Ensure shielded nodes are enabled for all nodes in Google Container Cluster

LOW

Description

Google Kubernetes Engine (GKE) has the capability only allow shielded nodes which can be used to protect workloads from attack. This is enabled by default but can be overridden. For more information on shielded nodes, see the GCP documentation.
References:
https://cloud.google.com/kubernetes-engine/docs/how-to/shielded-gke-nodes

Remediation

In GCP Console -

  1. Open the GCP Portal and Go to the Google Kubernetes Engine (GKE).
  2. Select the cluster you want to edit.
  3. Click Nodes, Select the node pool.
  4. Select the Enable Shielded GKE Nodes checkbox.
  5. Click Save Changes.

In Terraform -

  1. In the google_container_cluster resource, set the attribute enable_shielded_nodes attribute is set to true.

References:
https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_cluster#http_load_balancing

Policy Details

Rule Reference ID: AC_GCP_0272
CSP: GCP
Remediation Available: Yes
Resource Category: Compute

Frameworks