Client certificate authentication should not be used for users Details Kubernetes provides the option to use client certificates for user authentication. However as there is no way to revoke...
Create administrative boundaries between resources using namespaces Details Use namespaces to isolate your Kubernetes objects. Rationale: Limiting the scope of user permissions can reduce the impact of...
Enable Cloud Security Command Center (Cloud SCC) Details Enable Cloud Security Command Center (Cloud SCC) to provide a centralized view of security for your GKE clusters. Rationale:...
Ensure authentication using Client Certificates is Disabled Details Disable Client Certificates, which require certificate rotation, for authentication. Instead, use another authentication method like OpenID Connect. Rationale: With...
Ensure Basic Authentication using static passwords is Disabled Details Disable Basic Authentication (basic auth) for API server authentication as it uses static passwords which need to be rotated....
Ensure clusters are created with Private Nodes Details Disable public IP addresses for cluster nodes, so that they only have private IP addresses. Private Nodes are nodes...
Ensure GKE clusters are not running using the Compute Engine default service account Details Create and use minimally privileged Service accounts to run GKE cluster nodes instead of using the Compute Engine default...
Ensure Image Vulnerability Scanning using GCR Container Analysis or a third party provider Details Scan images stored in Google Container Registry (GCR) for vulnerabilities. Rationale: Vulnerabilities in software packages can be exploited by...
Ensure Integrity Monitoring for Shielded GKE Nodes is Enabled Details Enable Integrity Monitoring for Shielded GKE Nodes to be notified of inconsistencies during the node boot sequence. Rationale: Integrity...
Ensure Kubernetes Secrets are encrypted using keys managed in Cloud KMS Details Encrypt Kubernetes secrets, stored in etcd, at the application-layer using a customer-managed key in Cloud KMS. Rationale: By default,...