cis-gke-autopilot-v120-5-5-1

name	cis-gke-autopilot-v120-5.5.1
description	Manage Kubernetes RBAC users with Google Groups for GKE (Manual)
category	cis-gke-autopilot
version	1.2.0
author	cyberstrike-official
tags	["cis","gke-autopilot","kubernetes","gcp","authentication","authorization","google-groups"]
cis_id	5.5.1
cis_benchmark	CIS Google Kubernetes Engine (GKE) Autopilot Benchmark v1.2.0
tech_stack	["kubernetes","gcp","gke"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

5.5.1 Manage Kubernetes RBAC users with Google Groups for GKE (Manual)

Profile Applicability

• Level 2

Description

Cluster Administrators should leverage G Suite Groups and Cloud IAM to assign Kubernetes user roles to a collection of users, instead of to individual emails using only Cloud IAM.

Rationale

On- and off-boarding users is often difficult to automate and prone to error. Using a single source of truth for user permissions via G Suite Groups reduces the number of locations that an individual must be off-boarded from, and prevents users gaining unique permissions sets that increase the cost of audit.

Impact

When migrating to using security groups, an audit of RoleBindings and ClusterRoleBindings is required to ensure all users of the cluster are managed using the new groups and not individually.

When managing RoleBindings and ClusterRoleBindings, be wary of inadvertently removing bindings required by service accounts.

Audit

Using G Suite Admin Console and Google Cloud Console:

1. Navigate to manage G Suite Groups in the Google Admin console at: https://admin.google.com/dashboard
2. Ensure there is a group named gke-security-groups@[yourdomain.com]. The group must be named exactly gke-security-groups.
3. Ensure only further groups (not individual users) are included in the gke-security-groups group as members.
4. Go to the Kubernetes Engine by visiting: https://console.cloud.google.com/kubernetes/list.
5. From the list of clusters, click on the desired cluster. In the Details pane, make sure Google Groups for RBAC is set to Enabled.

Remediation

Follow the G Suite Groups instructions at: https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control#google-groups-for-gke.

Then, create a cluster with:

gcloud container clusters create <cluster_name> --security-group <security_group_name>

Finally create Roles, ClusterRoles, RoleBindings, and ClusterRoleBindings that reference the G Suite Groups.