5.6.1 Enable VPC Flow Logs and Intranode Visibility

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Enable VPC Flow Logs and Intranode Visibility to see pod-level traffic, even for traffic within a worker node.

Rationale:

Enabling Intranode Visibility makes your intranode pod to pod traffic visible to the networking fabric. With this feature, you can use VPC Flow Logs or other VPC features for intranode traffic.

Solution

Using Google Cloud Console

Go to Kubernetes Engine by visiting https://console.cloud.google.com/kubernetes/list

Select Kubernetes clusters for which intranode visibility is disabled

Click on EDIT

Set 'Intranode visibility' to 'Enabled'

Click SAVE.

Using Command Line

To enable intranode visibility on an existing cluster, run the following command:

gcloud beta container clusters update [CLUSTER_NAME] \
--enable-intra-node-visibility

Impact:

This is a beta feature. Enabling it on existing cluster causes the cluster master and the cluster nodes to restart, which might cause disruption.

Default Value:

By default, Intranode Visibility is disabled.

See Also

https://workbench.cisecurity.org/files/2764