Detections
Analytics

5.3.1 Enable application-layer Secrets encryption with Cloud KMS keys

Information

Enable application layer Secrets encryption for GKE Standard clusters using a Cloud KMS key. This control adds customer managed encryption for Kubernetes Secret resources stored in the cluster state database, providing an additional protection layer beyond Google managed encryption at rest.

By default, GKE encrypts customer content at rest, including Kubernetes Secrets, using encryption that Google manages automatically. Application layer Secrets encryption adds another layer by encrypting Secret data before it is written to the cluster state database, using a key that is managed in Cloud KMS.

This improves protection for sensitive Kubernetes Secret data by allowing the organization to manage the encryption key lifecycle, including key access control, rotation, and disablement. It is important for clusters that store sensitive application credentials, tokens, certificates, or other Secret values that require stronger key management controls.

Solution

Enable application layer encryption on the GKE Standard cluster when the audit shows that databaseEncryption.state is not ALL_OBJECTS_ENCRYPTION_ENABLED, databaseEncryption.currentState is not CURRENT_STATE_ALL_OBJECTS_ENCRYPTION_ENABLED, or databaseEncryption.keyName does not reference the approved Cloud KMS CryptoKey.

In the Google Cloud console:

 -

Open the GKE cluster

 -

Select Edit and then go to the Security section

 -

Edit Application-layer Secrets Encryption

 -

Check Encrypt secrets at the application layer

 -

Choose the approved Cloud KMS key. (If prompted, grant the Kubernetes Engine Service Agent access to use the selected key)

 -

Save the change

After the update completes, rerun the audit command and verify that databaseEncryption.state returns ALL_OBJECTS_ENCRYPTION_ENABLED, databaseEncryption.currentState returns CURRENT_STATE_ALL_OBJECTS_ENCRYPTION_ENABLED, and databaseEncryption.keyName references the approved Cloud KMS CryptoKey. Updating an existing cluster can restart the control plane and re-encrypt existing data, so apply the change during an approved maintenance window, especially for zonal clusters.

Impact:

To use application layer Secrets encryption, the Kubernetes Engine Service Agent must have the Cloud KMS CryptoKey Encrypter/Decrypter role on the selected key. Enabling this feature on an existing cluster restarts the control plane and re-encrypts existing Secrets, which can result in a long running operation and temporary control plane unavailability for zonal clusters. Key availability, Cloud KMS permissions, rotation procedures, and Cloud KMS quota should be validated before enabling this control.

See Also

https://workbench.cisecurity.org/benchmarks/24956

Item Details

Category: IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|IA-5(1), 800-53|SC-28, 800-53|SC-28(1), CSCv7|14.8

Plugin: GCP

Control ID: 506521635bb837c1bfb22bfc7d0aa7161ce628354c149db5f2983b9fb61ee178