Ensure that your Google Kubernetes Engine (GKE) clusters are configured with master authorized networks in order to limit their exposure to the Internet. Master authorized networks allow you to whitelist specific IP addresses and/or IP address ranges to access your cluster master endpoint using HTTPS.
Adding master authorized networks can provide network level protection and additional security benefits for your GKE cluster. Authorized networks grant access to a specific set of trusted IP addresses, such as those that originate from a secure network. This can help protect access to your GKE cluster in the case of a vulnerability in the cluster's authentication or authorization mechanism.
To determine if your Google Kubernetes Engine (GKE) clusters are exposed to the Internet, perform the following operations:
Remediation / Resolution
To restrict access to your Google Kubernetes Engine (GKE) clusters and limit their exposure to the Internet using authorized networks, perform the following operations:Note: Authorized networks block untrusted IP addresses from outside Google Cloud Platform (GCP). IPs from inside Google Cloud (such as traffic from Compute Engine virtual machines) can reach the cluster provided that they have the necessary Kubernetes access credentials.
Unlock the Remediation Steps
Gain free unlimited access
to our full Knowledge Base
Over 750 rules & best practices
Get started for FREE
You are auditing:
Restrict Network Access to GKE Clusters
Risk level: High