cis-gke-v180-5-6-6

name	cis-gke-v180-5.6.6
description	Consider firewalling GKE worker nodes (Manual)
category	cis-gke
version	1.8.0
author	cyberstrike-official
tags	["cis","gke","kubernetes","gcp","cluster-networking","vpc-flow-logs","intranode-visibility","vpc-native","private-cluster","authorized-networks","firewall","ssl-certificates"]
cis_id	5.6.6
cis_benchmark	CIS Google Kubernetes Engine (GKE) Benchmark v1.8.0
tech_stack	["kubernetes","gcp","gke"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

5.6.6 Consider firewalling GKE worker nodes (Manual)

Profile Applicability

• Level 2

Description

Reduce the network attack surface of GKE nodes by using Firewalls to restrict ingress and egress traffic.

Rationale

Utilizing stringent ingress and egress firewall rules minimizes the ports and services exposed to an network-based attacker, whilst also restricting egress routes within or out of the cluster in the event that a compromised component attempts to form an outbound connection.

Impact

All instances targeted by a firewall rule, either using a tag or a service account will be affected. Ensure there are no adverse effects on other instances using the target tag or service account before implementing the firewall rule.

Audit

Using Google Cloud Console:

1. Go to Compute Engine by visiting: https://console.cloud.google.com/compute/instances.
2. For each instance within your cluster, use the 'more actions' menu (3 vertical dots) and select to 'View network details'.
3. If there are multiple network interfaces attached to the instance, select the network interface to view in the 'Network interface' details section and see all the rules that apply to the network interface, within the 'Firewall rules' tab. Make sure the firewall rules are appropriate for your environment.

Using Command Line: For the instance being evaluated, first define 2 variables Instance Name and Zone and then run the following command:

gcloud compute instances describe $INSTANCE_NAME --zone $COMPUTE_ZONE --format json | jq '{tags: .tags.items[], serviceaccount:.serviceAccounts[].email, network: .networkInterfaces[].network}'

This will return:

{
  "tags": "<tag>",
  "serviceaccount": "<service_account>"
  "network": "https://www.googleapis.com/compute/v1/projects/<project_id>/global/networks/<network>"
}

Then, observe the firewall rules applied to the instance by using the following command, replacing <tag> and <service_account> as appropriate:

gcloud compute firewall-rules list \
  --format="table(
              name,
              network,
              direction,
              priority,
              sourceRanges.list():label=SRC_RANGES,
              destinationRanges.list():label=DEST_RANGES,
              allowed[].map().firewall_rule().list():label=ALLOW,
              denied[].map().firewall_rule().list():label=DENY,
              sourceTags.list():label=SRC_TAGS,
              sourceServiceAccounts.list():label=SRC_SVC_ACCT,
              targetTags.list():label=TARGET_TAGS,
              targetServiceAccounts.list():label=TARGET_SVC_ACCT,
              disabled
            )" \
  --filter="targetTags.list():<tag> OR targetServiceAccounts.list():<service_account>"