Menu
Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.
Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-gke-v180-5-4-1La commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.
Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.
Basé sur la classification professionnelle SOC
Affichage de SKILL.md
| name | cis-gke-v180-5.4.1 |
| description | Ensure the GKE Metadata Server is Enabled (Automated) |
| category | cis-gke |
| version | 1.8.0 |
| author | cyberstrike-official |
| tags | ["cis","gke","kubernetes","gcp","node-metadata","metadata-server"] |
| cis_id | 5.4.1 |
| cis_benchmark | CIS Google Kubernetes Engine (GKE) Benchmark v1.8.0 |
| tech_stack |
| ["kubernetes","gcp","gke"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Running the GKE Metadata Server prevents workloads from accessing sensitive instance metadata and facilitates Workload Identity.
Every node stores its metadata on a metadata server. Some of this metadata, such as kubelet credentials and the VM instance identity token, is sensitive and should not be exposed to a Kubernetes workload. Enabling the GKE Metadata server prevents pods (that are not running on the host network) from accessing this metadata and facilitates Workload Identity.
When unspecified, the default setting allows running pods to have full access to the node's underlying metadata server.
The GKE Metadata Server must be run when using Workload Identity. Because Workload Identity replaces the need to use Metadata Concealment, the two approaches are incompatible.
When the GKE Metadata Server and Workload Identity are enabled, unless the Pod is running on the host network, Pods cannot use the the Compute Engine default service account.
Workloads may need modification in order for them to use Workload Identity as described within: https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity.
Using Google Cloud Console
Details pane, and ensure that the GKE Metadata Server is set to Enabled.Using Command Line To check whether the GKE Metadata Server is enabled for each Node pool within a cluster define 2 variables for Cluster Name and Zone and then run the following command:
gcloud container clusters describe $CLUSTER_NAME --zone $COMPUTE_ZONE --format json | jq '.nodePools[].config.workloadMetadataConfig'
This should return the following for each Node pool:
{
"mode": "GKE_METADATA"
}
Null ({ }) is returned if the GKE Metadata Server is not enabled.
The GKE Metadata Server requires Workload Identity to be enabled on a cluster. Modify the cluster to enable Workload Identity and enable the GKE Metadata Server.
Using Google Cloud Console
DETAILS pane, navigate down to the Security subsection.Edit Workload Identity, click on Enable Workload Identity in the pop-up window, and select a workload pool from the drop-down box. By default, it will be the namespace of the Cloud project containing the cluster, for example: <project_id>.svc.id.goog.SAVE CHANGES and wait for the cluster to update.EDIT within the Node Pool details page.Edit node pool pane, check the Enable GKE Metadata Server checkbox.SAVE.Using Command Line
gcloud container clusters update <cluster_name> --identity-namespace=<project_id>.svc.id.goog
Note that existing Node pools are unaffected. New Node pools default to --workload-metadata-from-node=GKE_METADATA_SERVER.
To modify an existing Node pool to enable GKE Metadata Server:
gcloud container node-pools update <node_pool_name> --cluster=<cluster_name> --workload-metadata-from-node=GKE_METADATA_SERVER
Workloads may need modification in order for them to use Workload Identity as described within: https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity.
By default, running pods to have full access to the node's underlying metadata server.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 16.7 Use Standard Hardening Configuration Templates for Application Infrastructure | x | x | |
| v7 | 5.2 Maintain Secure Images | x | x |