Detections
Analytics

5.5.6 Verify Shielded GKE Node integrity monitoring is enabled

Information

Verify Shielded GKE Node integrity monitoring is enabled for GKE node pools. Integrity monitoring validates each Shielded VM boot sequence against a known good baseline and records pass or fail results so administrators can detect potential boot level or kernel level integrity issues on worker nodes.

Integrity monitoring strengthens node security by measuring the Shielded VM boot sequence and comparing it to an expected baseline. This helps identify unexpected changes in boot components, firmware, kernel, or other early boot measurements that could indicate tampering, rootkit activity, or unauthorized low level modification.

This control complements Shielded GKE Nodes by improving visibility into node integrity events. Integrity monitoring does not replace workload security, image controls, or runtime detection, but it provides an important signal in Cloud Logging that can be reviewed, monitored, or used for alerting when boot integrity checks fail.

Solution

Create a replacement node pool with Shielded GKE Node integrity monitoring enabled. Integrity monitoring is enabled by default for new GKE node pools, but it can also be explicitly enabled during node pool creation by using the --shielded-integrity-monitoring option.

gcloud container node-pools create $POOL_NAME \\
 --cluster $CLUSTER_NAME \\
 --location $LOCATION \\
 --project $PROJECT_ID \\
 --shielded-integrity-monitoring

Migrate workloads from the noncompliant node pool to the new node pool, validate workload health, and then drain and delete the old node pool. After remediation, rerun the audit command and confirm that enableIntegrityMonitoring returns true.

Impact:

Integrity monitoring is enabled by default for GKE node pools, and Google recommends not disabling it. Keeping it enabled has minimal impact, but should ensure Cloud Logging retention, monitoring, and alerting processes are configured so failed integrity validation events are reviewed and investigated. Disabling integrity monitoring reduces visibility into node boot integrity and weakens Shielded GKE Node protections.

See Also

https://workbench.cisecurity.org/benchmarks/24956

Item Details

Category: RISK ASSESSMENT

References: 800-53|RA-5, CSCv7|5.3

Plugin: GCP

Control ID: 6709b4e3c1aa21401391f2badbfe804d03cf1c8e978580ba3b40c78605386189