Detections
Analytics

5.6.4 Use DNS based access or private GKE control plane endpoints

Information

Use DNS based access or private GKE control plane endpoints to reduce Kubernetes API server exposure. Prefer DNS based control plane access where possible, and if IP based access is required, disable the external IP based endpoint or restrict it to trusted networks only.

The GKE control plane supports DNS based endpoints and IP based endpoints. The DNS based endpoint provides a stable fully qualified domain name for the control plane and can be protected using IAM, authentication tokens, and VPC Service Controls. This approach avoids exposing the control plane through a public IP address and provides a more flexible access model for administrators, automation, and private clients.

When IP based endpoints are required, disabling the external IP based endpoint or using authorized networks limits who can reach the Kubernetes API server. This reduces the control plane attack surface and helps protect the cluster if credentials, certificates, or automation tokens are exposed. If an external IP based endpoint must remain enabled, access should be restricted to approved CIDR ranges only.

Solution

Remediate existing GKE clusters by updating the control plane access configuration. Recreating the cluster is not required for this control. Choose the access model that matches the organization's approved management path.

Method 1: Use DNS based control plane access and disable IP based endpoint access where appropriate:

gcloud container clusters update $CLUSTER_NAME \\
 --location $LOCATION \\
 --project $PROJECT_ID \\
 --enable-dns-access \\
 --no-enable-ip-access

Method 2: Use IP based access with the external endpoint disabled and the private endpoint enabled:

gcloud container clusters update $CLUSTER_NAME \\
 --location $LOCATION \\
 --project $PROJECT_ID \\
 --enable-ip-access \\
 --enable-private-endpoint

If the public IP based endpoint must remain enabled, restrict it with authorized networks and use only approved CIDR ranges. Rerun the audit command and confirm that the selected access model is reflected in controlPlaneEndpointsConfig . If using DNS based access, update kubeconfig to use the DNS endpoint as needed.

Impact:

Restricting GKE control plane access can affect administrators, CI/CD systems, bastion hosts, monitoring tools, and automation that currently use the external IP based endpoint. Before disabling the external endpoint or moving to DNS based access, confirm that approved users and systems can still connect through the selected access path, such as DNS based access, private connectivity, Private Google Access, Cloud NAT, Private Service Connect, VPN, or Cloud Interconnect.

See Also

https://workbench.cisecurity.org/benchmarks/24956

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|SC-7, 800-53|SC-7(5), CSCv7|12

Plugin: GCP

Control ID: 2e7feb7206c9123852b1ca13c7628ef1fac8e3ee57977ee88ba2ef3751270786