Detections
Analytics

5.9.2 Use CMEK protected boot disks for GKE node pools

Information

Use CMEK protected boot disks for GKE node pools so node boot disks are encrypted with approved Cloud KMS keys managed by the organization. This applies when creating a new cluster or creating a new node pool with the --boot-disk-kms-key setting.

GKE node boot disks are encrypted at rest by default using Google managed encryption. CMEK provides additional control by allowing the organization to manage the Cloud KMS key used for node boot disk encryption, including key access control, rotation, separation of duties, and the ability to disable key use when required by security or compliance processes.

Using CMEK protected boot disks helps align node infrastructure encryption with enterprise key management requirements. The Cloud KMS key must be created before use, and the node boot disk key should be specified when creating the cluster or node pool.

Solution

CMEK for node boot disks cannot be enabled, changed, or disabled in place for an existing node pool. To remediate a noncompliant node pool, create a replacement node pool with the approved Cloud KMS key, migrate workloads to the new node pool, validate workload health, and delete the old node pool after migration. Before creating the replacement node pool, grant the required Cloud KMS key access to the Compute Engine service agent for the cluster project.

Create the replacement node pool with the approved boot disk type and Cloud KMS key. Current GKE CMEK boot disk guidance uses pd-standard or pd-ssd for this configuration.

gcloud container node-pools create $NEW_NODE_POOL \\
 --cluster $CLUSTER_NAME \\
 --location $LOCATION \\
 --project $PROJECT_ID \\
 --disk-type $DISK_TYPE \\
 --boot-disk-kms-key $BOOT_DISK_KMS_KEY

After the replacement node pool is available, migrate workloads, validate scheduling and application health, and then drain and delete the noncompliant node pool. Rerun the audit command and confirm that bootDiskKmsKey returns the approved Cloud KMS key.

Impact:

CMEK for node boot disks cannot be enabled, changed, or disabled in place for an existing cluster or existing node pool. To remediate an existing noncompliant node pool, create a new node pool with the approved --boot-disk-kms-key, migrate workloads to the new node pool, validate workload health, and delete the old node pool. For GKE, CMEK protected node boot disks are supported only with pd-standard or pd-ssd boot disk types.

See Also

https://workbench.cisecurity.org/benchmarks/24956

Item Details

Category: IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|IA-5(1), 800-53|SC-28, 800-53|SC-28(1), CSCv7|14.8

Plugin: GCP

Control ID: 725e2cb3a22f74939c9fb39df99360822f2d4c3730bb8a6155c2ccaa0667d7da