cis-gke-v180-5-6-1

name	cis-gke-v180-5.6.1
description	Enable VPC Flow Logs and Intranode Visibility (Automated)
category	cis-gke
version	1.8.0
author	cyberstrike-official
tags	["cis","gke","kubernetes","gcp","cluster-networking","vpc-flow-logs","intranode-visibility","vpc-native","private-cluster","authorized-networks","firewall","ssl-certificates"]
cis_id	5.6.1
cis_benchmark	CIS Google Kubernetes Engine (GKE) Benchmark v1.8.0
tech_stack	["kubernetes","gcp","gke"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

5.6.1 Enable VPC Flow Logs and Intranode Visibility (Automated)

Profile Applicability

• Level 2

Description

Enable VPC Flow Logs and Intranode Visibility to see pod-level traffic, even for traffic within a worker node.

Rationale

Enabling Intranode Visibility makes intranode pod to pod traffic visible to the networking fabric. With this feature, VPC Flow Logs or other VPC features can be used for intranode traffic.

Impact

Enabling it on existing cluster causes the cluster master and the cluster nodes to restart, which might cause disruption.

Audit

Using Google Cloud Console:

1. Go to Kubernetes Engine by visiting: https://console.cloud.google.com/kubernetes/list.
2. Select the desired cluster, and under the Cluster section, make sure that Intranode visibility is set to Enabled.

Using Command Line: To check for Intranode Visibility in the cluster, first define 2 variables Cluster Name and Zone and then run the following command for each Node pool:

gcloud container clusters describe $CLUSTER_NAME --zone $COMPUTE_ZONE --format json | jq '.networkConfig.enableIntraNodeVisibility'

The result should return:

{
  "enableIntraNodeVisibility": true
}

if Intranode Visibility is Enabled.

Remediation

Enable Intranode Visibility: Using Google Cloud Console:

1. Go to Kubernetes Engine by visiting: https://console.cloud.google.com/kubernetes/list.
2. Select Kubernetes clusters for which intranode visibility is disabled.
3. Within the Details pane, under the Network section, click on the pencil icon named Edit intranode visibility.
4. Check the box next to Enable Intranode visibility.
5. Click SAVE CHANGES.

Using Command Line: To enable intranode visibility on an existing cluster, run the following command:

gcloud container clusters update <cluster_name> --enable-intra-node-visibility