Detections
Analytics

5.4.2 Ensure the GKE Metadata Server is Enabled

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Running the GKE Metadata Server prevents workloads from accessing sensitive instance metadata and facilitates Workload Identity

Rationale:

Every node stores its metadata on a metadata server. Some of this metadata, such as kubelet credentials and the VM instance identity token, is sensitive and should not be exposed to a Kubernetes workload. Enabling the GKE Metadata server prevents pods (that are not running on the host network) from accessing this metadata and facilitates Workload Identity.

When unspecified, the default setting allows running pods to have full access to the node's underlying metadata server.

Solution

The GKE Metadata Server requires Workload Identity to be enabled on a cluster. Modify the cluster to enable Workload Identity and enable the GKE Metadata Server.

Using Google Cloud Console

Go to Kubernetes Engine by visiting https://console.cloud.google.com/kubernetes/list

From the list of clusters, select the cluster for which Workload Identity is disabled.

Click on EDIT

Set Workload Identity to 'Enabled' and set the Workload Identity Namespace to the namespace of the Cloud project containing the cluster, e.g: [PROJECT_ID].svc.id.goog

Click SAVE and wait for the cluster to update

Once the cluster has updated, select each Node pool within the cluster Details page

For each Node pool, select EDIT within the Node pool details page

Within the Edit node pool pane, check the 'Enable GKE Metadata Server checkbox'

Click SAVE.

Using Command Line

gcloud beta container clusters update [CLUSTER_NAME] \
 --identity-namespace=[PROJECT_ID].svc.id.goog

Note that existing Node pools are unaffected. New Node pools default to --workload-metadata-from-node=GKE_METADATA_SERVER.
To modify an existing Node pool to enable GKE Metadata Server:

gcloud beta container node-pools update [NODEPOOL_NAME] \
 --cluster=[CLUSTER_NAME] \
 --workload-metadata-from-node=GKE_METADATA_SERVER

You may also need to modify workloads in order for them to use Workload Identity as described within https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity.

Impact:

The GKE Metadata Server must be run when using Workload Identity. Because Workload Identity replaces the need to use Metadata Concealment, the two approaches are incompatible.

When the GKE Metadata Server and Workload Identity are enabled, unless the Pod is running on the host network, Pods cannot use the the Compute Engine default service account.

You may also need to modify workloads in order for them to use Workoad Identity as described within https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity.

Default Value:

By default, running pods to have full access to the node's underlying metadata server.

See Also

https://workbench.cisecurity.org/files/2764

Item Details

References: CSCv7|4.3

Plugin: GCP

Control ID: f67b776d3238b955b6697aecef111297dba4f1b141daadf2431023d4963f83a2