Ensure The Gke Metadata Server Is Enabled

#!/usr/bin/env bash
# Report GKE Metadata Server / Workload Identity status for all clusters in a project.
# Runs from: any machine with gcloud, jq, and appropriate IAM permissions.

set -euo pipefail

PROJECT_ID="$(gcloud config get-value project 2>/dev/null)"

if [[ -z "${PROJECT_ID}" || "${PROJECT_ID}" == "(unset)" ]]; then
  echo "ERROR: gcloud project is not set. Run: gcloud config set project YOUR_PROJECT_ID" >&2
  exit 1
fi

echo "Project: ${PROJECT_ID}"
echo

# List all clusters (both zonal and regional)
mapfile -t CLUSTERS < <(gcloud container clusters list \
  --project "${PROJECT_ID}" \
  --format='value(name,location)' 2>/dev/null)

if [[ "${#CLUSTERS[@]}" -eq 0 ]]; then
  echo "No GKE clusters found in project ${PROJECT_ID}."
  exit 0
fi

printf "%-30s %-20s %-25s %-35s %-15s\n" \
  "CLUSTER" "LOCATION" "NODE_POOL" "WORKLOAD_METADATA_MODE" "ISSUE?"
printf "%0.s-" {1..130}; echo

for ENTRY in "${CLUSTERS[@]}"; do
  CLUSTER_NAME="$(awk '{print $1}' <<< "${ENTRY}")"
  LOCATION="$(awk '{print $2}' <<< "${ENTRY}")"

  # Describe cluster nodePools and workloadMetadataConfig
  DESC_JSON="$(gcloud container clusters describe "${CLUSTER_NAME}" \
    --location "${LOCATION}" \
    --project "${PROJECT_ID}" \
    --format=json 2>/dev/null || true)"

  if [[ -z "${DESC_JSON}" ]]; then
    printf "%-30s %-20s %-25s %-35s %-15s\n" \
      "${CLUSTER_NAME}" "${LOCATION}" "-" "DESCRIBE_FAILED" "REVIEW"
    continue
  fi

  # Get identity namespace for the cluster (Workload Identity enabled if non-empty)
  ID_NS="$(jq -r '.workloadIdentityConfig.identityNamespace // empty' <<< "${DESC_JSON}")"
  if [[ -z "${ID_NS}" ]]; then
    CLUSTER_WI="DISABLED"
  else
    CLUSTER_WI="ENABLED (${ID_NS})"
  fi

  # Iterate node pools
  NP_COUNT="$(jq '.nodePools | length' <<< "${DESC_JSON}")"
  if [[ "${NP_COUNT}" -eq 0 ]]; then
    printf "%-30s %-20s %-25s %-35s %-15s\n" \
      "${CLUSTER_NAME}" "${LOCATION}" "-" "NO_NODE_POOLS" "REVIEW"
    continue
  fi

  for ((i=0; i<NP_COUNT; i++)); do
    NP_NAME="$(jq -r ".nodePools[${i}].name" <<< "${DESC_JSON}")"
    MODE="$(jq -r ".nodePools[${i}].config.workloadMetadataConfig.mode // \"UNSPECIFIED\"" <<< "${DESC_JSON}")"

    # Normalize and flag issues:
    # EXPECTED secure setting: GKE_METADATA or GKE_METADATA_SERVER (legacy name).
    # Problematic / needs review:
    #   - MODE == "GCE_METADATA" (pods can query full instance metadata)
    #   - MODE == "UNSPECIFIED" (older clusters / unclear behavior)
    #   - Cluster workload identity disabled but node pool uses GKE_METADATA(_SERVER)
    ISSUE="OK"

    case "${MODE}" in
      "GKE_METADATA"|"GKE_METADATA_SERVER")
        # Good from metadata-server perspective, but cluster WI disabled is a config mismatch
        if [[ "${CLUSTER_WI}" == "DISABLED" ]]; then
          ISSUE="REVIEW_WI"
        fi
        ;;
      "GCE_METADATA")
        ISSUE="PROBLEM"
        ;;
      "UNSPECIFIED")
        ISSUE="REVIEW"
        ;;
      *)
        ISSUE="REVIEW"
        ;;
    esac

    printf "%-30s %-20s %-25s %-35s %-15s\n" \
      "${CLUSTER_NAME}" "${LOCATION}" "${NP_NAME}" "${MODE} / WI:${CLUSTER_WI}" "${ISSUE}"
  done
done

cat <<'EOF'

Interpretation:

- WORKLOAD_METADATA_MODE = GCE_METADATA  (ISSUE=PROBLEM)
    -> Workloads access the full Compute Engine metadata server from the node.
       This is *not* using the GKE Metadata Server and should be remediated.

- WORKLOAD_METADATA_MODE = UNSPECIFIED or any unexpected value (ISSUE=REVIEW)
    -> Older / unclear configuration. Manually inspect the cluster and node pool
       settings in the GCP Console or with:
          gcloud container clusters describe CLUSTER --location LOCATION --format=json

- WORKLOAD_METADATA_MODE = GKE_METADATA or GKE_METADATA_SERVER AND WI enabled (ISSUE=OK)
    -> Desired state: GKE Metadata Server is used and Workload Identity is configured.

- WORKLOAD_METADATA_MODE = GKE_METADATA or GKE_METADATA_SERVER AND WI disabled (ISSUE=REVIEW_WI)
    -> Node pools use GKE Metadata Server, but the cluster identity namespace is not set.
       Review whether Workload Identity should be enabled for this cluster.

Use this report to decide where to apply:
  - Cluster-level Workload Identity: 
      gcloud container clusters update CLUSTER_NAME \
        --location=LOCATION \
        --identity-namespace=PROJECT_ID.svc.id.goog

  - Node pool-level metadata mode:
      gcloud container node-pools update NODE_POOL_NAME \
        --cluster=CLUSTER_NAME \
        --location=LOCATION \
        --workload-metadata-from-node=GKE_METADATA_SERVER

These commands are *not* executed by this script; they require manual review
and explicit action per cluster and node pool.
EOF