> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable VPC Flow Logs And Intranode Visibility

### More Info:

Enable VPC Flow Logs and intranode visibility so network traffic to, from, and between nodes is recorded for monitoring and forensics. Without them, network-level activity is not observable.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS GKE

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. **Identify cluster networking settings**\
           Run on any machine with gcloud configured:
           ```bash theme={null}
           gcloud container clusters describe CLUSTER_NAME \
             --location LOCATION \
             --project PROJECT_ID \
             --format json | jq '.networkConfig'
           ```
           Review:
           * `.enableIntraNodeVisibility` (should be `true` to meet the intent of the control)
           * `.network` and `.subnetwork` (VPC and subnet used by the cluster)

        2. **Check current VPC Flow Logs status for the cluster subnet**\
           From the previous output, note the subnetwork name (without quotes), then run:
           ```bash theme={null}
           gcloud compute networks subnets describe SUBNET_NAME \
             --region REGION \
             --project PROJECT_ID \
             --format json | jq '.logConfig'
           ```
           Review whether:
           * `enable` is `true` (Flow Logs enabled)
           * Optional: `aggregationInterval`, `flowSampling`, and `metadata` match your logging/forensics requirements.

        3. **Decide on enabling intranode visibility**\
           Based on your security and performance requirements, decide whether to enable intra-node visibility (may increase load on network and logging backends). If required by your policy, plan to enable it for the cluster.

        4. **Decide on enabling VPC Flow Logs**\
           Based on compliance, logging cost, and retention policies, decide whether to enable `logConfig.enable=true` for the cluster subnet. If required, plan to enable Flow Logs with appropriate sampling/aggregation settings.

        5. **Apply configuration changes (if required by your decision)**\
           a. Enable VPC Flow Logs on the cluster subnet (any machine with gcloud):

           ```bash theme={null}
           gcloud compute networks subnets update SUBNET_NAME \
             --region REGION \
             --project PROJECT_ID \
             --enable-flow-logs
           ```

           (Optionally add flags like `--logging-aggregation-interval`, `--logging-flow-sampling`, `--logging-metadata` as per your logging design.)

           b. Enable intranode visibility on the cluster:

           ```bash theme={null}
           gcloud container clusters update CLUSTER_NAME \
             --location LOCATION \
             --project PROJECT_ID \
             --enable-intra-node-visibility
           ```

        6. **Verify that changes are effective**\
           a. Verify intranode visibility:

           ```bash theme={null}
           gcloud container clusters describe CLUSTER_NAME \
             --location LOCATION \
             --project PROJECT_ID \
             --format json | jq '.networkConfig.enableIntraNodeVisibility'
           ```

           Confirm the value is `true`.

           b. Verify VPC Flow Logs:

           ```bash theme={null}
           gcloud compute networks subnets describe SUBNET_NAME \
             --region REGION \
             --project PROJECT_ID \
             --format json | jq '.logConfig'
           ```

           Confirm `enable` is `true` and that other settings match your intended configuration.
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot enable VPC Flow Logs or intranode visibility because they are configured at the GCP network and GKE cluster level, not via Kubernetes API objects. Apply the remediation using the Google Cloud Console, `gcloud` CLI, or your IaC tooling as described in the Manual Steps section.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Check CIS GKE 5.6.1: VPC Flow Logs and Intra-node Visibility
        # Requirements:
        #   - gcloud, jq installed
        #   - Application Default Credentials or gcloud auth set up
        #
        # Runs from: any machine with gcloud access

        set -euo pipefail

        # ---------- CONFIGURATION ----------
        # Optional: restrict to specific project(s) or locations
        PROJECT_FILTER=()   # e.g. PROJECT_FILTER=(my-prod-project my-dev-project)
        LOCATION_FILTER=()  # e.g. LOCATION_FILTER=(us-central1 us-east1)

        # ---------- FUNCTIONS ----------
        list_projects() {
          if ((${#PROJECT_FILTER[@]})); then
            printf '%s\n' "${PROJECT_FILTER[@]}"
          else
            gcloud projects list --format='value(projectId)'
          fi
        }

        list_clusters() {
          local project="$1"
          if ((${#LOCATION_FILTER[@]})); then
            for loc in "${LOCATION_FILTER[@]}"; do
              gcloud container clusters list \
                --project "$project" \
                --region "$loc" \
                --format='value(name,location)'
              gcloud container clusters list \
                --project "$project" \
                --zone "$loc" \
                --format='value(name,location)'
            done | sort -u
          else
            gcloud container clusters list \
              --project "$project" \
              --format='value(name,location)'
          fi
        }

        # ---------- MAIN ----------
        echo "project,cluster,location,network,subnetwork,intra_node_visibility_enabled,subnet_flow_logs_enabled"

        for project in $(list_projects); do
          while IFS=$'\t' read -r cluster location; do
            [[ -z "$cluster" ]] && continue

            desc_json=$(gcloud container clusters describe "$cluster" \
              --location "$location" \
              --project "$project" \
              --format=json)

            network=$(echo "$desc_json" | jq -r '.network')
            subnetwork=$(echo "$desc_json" | jq -r '.subnetwork')
            inv_enabled=$(echo "$desc_json" | jq -r '.networkConfig.enableIntraNodeVisibility // false')

            # subnet names may be full URLs; extract last component
            subnet_name="${subnetwork##*/}"
            network_name="${network##*/}"

            subnet_json=$(gcloud compute networks subnets describe "$subnet_name" \
              --project "$project" \
              --region "$(echo "$location" | sed 's/-[a-z]$//')" \
              --format=json 2>/dev/null || echo '{}')

            flow_logs=$(echo "$subnet_json" | jq -r '.enableFlowLogs // false')

            echo "$project,$cluster,$location,$network_name,$subnet_name,$inv_enabled,$flow_logs"
          done < <(list_clusters "$project" | sed 's/ \+/\t/')
        done
        ```

        Explanation of output indicating a problem:

        * Any row where `intra_node_visibility_enabled` is `false` means intra-node visibility is not enabled for that cluster.
        * Any row where `subnet_flow_logs_enabled` is `false` means VPC Flow Logs are not enabled on the subnetwork used by that cluster.

        Clusters where either (or both) of these columns are `false` require manual review and potential remediation using the benchmark’s recommended `gcloud` commands.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>