| name | cis-gke-autopilot-v120-5.5.1 |
| description | Manage Kubernetes RBAC users with Google Groups for GKE (Manual) |
| category | cis-gke-autopilot |
| version | 1.2.0 |
| author | cyberstrike-official |
| tags | ["cis","gke-autopilot","kubernetes","gcp","authentication","authorization","google-groups"] |
| cis_id | 5.5.1 |
| cis_benchmark | CIS Google Kubernetes Engine (GKE) Autopilot Benchmark v1.2.0 |
| tech_stack | ["kubernetes","gcp","gke"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
5.5.1 Manage Kubernetes RBAC users with Google Groups for GKE (Manual)
Profile Applicability
Description
Cluster Administrators should leverage G Suite Groups and Cloud IAM to assign Kubernetes user roles to a collection of users, instead of to individual emails using only Cloud IAM.
Rationale
On- and off-boarding users is often difficult to automate and prone to error. Using a single source of truth for user permissions via G Suite Groups reduces the number of locations that an individual must be off-boarded from, and prevents users gaining unique permissions sets that increase the cost of audit.
Impact
When migrating to using security groups, an audit of RoleBindings and ClusterRoleBindings is required to ensure all users of the cluster are managed using the new groups and not individually.
When managing RoleBindings and ClusterRoleBindings, be wary of inadvertently removing bindings required by service accounts.
Audit
Using G Suite Admin Console and Google Cloud Console:
- Navigate to manage G Suite Groups in the Google Admin console at: https://admin.google.com/dashboard
- Ensure there is a group named
gke-security-groups@[yourdomain.com]. The group must be named exactly gke-security-groups.
- Ensure only further groups (not individual users) are included in the
gke-security-groups group as members.
- Go to the Kubernetes Engine by visiting: https://console.cloud.google.com/kubernetes/list.
- From the list of clusters, click on the desired cluster. In the
Details pane, make sure Google Groups for RBAC is set to Enabled.
Remediation
Follow the G Suite Groups instructions at: https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control#google-groups-for-gke.
Then, create a cluster with:
gcloud container clusters create <cluster_name> --security-group <security_group_name>
Finally create Roles, ClusterRoles, RoleBindings, and ClusterRoleBindings that reference the G Suite Groups.
