Shielded Nodes Should Be Used For Kubernetes Cluster

Using Console

To remediate the misconfiguration of not using Shielded Nodes for a Kubernetes Cluster in GCP, you can follow the below steps using GCP console:

Go to the GCP Console and select the Kubernetes Engine from the navigation menu.
Select the Kubernetes Cluster for which you want to enable Shielded Nodes.
Click on the Edit button at the top of the page.
Scroll down to the Node Pools section and click on the node pool name for which you want to enable Shielded Nodes.
In the Node Pool edit page, scroll down to the Security section and enable the Shielded Nodes option.
Click on the Save button to save the changes.

After completing these steps, Shielded Nodes will be enabled for the selected node pool in your Kubernetes Cluster. You can repeat these steps for all the node pools in your cluster to ensure that all nodes are using Shielded Nodes.

Using CLI

To remediate the misconfiguration of using shielded nodes for a Kubernetes cluster on GCP using GCP CLI, you can follow the below steps:

First, you need to check if the Kubernetes cluster is using shielded nodes or not. To check this, run the following command:

gcloud container clusters describe [CLUSTER-NAME] --zone [ZONE] | grep -i shielded

If the output of the above command shows that shielded nodes are not enabled, then you can enable it by running the following command:

gcloud beta container clusters update [CLUSTER-NAME] --zone [ZONE] --update-shielded-nodes

If the output of the above command shows an error message saying that the beta component is not enabled, then you need to enable it by running the following command:

gcloud components install beta

Once the beta component is installed, you can run the previous command again to enable the shielded nodes.
After enabling the shielded nodes, you can verify it by running the first command again. The output should show that shielded nodes are enabled for the Kubernetes cluster.

By following the above steps, you can remediate the misconfiguration of not using shielded nodes for a Kubernetes cluster on GCP using GCP CLI.

Using Python

To remediate the misconfiguration of not using shielded nodes for a Kubernetes cluster in GCP using Python, follow these steps:

Install the Google Cloud SDK and Python client library using the following commands:

curl https://sdk.cloud.google.com | bash
exec -l $SHELL
gcloud init
pip install google-cloud

Create a new GCP project or select an existing project to work with.
Enable the necessary APIs for the project using the following command:

gcloud services enable container.googleapis.com

Authenticate the SDK using the following command:

gcloud auth login

Create a new Kubernetes cluster using the following command:

gcloud container clusters create [CLUSTER_NAME] --shielded-secure-boot --shielded-integrity-monitoring

Verify that the shielded nodes are enabled for the cluster using the following command:

gcloud container clusters describe [CLUSTER_NAME] --format='get(shieldedNodes.enabled)'

This command should return “True” indicating that the shielded nodes are enabled for the cluster.

If you have an existing cluster, you can update the cluster to enable shielded nodes using the following command:

gcloud container clusters update [CLUSTER_NAME] --shielded-secure-boot --shielded-integrity-monitoring

This command will update the existing cluster to enable shielded nodes.By following these steps, the misconfiguration of not using shielded nodes for a Kubernetes cluster in GCP can be remediated using Python.

Using Terraform

resource "google_container_cluster" "GKE_CLUSTER" {
  name     = "GKE_CLUSTER_NAME"          # Replace with your cluster name
  location = "GCP_REGION_OR_ZONE"        # e.g. "us-central1" or "us-central1-a"

  # ...other required arguments (network, subnetwork, ip_allocation_policy, etc.)

  remove_default_node_pool = true
  initial_node_count       = 1

  # Optional but recommended: enforce shielded nodes at cluster level so all new node pools inherit it
  enable_shielded_nodes = true
}

resource "google_container_node_pool" "GKE_NODE_POOL" {
  name       = "GKE_NODE_POOL_NAME"      # Replace with your node pool name
  cluster    = google_container_cluster.GKE_CLUSTER.name
  location   = google_container_cluster.GKE_CLUSTER.location

  node_count = 3

  node_config {
    machine_type = "e2-medium"           # Replace as needed

    shielded_instance_config {
      enable_secure_boot = true
    }

    # ...any other node_config settings (oauth_scopes, service_account, etc.)
  }

  # ...any autoscaling / management blocks as needed
}

Enabling shielded_instance_config.enable_secure_boot = true on an existing node pool forces recreation of the nodes in that pool (the node pool may be replaced depending on current settings), which is a disruptive change for workloads running on those nodes.To verify, terraform plan should show the google_container_node_pool (and optionally google_container_cluster) gaining shielded_instance_config.enable_secure_boot = true, with node recreation indicated in the plan.

GCP Introduction

GCP Pricing

GCP Threats

GCP Misconfigurations

Resources

GCP Threats

Shielded Nodes Should Be Used For Kubernetes Cluster

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: