Client certificate authentication should not be used for users
Details Kubernetes provides the option to use client certificates for user authentication. However as there is no way to revoke...
- Home
- Security Hardening
- CIS Google Kubernetes Engine GKE V1.1.0 L1 Master
CIS Google Kubernetes Engine GKE V1.1.0 L1 Master
Create administrative boundaries between resources using namespaces
Details Use namespaces to isolate your Kubernetes objects. Rationale: Limiting the scope of user permissions can reduce the impact of...Enable Cloud Security Command Center (Cloud SCC)
Details Enable Cloud Security Command Center (Cloud SCC) to provide a centralized view of security for your GKE clusters. Rationale:...Ensure authentication using Client Certificates is Disabled
Details Disable Client Certificates, which require certificate rotation, for authentication. Instead, use another authentication method like OpenID Connect. Rationale: With...Ensure Basic Authentication using static passwords is Disabled
Details Disable Basic Authentication (basic auth) for API server authentication as it uses static passwords which need to be rotated....Ensure clusters are created with Private Nodes
Details Disable public IP addresses for cluster nodes, so that they only have private IP addresses. Private Nodes are nodes...Ensure GKE clusters are not running using the Compute Engine default service account
Details Create and use minimally privileged Service accounts to run GKE cluster nodes instead of using the Compute Engine default...Ensure Image Vulnerability Scanning using GCR Container Analysis or a third party provider
Details Scan images stored in Google Container Registry (GCR) for vulnerabilities. Rationale: Vulnerabilities in software packages can be exploited by...Ensure Integrity Monitoring for Shielded GKE Nodes is Enabled
Details Enable Integrity Monitoring for Shielded GKE Nodes to be notified of inconsistencies during the node boot sequence. Rationale: Integrity...Ensure Kubernetes Secrets are encrypted using keys managed in Cloud KMS
Details Encrypt Kubernetes secrets, stored in etcd, at the application-layer using a customer-managed key in Cloud KMS. Rationale: By default,...