Detections
Analytics

5.6.1 Enable VPC Flow Logs and Intranode Visibility

Information

Enable VPC Flow Logs on the subnet used by GKE nodes and enable intranode visibility on the GKE cluster to improve visibility into Pod traffic. This combination allows network flow logging to include traffic between Pods, including traffic between Pods running on the same worker node.

VPC Flow Logs capture network flow records for subnet traffic, but Pod to Pod traffic on the same node requires GKE intranode visibility so that the traffic is visible to the VPC network. Enabling both controls improves traffic observability for security monitoring, network troubleshooting, forensics, and validation of expected workload communication patterns.

Without intranode visibility, traffic between Pods on the same node can bypass VPC level visibility, reducing the usefulness of VPC Flow Logs for Kubernetes east west traffic analysis. Intranode visibility sends Pod to Pod traffic on the same node through the VPC networking path, allowing VPC Flow Logs and other VPC features to observe that traffic.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Enable intranode visibility on the GKE cluster when the audit shows that networkConfig.enableIntraNodeVisibility is not true . Enabling intranode visibility makes Pod to Pod traffic on the same node visible to the VPC network path so it can be captured by VPC Flow Logs and other VPC features. Plan the change during an approved maintenance window because enabling intranode visibility on an existing cluster can restart components in the control plane and worker nodes.

gcloud container clusters update $CLUSTER_NAME \\
 --location $LOCATION \\
 --project $PROJECT_ID \\
 --enable-intra-node-visibility

After intranode visibility is enabled, review the subnet used by the GKE cluster and confirm that VPC Flow Logs are enabled for that subnet. VPC Flow Logs are configured at the subnet level, while intranode visibility is configured at the cluster level, so both settings must be in place for complete network flow visibility.

 -

If VPC Flow Logs are not enabled for the subnet used by the GKE cluster, enable flow logging on that subnet.

 -

Configure VPC Flow Logs settings such as aggregation interval, sampling, metadata inclusion, and log filters based on security monitoring, troubleshooting and retention.

 -

Rerun the audit check and confirm that intranode visibility returns true and that the GKE subnet has an effective VPC Flow Logs configuration.

Impact:

Enabling intranode visibility on an existing GKE cluster restarts components in both the control plane and worker nodes, which can cause temporary disruption and should be planned during a maintenance window.

See Also

https://workbench.cisecurity.org/benchmarks/24956

Item Details

Category: AUDIT AND ACCOUNTABILITY, SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, 800-53|CA-9, 800-53|SC-7, 800-53|SI-4, 800-53|SI-4(4), CSCv7|6.3

Plugin: GCP

Control ID: 3040b2603c779a3ad8f4dc991011c16be235ca5b876d0280926d615c8fab2692