Detections
Analytics

5.10.3 Enable the GKE security posture dashboard for cluster security insights

Information

Enable the GKE security posture dashboard to surface cluster and workload security insights, including workload configuration auditing, actionable security concerns, and security bulletin related findings. The dashboard provides a centralized view of security posture findings so teams can identify, prioritize, and remediate issues across eligible GKE clusters and workloads.

The GKE security posture dashboard helps identify workload and cluster configuration risks during runtime by scanning Kubernetes workloads for security concerns and presenting actionable findings in the Google Cloud console. This improves visibility into misconfigurations, risky workload settings, and security concerns that might otherwise require manual review across namespaces, manifests, and clusters.

Security posture findings can support operational review, remediation tracking, and security governance across individual clusters or fleets.

Solution

Enable the GKE security posture dashboard for workload configuration auditing when the audit shows that securityPostureConfig.mode is not BASIC . GKE supports enabling configuration auditing on existing clusters by setting the security posture mode to standard, which maps to BASIC in the cluster configuration.

gcloud container clusters update $CLUSTER_NAME \\
 --location $LOCATION \\
 --project $PROJECT_ID \\
 --security-posture=standard

For new clusters, include --security-posture=standard during cluster creation when this setting must be explicitly enforced. Rerun the audit command and confirm that securityPostureConfig.mode returns BASIC . Initial configuration audit results can take several minutes to appear in the security posture dashboard and related logs.

Impact:

Enabling the GKE security posture dashboard is an observability and assessment control, so it does not directly block workload deployment or change running workloads. Findings still require review, prioritization, and remediation by the platform or application teams. Large clusters can also hit finding limits for workload configuration auditing, so teams should monitor dashboard coverage and use Cloud Logging when additional investigation is required.

See Also

https://workbench.cisecurity.org/benchmarks/24956

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-8(3), CSCv7|5.5

Plugin: GCP

Control ID: 6fe10cd23e582441091798257a1caa0d9f1cf41df7e86538503c28ef69039472