Ensure Kubernetes Secrets Are Encrypted Using Keys Managed In Cloud KMS

#!/usr/bin/env bash
#
# Check GKE clusters for Application-layer Secrets Encryption with Cloud KMS.
#
# REQUIREMENTS:
# - Runs on: any machine with gcloud, jq, and access to the relevant projects.
# - Auth: 'gcloud auth login' (or service account) and 'gcloud config set project' as needed.
#
# USAGE:
#   ./check_gke_kms_encryption.sh                          # use current gcloud project
#   GCP_PROJECTS="proj-a proj-b" ./check_gke_kms_encryption.sh
#   GCP_PROJECTS="$(gcloud projects list --format='value(projectId)')" ./check_gke_kms_encryption.sh
#
# OUTPUT:
#   Columns:
#     PROJECT           GKE project ID
#     CLUSTER          GKE cluster name
#     LOCATION         Cluster location (zone or region)
#     ENABLED          true/false if databaseEncryption is enabled
#     KEY_RESOURCE     Full KMS key resource, or "-" if not set
#     STATE            OK / NOT_ENCRYPTED / MISCONFIGURED
#
# INTERPRETATION (what indicates a problem):
#   - STATE=NOT_ENCRYPTED
#       => Application-layer Secrets Encryption is NOT enabled. This fails CIS GKE 5.3.1.
#   - STATE=MISCONFIGURED
#       => 'databaseEncryption' block exists but is missing key fields
#          (e.g., keyName or state). Requires manual review.
#   - STATE=OK
#       => Application-layer Secrets Encryption is enabled and has a KMS key configured.
#
set -euo pipefail

# ANSI colors for readability (can be disabled by setting NO_COLOR=1)
if [[ "${NO_COLOR:-}" == "1" ]]; then
  RED=""; GREEN=""; YELLOW=""; RESET=""
else
  RED="$(printf '\033[31m')"
  GREEN="$(printf '\033[32m')"
  YELLOW="$(printf '\033[33m')"
  RESET="$(printf '\033[0m')"
fi

PROJECTS=()
if [[ -n "${GCP_PROJECTS:-}" ]]; then
  # Space-separated list from env var
  read -r -a PROJECTS <<< "${GCP_PROJECTS}"
else
  # Use current gcloud project
  CURRENT_PROJECT="$(gcloud config get-value project 2>/dev/null || true)"
  if [[ -z "${CURRENT_PROJECT}" ]]; then
    echo "ERROR: No projects specified and no current gcloud project set." >&2
    echo "       Set GCP_PROJECTS or run: gcloud config set project <project_id>" >&2
    exit 1
  fi
  PROJECTS=("${CURRENT_PROJECT}")
fi

echo "PROJECT,CLUSTER,LOCATION,ENABLED,KEY_RESOURCE,STATE"  # CSV header

for PROJECT in "${PROJECTS[@]}"; do
  CLUSTERS_JSON="$(gcloud container clusters list \
      --project "${PROJECT}" \
      --format=json 2>/dev/null || true)"

  if [[ -z "${CLUSTERS_JSON}" || "${CLUSTERS_JSON}" == "[]" ]]; then
    # No clusters in this project; continue silently.
    continue
  fi

  echo "${CLUSTERS_JSON}" | jq -c '.[]' | while read -r CLUSTER; do
    NAME="$(echo "${CLUSTER}" | jq -r '.name')"
    LOCATION="$(echo "${CLUSTER}" | jq -r '.location')"

    # Describe cluster to inspect databaseEncryption
    DESCRIBE_JSON="$(gcloud container clusters describe "${NAME}" \
        --location "${LOCATION}" \
        --project "${PROJECT}" \
        --format=json 2>/dev/null || true)"

    if [[ -z "${DESCRIBE_JSON}" ]]; then
      STATE="MISCONFIGURED"
      ENABLED="unknown"
      KEY_RESOURCE="-"
      printf '%s,"%s",%s,%s,%s,%s%s%s\n' \
        "${PROJECT}" "${NAME}" "${LOCATION}" "${ENABLED}" "${KEY_RESOURCE}" \
        "${YELLOW}" "${STATE}" "${RESET}"
      continue
    fi

    DB_ENCRYPTION="$(echo "${DESCRIBE_JSON}" | jq -c '.databaseEncryption // {}')"
    RAW_STATE="$(echo "${DB_ENCRYPTION}" | jq -r '.state // empty')"
    KEY_NAME="$(echo "${DB_ENCRYPTION}" | jq -r '.keyName // empty')"

    if [[ -z "${RAW_STATE}" ]]; then
      # No state field at all => not configured
      ENABLED="false"
      KEY_RESOURCE="-"
      STATE="NOT_ENCRYPTED"
      COLOR="${RED}"
    elif [[ "${RAW_STATE}" != "ENCRYPTED" ]]; then
      # State present but not ENCRYPTED (e.g., DECRYPTED or UNKNOWN)
      ENABLED="false"
      KEY_RESOURCE="${KEY_NAME:-"-"}"
      STATE="NOT_ENCRYPTED"
      COLOR="${RED}"
    else
      # State == ENCRYPTED, verify keyName present
      if [[ -z "${KEY_NAME}" ]]; then
        ENABLED="true"
        KEY_RESOURCE="-"
        STATE="MISCONFIGURED"
        COLOR="${YELLOW}"
      else
        ENABLED="true"
        KEY_RESOURCE="${KEY_NAME}"
        STATE="OK"
        COLOR="${GREEN}"
      fi
    fi

    printf '%s,"%s",%s,%s,"%s",%s%s%s\n' \
      "${PROJECT}" "${NAME}" "${LOCATION}" "${ENABLED}" "${KEY_RESOURCE}" \
      "${COLOR}" "${STATE}" "${RESET}"
  done
done