Detections
Analytics

5.5.7 Ensure Secure Boot is enabled for Shielded GKE node pools

Information

Enable Secure Boot for Shielded GKE node pools to verify the digital signature of node VM boot components, including the kernel and bootloader, during the boot process. Secure Boot helps ensure that only trusted boot components are allowed to run when the node starts.

Secure Boot helps reduce the risk of boot level compromise by verifying the authenticity of node boot components before the operating system starts. If signature verification fails, the boot process is halted, which helps prevent nodes from starting with tampered bootloaders, kernels, or other unauthorized low level components.

This control complements Shielded GKE Nodes and integrity monitoring by strengthening node startup integrity. Shielded GKE Nodes, Secure Boot, and integrity monitoring are independent features, so Secure Boot should be explicitly reviewed for each applicable node pool rather than assumed from the cluster level Shielded GKE Nodes setting.

Solution

Create a replacement node pool with Secure Boot enabled for any node pool where the audit result is not true. Secure Boot is disabled by default for node pools and should be explicitly enabled when creating the replacement node pool.

gcloud container node-pools create $POOL_NAME \\
 --cluster $CLUSTER_NAME \\
 --location $LOCATION \\
 --project $PROJECT_ID \\
 --shielded-secure-boot

 - Before migrating workloads, validate that Secure Boot will not block required boot components or node level dependencies. On Ubuntu nodes, Secure Boot blocks unsigned third party kernel modules from loading.

Migrate workloads from the noncompliant node pool to the new Secure Boot enabled node pool, validate workload health, and then drain and delete the old node pool. After remediation, rerun the audit command and confirm that enableSecureBoot returns true.

Impact:

Secure Boot is disabled by default for GKE node pools and should be tested before enablement. On Ubuntu nodes, Secure Boot blocks unsigned third party kernel modules from loading, which can affect workloads or agents that depend on custom drivers or kernel extensions.

See Also

https://workbench.cisecurity.org/benchmarks/24956

Item Details

Category: RISK ASSESSMENT

References: 800-53|RA-5, CSCv7|5.3

Plugin: GCP

Control ID: b5bf7d3411fee70b5ff51a7b8417f22c9d7ee90b107b6bd89b7752f2d1d7907b