cis-gke-v180-5-6-4

name	cis-gke-v180-5.6.4
description	Ensure clusters are created with Private Endpoint Enabled and Public Access Disabled (Automated)
category	cis-gke
version	1.8.0
author	cyberstrike-official
tags	["cis","gke","kubernetes","gcp","cluster-networking","vpc-flow-logs","intranode-visibility","vpc-native","private-cluster","authorized-networks","firewall","ssl-certificates"]
cis_id	5.6.4
cis_benchmark	CIS Google Kubernetes Engine (GKE) Benchmark v1.8.0
tech_stack	["kubernetes","gcp","gke"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

5.6.4 Ensure clusters are created with Private Endpoint Enabled and Public Access Disabled (Automated)

Profile Applicability

• Level 2

Description

Disable access to the Kubernetes API from outside the node network if it is not required.

Rationale

In a private cluster, the master node has two endpoints, a private and public endpoint. The private endpoint is the internal IP address of the master, behind an internal load balancer in the master's VPC network. Nodes communicate with the master using the private endpoint. The public endpoint enables the Kubernetes API to be accessed from outside the master's VPC network.

Although Kubernetes API requires an authorized token to perform sensitive actions, a vulnerability could potentially expose the Kubernetes publically with unrestricted access. Additionally, an attacker may be able to identify the current cluster and Kubernetes API version and determine whether it is vulnerable to an attack. Unless required, disabling public endpoint will help prevent such threats, and require the attacker to be on the master's VPC network to perform any attack on the Kubernetes API.

Impact

To enable a Private Endpoint, the cluster has to also be configured with private nodes, a private master IP range and IP aliasing enabled.

If the Private Endpoint flag --enable-private-endpoint is passed to the gcloud CLI, or the external IP address undefined in the Google Cloud Console during cluster creation, then all access from a public IP address is prohibited.

Audit

Using Google Cloud Console:

1. Go to Kubernetes Engine by visiting https://console.cloud.google.com/kubernetes/list.
2. Select the required cluster, and within the Details pane, make sure the 'Endpoint' does not have a public IP address.

Using Command Line: To check Private Endpoint status for an existing cluster, first define 2 variables Cluster Name and Zone and then run the following command:

gcloud container clusters describe $CLUSTER_NAME --zone $COMPUTE_ZONE --format json | jq '.privateClusterConfig.enablePrivateEndpoint'

The output of the above command returns

{
  "enablePrivateEndpoint": true
}

if a Private Endpoint is enabled with Public Access disabled. For an additional check, the endpoint parameter can be queried with the following command: