Detections
Analytics

5.6.5 Ensure private GKE nodes are configured without external IP addresses

Information

Configure GKE nodes without external IP addresses so worker nodes are reachable only through internal network paths. Private nodes reduce direct exposure of the node network interface to external clients while still allowing the cluster to run workloads and communicate with the control plane through internal connectivity.

Nodes with external IP addresses increase the externally reachable surface of the cluster infrastructure. Configuring private nodes limits direct inbound access to the node VMs from the internet and helps ensure node administration, workload traffic, and supporting services use approved private connectivity patterns, firewall rules, and controlled egress paths.

Private nodes also support stronger network isolation because workloads run on nodes with only internal IP addresses. If internet or Google API access is required, it should be provided through controlled paths such as Cloud NAT, Private Google Access, or approved private connectivity rather than direct external IP assignment on the nodes.

Solution

Remediate by enabling private nodes at the cluster level for new node pools and at the node pool level for existing node pools. Private nodes provision GKE nodes with internal IP addresses only. GKE does not automatically modify existing node pools when the cluster level setting is changed, so existing node pools must be updated separately.

Enable private nodes as the cluster level default for new node pools:

gcloud container clusters update $CLUSTER_NAME \\
 --location $LOCATION \\
 --project $PROJECT_ID \\
 --enable-private-nodes \\
 --enable-ip-alias

Enable private nodes on an existing node pool:

gcloud container node-pools update $POOL_NAME \\
 --cluster $CLUSTER_NAME \\
 --location $LOCATION \\
 --project $PROJECT_ID \\
 --enable-private-nodes \\
 --enable-ip-alias

 - Note: After remediation, rerun the audit commands and confirm that the cluster level default and each applicable node pool return true . Validate that private nodes still have required outbound access through approved paths such as Cloud NAT, Private Google Access, or private connectivity for image pulls, package downloads, Google APIs, and third party services.

Impact:

Enabling private nodes can affect workloads, node startup, image pulls, package downloads, and integrations that require outbound access beyond the cluster network. Cloud NAT or an approved NAT solution is required for internet egress, and Private Google Access might be required for private nodes to reach Google APIs and services, especially in Shared VPC environments. In GKE, private node settings can be changed, but cluster level changes apply only to new node pools, while existing node pools must be updated separately.

See Also

https://workbench.cisecurity.org/benchmarks/24956

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|SC-7, 800-53|SC-7(5), CSCv7|12

Plugin: GCP

Control ID: 6b64020b20920f0a16acdc88072a1155aaab35403279930b946d88bda447435a