K8s control plane access remediation

Using Console

To remediate the control plane endpoint access misconfiguration in GCP, you can follow these steps:

Open the Google Cloud Console and navigate to the VPC network page.
Select the VPC network that you want to configure.
Click on the “Firewall rules” tab.
Click on the “Create Firewall Rule” button.
In the “Name” field, enter a name for the firewall rule.
In the “Targets” field, select “All instances in the network”.
In the “Source IP ranges” field, enter the IP address range of the authorized networks that should have access to the control plane endpoint.
In the “Protocols and ports” section, select “Specified protocols and ports”.
In the “Specified protocols and ports” field, enter “tcp:443”.
Click on the “Create” button to create the firewall rule.

This will create a firewall rule that will restrict access to the control plane endpoint to only the authorized networks that you specified.

Using CLI

To remediate the misconfiguration “Control Plane Endpoint Access Should Be Limited To Authorized Networks” for GCP using GCP CLI, follow these steps:

Open the Cloud Shell in the GCP Console.
Run the following command to list the current authorized networks:

gcloud container clusters describe [CLUSTER_NAME] --zone [ZONE] --format="value(masterAuthorizedNetworksConfig.cidrBlocks)"

Replace [CLUSTER_NAME] and [ZONE] with the name and zone of your cluster.

If the output shows that there are no authorized networks, or if the authorized networks are not correct, run the following command to add authorized networks:

gcloud container clusters update [CLUSTER_NAME] --zone [ZONE] --update-master --master-authorized-networks=[CIDR_BLOCK]

Replace [CLUSTER_NAME], [ZONE], and [CIDR_BLOCK] with your own values. You can specify multiple CIDR blocks separated by commas.

Verify that the authorized networks have been added by running the first command again.
Repeat steps 2-4 for each cluster in your GCP project.

By following these steps, you will restrict access to the control plane endpoint to only the authorized networks, reducing the risk of unauthorized access.

Using Python

To remediate “Control Plane Endpoint Access Should Be Limited To Authorized Networks” for GCP using python, you can follow these steps:

Import necessary libraries:

from googleapiclient import discovery
from google.oauth2 import service_account

Set up authentication using a service account:

credentials = service_account.Credentials.from_service_account_file(
    '/path/to/service_account_key.json')

Initialize the GCP API client:

service = discovery.build('container', 'v1', credentials=credentials)

Get the current cluster configuration:

project_id = 'your-project-id'
zone = 'your-zone'
cluster_id = 'your-cluster-id'

cluster = service.projects().zones().clusters().get(
    projectId=project_id, zone=zone, clusterId=cluster_id).execute()

Update the cluster configuration to limit control plane endpoint access to authorized networks:

authorized_networks_config = {
    'enabled': True,
    'cidrBlocks': ['10.0.0.0/8', '172.16.0.0/12']
}

cluster['masterAuthorizedNetworksConfig'] = authorized_networks_config

response = service.projects().zones().clusters().update(
    projectId=project_id, zone=zone, clusterId=cluster_id, body=cluster).execute()

In this example, we are limiting control plane endpoint access to the IP ranges ‘10.0.0.0/8’ and ‘172.16.0.0/12’. You can modify the cidrBlocks list to include the authorized networks for your specific use case.Note: This code assumes that you have the necessary permissions to modify the cluster configuration.

Using Terraform

resource "google_container_cluster" "GKE_CLUSTER" {
  name     = "GKE_CLUSTER_NAME"              # substitute your cluster name
  location = "GKE_CLUSTER_LOCATION"          # e.g. "us-central1" or "us-central1-a"

  # ...other required arguments like network, subnetwork, initial_node_count, etc.

  # Restrict control plane (master) endpoint access to authorized networks only
  master_authorized_networks_config {
    cidr_blocks {
      display_name = "primary-office"
      cidr_block   = "AUTHORIZED_CIDR_1"     # e.g. "203.0.113.0/24"
    }

    cidr_blocks {
      display_name = "secondary-office"
      cidr_block   = "AUTHORIZED_CIDR_2"     # e.g. "198.51.100.0/24"
    }

    # add more cidr_blocks as needed for other authorized networks
  }
}

Substitute:

GKE_CLUSTER_NAME with your cluster’s name.
GKE_CLUSTER_LOCATION with the region/zone where the cluster runs.
AUTHORIZED_CIDR_1, AUTHORIZED_CIDR_2, etc. with the exact IPv4 CIDR ranges that should be able to reach the control plane.

This change is an in‑place update and should not force replacement of the cluster (no outage), though the control plane endpoint will stop accepting traffic from sources outside the listed CIDRs.For verification, terraform plan should show an in-place ~ update to google_container_cluster.GKE_CLUSTER with master_authorized_networks_config being added or modified, and no -/+ replacement of the cluster.

GCP Introduction

GCP Pricing

GCP Threats

GCP Misconfigurations

Resources

GCP Threats

K8s control plane access remediation

Triage and Remediation

Remediation

​Triage and Remediation

​Remediation

​

Triage and Remediation

Remediation