Detections
Analytics

5.6.2 Use VPC native GKE clusters with alias IP address ranges

Information

Use VPC native GKE clusters with alias IP address ranges so Pod and Service IP addresses are allocated from subnet secondary IP address ranges in the cluster's VPC network. This provides native VPC routing for GKE workloads and avoids relying on custom static routes for Pod routing.

VPC native clusters improve network planning and control because Pod IP addresses are reserved in the VPC network before Pods are created, which helps prevent IP conflicts with other VPC resources. Pod IP ranges also do not depend on custom static routes, reducing route scale concerns and allowing automatically generated subnet routes to handle cluster routing.

Using alias IP address ranges also allows firewall rules to target Pod IP address ranges separately from node IP addresses. This improves network segmentation options and supports better visibility and control for GKE workload traffic across the VPC network and connected networks.

Solution

VPC native networking is selected at cluster creation and cannot be enabled on an existing routes based cluster. To remediate a noncompliant cluster, create a new GKE cluster with alias IP address ranges enabled, migrate workloads to the new cluster, validate application connectivity, and decommission the routes based cluster after migration is complete.

gcloud container clusters create $CLUSTER_NAME \\
 --location $LOCATION \\
 --project $PROJECT_ID \\
 --enable-ip-alias

For production clusters, define or select appropriate subnet secondary IP address ranges for Pods and Services before cluster creation. Proper IP range planning helps avoid Pod or Service IP exhaustion as the cluster scales.

 - Note: VPC native networking is selected at cluster creation and cannot be enabled on an existing routes based cluster. To remediate a noncompliant cluster, create a replacement GKE cluster with alias IP address ranges enabled, migrate workloads to the new cluster, validate workload and network connectivity, and decommission the routes based cluster after migration is complete.

Impact:

VPC native is the default and recommended network mode for new GKE clusters. Existing routes based clusters should be evaluated carefully because this network mode is chosen at cluster creation, and the practical remediation is typically to create a new VPC native cluster and migrate workloads.

See Also

https://workbench.cisecurity.org/benchmarks/24956

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|SC-7, CSCv7|11, CSCv7|14.1

Plugin: GCP

Control ID: 1f41488be2fc6ac44680d352be454d111e64c7888f9f26e664cdefa947ffea48