Detections
Analytics

5.4.4 Ensure private GKE nodes are configured without external IP addresses

Information

Configure GKE Autopilot nodes without external IP addresses so worker nodes are reachable only through internal network paths. Private nodes reduce direct exposure of the node network interface to external clients while still allowing the cluster to run workloads and communicate with the control plane through internal connectivity.

Nodes with external IP addresses increase the externally reachable surface of the cluster infrastructure. Configuring private nodes limits direct inbound access to the node VMs from the internet and helps ensure node administration, workload traffic, and supporting services use approved private connectivity patterns, firewall rules, and controlled egress paths.

Private nodes also support stronger network isolation because workloads run on nodes with only internal IP addresses. If internet or Google API access is required, it should be provided through controlled paths such as Cloud NAT, Private Google Access, or approved private connectivity rather than direct external IP assignment on the nodes.

Solution

Remediate by enabling private nodes at the cluster level for GKE Autopilot workloads. Private nodes provision GKE nodes with internal IP addresses only. For Autopilot clusters, update the cluster level private node configuration instead of updating individual node pools. The cluster update takes effect after GKE reschedules workloads onto nodes that match the configuration.

Enable private nodes as the cluster level default for GKE Autopilot workloads:

gcloud container clusters update $CLUSTER_NAME \\
 --location $LOCATION \\
 --project $PROJECT_ID \\
 --enable-private-nodes \\
 --enable-ip-alias

If workload level placement is required, configure the workload to schedule on private nodes by using the cloud.google.com/private-node=true node selector.

Note: After remediation, rerun the audit command and confirm that the cluster level default returns true. Validate that private nodes still have required outbound access through approved paths such as Cloud NAT, Private Google Access, or private connectivity for image pulls, package downloads, Google APIs, and third party services.

Impact:

Enabling private nodes can affect workloads, node startup, image pulls, package downloads, and integrations that require outbound access beyond the cluster network. Cloud NAT or an approved NAT solution is required for internet egress, and Private Google Access might be required for private nodes to reach Google APIs and services, especially in Shared VPC environments. In GKE Autopilot, private node settings are configured at the cluster level for the default workload behavior, and the update takes effect after GKE reschedules workloads onto nodes that match the configuration.

See Also

https://workbench.cisecurity.org/benchmarks/24958

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|SC-7, 800-53|SC-7(5), CSCv7|12

Plugin: GCP

Control ID: 3a755423fd279e347869c3f0ee394e1f2236db137aa1141d90cec8807ea4e30f