Detections
Analytics
5.4.2 Restrict GKE control plane access with authorized networks
Information
Restrict GKE Autopilot control plane access by enabling authorized networks for IP based control plane endpoints and allowing only approved CIDR ranges. This reduces exposure of the Kubernetes API server by limiting which source IP ranges can reach the control plane over the configured IP endpoint.GKE control plane access can use DNS based endpoints and IP based endpoints. When IP based endpoints are enabled, authorized networks provide an IP based access control layer that limits control plane reachability to approved CIDR ranges. Without authorized networks, the control plane IP endpoint can be reachable from any external IP address, including public internet addresses and Google Cloud external IP addresses, subject to authentication and authorization.
Restricting access to approved CIDR ranges reduces the control plane attack surface and helps protect the Kubernetes API server if credentials, certificates, or automation tokens are exposed. For stronger control plane isolation, authorized networks should be combined with private endpoint configuration where appropriate, denial of broad Google Cloud external IP access, and IAM based authentication controls.
NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
Enable control plane authorized networks when the audit shows that masterAuthorizedNetworksConfig is missing, does not show authorized networks as enabled, does not include approved cidrBlocks, or includes broad ranges such as 0.0.0.0/0 . Authorized networks should include only trusted administrative, bastion, VPN, CI/CD, or automation source ranges that require access to the GKE Autopilot control plane IP endpoint, and use authorized networks when IP based control plane endpoints are enabled.gcloud container clusters update $CLUSTER_NAME \\
--location $LOCATION \\
--project $PROJECT_ID \\
--enable-master-authorized-networks \\
--master-authorized-networks <authorized-cidrs>
If broad access from Google Cloud external IP addresses is not explicitly approved, disable that access so external IP addresses from Google Cloud are not automatically allowed to reach the control plane.
gcloud container clusters update $CLUSTER_NAME \\
--location $LOCATION \\
--project $PROJECT_ID \\
--no-enable-google-cloud-access
If the cluster uses the control plane internal endpoint and the same CIDR restrictions should apply to private endpoint access, enable authorized network enforcement on the private endpoint.
gcloud container clusters update $CLUSTER_NAME \\
--location $LOCATION \\
--project $PROJECT_ID \\
--enable-authorized-networks-on-private-endpoint
Note: Rerun the audit command and confirm that masterAuthorizedNetworksConfig shows authorized networks enabled, cidrBlocks contains only approved trusted source ranges, and gcpPublicCidrsAccessEnabled is false unless explicitly approved.
Impact:
Misconfigured authorized networks can block administrators, CI/CD systems, bastion hosts, VPN ranges, or node related network paths from reaching the control plane. Before enabling or tightening authorized networks, confirm all approved administrative and automation source CIDR ranges are included, and update the allowed ranges when trusted network paths change. If subnet primary IP ranges are expanded, the authorized networks configuration may also need to be updated so new nodes can continue to register with the control plane.
See Also
Item Details
Category: ACCESS CONTROL, MEDIA PROTECTION
References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6
Plugin: GCP
Control ID: 52fc27c7df5410188556437e93614dfdc6cb1812771c771d28240befd685498b