine with gcloud access, disable legacy authorization:

   gcloud container clusters update CLUSTER_NAME \
     --location LOCATION \
     --project PROJECT_ID \
     --no-enable-legacy-authorization

5. After the update completes, verify that ABAC is disabled from a machine with gcloud access:

   gcloud container clusters describe CLUSTER_NAME \
     --location LOCATION \
     --project PROJECT_ID \
     --format json | jq '.legacyAbac'

   Confirm the output is null or shows "enabled": false.

6. From any machine with kubectl access, perform a quick access-validation check for a few representative service accounts / users (to ensure RBAC covers necessary permissions), for example:

   kubectl auth can-i list pods --as system:serviceaccount:DEFAULT_NAMESPACE:SERVICE_ACCOUNT

   Adjust RBAC roles and bindings as needed if any required access is now denied.

Using kubectl

kubectl cannot enable or disable Legacy Authorization (ABAC) because this setting is controlled at the managed control-plane / cloud provider configuration level for the GKE cluster. To remediate this finding, follow the guidance in the Manual Steps section using gcloud, the cloud console, or your IaC tooling.

Automation

#!/usr/bin/env bash
#
# Check Legacy Authorization (ABAC) status for all GKE clusters in one or more projects.
#
# Requirements:
#   - gcloud
#   - jq
#
# Usage examples:
#   ./check-gke-abac.sh
#   ./check-gke-abac.sh my-project-1 my-project-2

set -euo pipefail

if ! command -v gcloud >/dev/null 2>&1; then
  echo "ERROR: gcloud not found in PATH" >&2
  exit 1
fi

if ! command -v jq >/dev/null 2>&1; then
  echo "ERROR: jq not found in PATH" >&2
  exit 1
fi

PROJECTS=("$@")
if [ "${#PROJECTS[@]}" -eq 0 ]; then
  # Default to all active projects in the current account
  mapfile -t PROJECTS < <(gcloud projects list --format="value(projectId)")
fi

echo "PROJECT,LOCATION,CLUSTER_NAME,ABAC_ENABLED"

for PROJECT in "${PROJECTS[@]}"; do
  # List all clusters in the project across all locations
  mapfile -t CLUSTERS < <(
    gcloud container clusters list \
      --project "${PROJECT}" \
      --format="value(name,location)" 2>/dev/null || true
  )

  if [ "${#CLUSTERS[@]}" -eq 0 ]; then
    continue
  fi

  for ENTRY in "${CLUSTERS[@]}"; do
    CLUSTER_NAME=$(awk '{print $1}' <<<"${ENTRY}")
    LOCATION=$(awk '{print $2}' <<<"${ENTRY}")

    # Describe cluster and extract legacyAbac.enabled
    DESC_JSON=$(gcloud container clusters describe "${CLUSTER_NAME}" \
      --location "${LOCATION}" \
      --project "${PROJECT}" \
      --format=json 2>/dev/null || echo '{}')

    # Some clusters may not have legacyAbac field at all; treat that as disabled
    ENABLED=$(jq -r '.legacyAbac.enabled // "false"' <<<"${DESC_JSON}")

    echo "${PROJECT},${LOCATION},${CLUSTER_NAME},${ENABLED}"
  done
done

How to use and interpret:

1. Run from any machine with gcloud configured and access to the target projects:

   chmod +x check-gke-abac.sh
   ./check-gke-abac.sh            # all projects in your account
   ./check-gke-abac.sh proj-a     # specific project(s)

2. Output is CSV:

   • ABAC_ENABLED is either true or false.

3. Problematic state (requires review/remediation):

   • Any line where ABAC_ENABLED is true indicates that Legacy Authorization (ABAC) is enabled on that cluster and should be reviewed and typically disabled:

     my-project,us-central1,prod-cluster,true   <-- needs attention

4. Compliant state:

   • Lines with ABAC_ENABLED equal to false (or where the field is absent and treated as false) are aligned with the benchmark expectation:

     my-project,us-central1,prod-cluster,false  <-- OK