cis-gke-v180-5-6-2

name	cis-gke-v180-5.6.2
description	Ensure use of VPC-native clusters (Automated)
category	cis-gke
version	1.8.0
author	cyberstrike-official
tags	["cis","gke","kubernetes","gcp","cluster-networking","vpc-flow-logs","intranode-visibility","vpc-native","private-cluster","authorized-networks","firewall","ssl-certificates"]
cis_id	5.6.2
cis_benchmark	CIS Google Kubernetes Engine (GKE) Benchmark v1.8.0
tech_stack	["kubernetes","gcp","gke"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

5.6.2 Ensure use of VPC-native clusters (Automated)

Profile Applicability

• Level 1

Description

Create Alias IPs for the node network CIDR range in order to subsequently configure IP-based policies and firewalling for pods. A cluster that uses Alias IPs is called a VPC-native cluster.

Rationale

Using Alias IPs has several benefits:

• Pod IPs are reserved within the network ahead of time, which prevents conflict with other compute resources.
• The networking layer can perform anti-spoofing checks to ensure that egress traffic is not sent with arbitrary source IPs.
• Firewall controls for Pods can be applied separately from their nodes.
• Alias IPs allow Pods to directly access hosted services without using a NAT gateway.

Impact

You cannot currently migrate an existing cluster that uses routes for Pod routing to a cluster that uses Alias IPs.

Cluster IPs for internal services remain only available from within the cluster. If you want to access a Kubernetes Service from within the VPC, but from outside of the cluster, use an internal load balancer.

Audit

Using Google Cloud Console:

1. Go to Kubernetes Engine by visiting: https://console.cloud.google.com/kubernetes/list.
2. From the list of clusters, click on the desired cluster to open the Details page. Under the 'Networking' section, make sure 'VPC-native traffic routing' is set to 'Enabled'.

Using Command Line: To check Alias IP is enabled for an existing cluster, first define 2 variables Cluster Name and Zone and then run the following command:

gcloud container clusters describe $CLUSTER_NAME --zone $COMPUTE_ZONE --format json | jq '.ipAllocationPolicy.useIpAliases'

The output of the above command should return

{
  "useIpAliases": true
}

if VPC-native (using alias IP) is enabled. If VPC-native (using alias IP) is disabled, the above command will return null ({ }).

Remediation

Alias IPs cannot be enabled on an existing cluster. To create a new cluster using Alias IPs, follow the instructions below. Using Google Cloud Console: If using Standard configuration mode:

1. Go to Kubernetes Engine by visiting: https://console.cloud.google.com/kubernetes/list.