GCP GKE Hardening

GKE Autopilot: Private nodes and a private control-plane endpoint are enforced by default in Autopilot clusters. Authorized networks for the control-plane endpoint should still be explicitly configured. GKE Standard: Pass --enable-private-nodes, --enable-private-endpoint, --master-ipv4-cidr-block, and --enable-master-authorized-networks at cluster creation. CIS GKE Autopilot Benchmark v1.3.0 documents Autopilot-specific defaults.

Enable a private GKE cluster so worker nodes have no public IP addresses, and enable a private control-plane endpoint so the kube-apiserver is not reachable from the public internet. Combine with master authorized networks to restrict which CIDR ranges can reach the control plane. A public kube-apiserver is the number-one Kubernetes breach vector — any leaked credential is immediately usable from the internet without network-level barriers.

Remediation — Terraform

# Terraform Google provider ~> 6.0
resource "google_container_cluster" "hardened" {
  name     = "hardened-cluster"
  location = var.region

  # Private cluster — no external IPs on nodes
  private_cluster_config {
    enable_private_nodes    = true
    enable_private_endpoint = true
    master_ipv4_cidr_block  = "172.16.0.0/28"
  }

  # Restrict control-plane access to authorized CIDR ranges
  master_authorized_networks_config {
    cidr_blocks {
      cidr_block   = var.management_cidr
      display_name = "management-network"
    }
  }

  # VPC-native cluster (alias IP ranges)
  ip_allocation_policy {}

  # Dataplane V2 enables NetworkPolicy enforcement via Cilium
  datapath_provider = "ADVANCED_DATAPATH"
}

Remediation — gcloud

gcloud container clusters create CLUSTER_NAME \
  --enable-private-nodes \
  --enable-private-endpoint \
  --master-ipv4-cidr-block 172.16.0.0/28 \
  --enable-master-authorized-networks \
  --master-authorized-networks MGMT_CIDR/32 \
  --region REGION

Remediation — Config Connector

apiVersion: container.cnrm.cloud.google.com/v1beta1
kind: ContainerCluster
metadata:
  name: hardened-gke
  namespace: config-control
spec:
  location: us-central1
  initialNodeCount: 1
  privateClusterConfig:
    enablePrivateNodes: true
    enablePrivateEndpoint: true
    masterIpv4CidrBlock: "172.16.0.0/28"
  masterAuthorizedNetworksConfig:
    cidrBlocks:
    - cidrBlock: "10.0.0.0/8"
      displayName: "corp-vpn"
  networkRef:
    name: gke-vpc
  subnetworkRef:
    name: gke-subnet

Remediation — Pulumi (TypeScript)

import * as gcp from "@pulumi/gcp";

// Private GKE cluster with private endpoint and master-authorized-networks lock.
const hardenedCluster = new gcp.container.Cluster("hardened-gke", {
    name: "hardened-gke",
    location: "us-central1",
    initialNodeCount: 1,
    removeDefaultNodePool: true,
    privateClusterConfig: {
        enablePrivateNodes: true,
        enablePrivateEndpoint: true,
        masterIpv4CidrBlock: "172.16.0.0/28",
    },
    masterAuthorizedNetworksConfig: {
        cidrBlocks: [{ cidrBlock: "10.0.0.0/8", displayName: "corp-vpn" }],
    },
    network: gkeVpc.id,
    subnetwork: gkeSubnet.id,
});

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND resource.type="gke_cluster"
          AND protoPayload.methodName="google.container.v1.ClusterManager.UpdateCluster"
          AND (protoPayload.request.update.desiredPrivateClusterConfig.enablePrivateEndpoint=false
               OR protoPayload.request.update.desiredMasterAuthorizedNetworksConfig.cidrBlocks.cidrBlock="0.0.0.0/0")

Equivalent controls in other providers: EKS private endpoint, AKS private cluster, OKE private API endpoint.

GKE Autopilot: Workload Identity is mandatory — it cannot be disabled. Service accounts must be configured to use the workload pool. GKE Standard: Set workload_identity_config { workload_pool = "PROJECT_ID.svc.id.goog" } at cluster creation or update; bind Kubernetes ServiceAccounts to GCP IAM ServiceAccounts via roles/iam.workloadIdentityUser. CIS GKE Autopilot Benchmark v1.3.0 documents Autopilot-specific defaults.

Enable Workload Identity Federation for GKE so Kubernetes pods use GCP IAM ServiceAccounts instead of the default Compute Engine service account. The Compute Engine default SA carries broad project-level permissions including Compute viewer and logging writer — using it for pod workloads violates least-privilege. Workload Identity binds a Kubernetes ServiceAccount in a specific namespace to a GCP SA with the minimum necessary IAM roles, and eliminates the need for static SA key files mounted as secrets.

Remediation — Terraform

# Terraform Google provider ~> 6.0
resource "google_container_cluster" "hardened" {
  name     = "hardened-cluster"
  location = var.region

  workload_identity_config {
    workload_pool = "${var.project_id}.svc.id.goog"
  }
}

# Bind a Kubernetes ServiceAccount to a GCP IAM ServiceAccount
resource "google_service_account_iam_binding" "workload_identity" {
  service_account_id = google_service_account.app.name
  role               = "roles/iam.workloadIdentityUser"
  members = [
    "serviceAccount:${var.project_id}.svc.id.goog[${var.namespace}/${var.ksa_name}]"
  ]
}

Remediation — gcloud

# Enable Workload Identity on existing cluster
gcloud container clusters update CLUSTER_NAME \
  --workload-pool=PROJECT_ID.svc.id.goog \
  --region REGION

# Bind K8s ServiceAccount to GCP SA
gcloud iam service-accounts add-iam-policy-binding \
  APP_SA@PROJECT_ID.iam.gserviceaccount.com \
  --role roles/iam.workloadIdentityUser \
  --member "serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]"

# Annotate the Kubernetes ServiceAccount
kubectl annotate serviceaccount KSA_NAME \
  --namespace NAMESPACE \
  iam.gke.io/gcp-service-account=APP_SA@PROJECT_ID.iam.gserviceaccount.com

Remediation — Config Connector

apiVersion: container.cnrm.cloud.google.com/v1beta1
kind: ContainerCluster
metadata:
  name: workload-identity-gke
  namespace: config-control
spec:
  location: us-central1
  initialNodeCount: 1
  workloadIdentityConfig:
    workloadPool: "PROJECT_ID.svc.id.goog"

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND resource.type="gke_cluster"
          AND (protoPayload.methodName="google.container.v1.ClusterManager.UpdateCluster"
               OR protoPayload.methodName="google.container.v1.ClusterManager.UpdateNodePool")
          AND (protoPayload.request.update.desiredWorkloadIdentityConfig.workloadPool=""
               OR protoPayload.request.update.desiredNodePoolAutoConfig.networkTags.tags=~"legacy-metadata")

Equivalent controls in other providers: EKS Pod Identity, AKS Workload Identity, OKE Workload Identity.

GKE Autopilot: Autopilot uses Google-managed encryption for etcd by default. Customer-managed encryption keys (CMEK) via Cloud KMS are supported but require explicit configuration at cluster creation. GKE Standard: Configure database_encryption { state = "ENCRYPTED", key_name = KMS_KEY_RESOURCE_ID } at cluster creation or update. CIS GKE Autopilot Benchmark v1.3.0 documents Autopilot-specific defaults.

Enable application-layer secrets encryption so Kubernetes Secrets stored in etcd are encrypted with a Cloud KMS Customer-Managed Encryption Key (CMEK). This adds an envelope encryption layer on top of Google's default etcd encryption-at-rest, giving the customer control over the key lifecycle — including rotation and revocation. Without CMEK, Google holds the encryption key; with CMEK, the customer can revoke access to the cluster's etcd contents by disabling the key.

Remediation — Terraform

# Terraform Google provider ~> 6.0
resource "google_kms_key_ring" "k8s_keyring" {
  name     = "gke-secrets-keyring"
  location = var.region
}

resource "google_kms_crypto_key" "k8s_secrets" {
  name     = "gke-secrets-key"
  key_ring = google_kms_key_ring.k8s_keyring.id

  rotation_period = "7776000s" # 90 days
}

resource "google_container_cluster" "hardened" {
  name     = "hardened-cluster"
  location = var.region

  database_encryption {
    state    = "ENCRYPTED"
    key_name = google_kms_crypto_key.k8s_secrets.id
  }
}

Remediation — gcloud

gcloud container clusters create CLUSTER_NAME \
  --database-encryption-key=projects/PROJECT_ID/locations/REGION/keyRings/KEYRING/cryptoKeys/KEY_NAME \
  --region REGION

Remediation — Config Connector

apiVersion: container.cnrm.cloud.google.com/v1beta1
kind: ContainerCluster
metadata:
  name: secrets-encrypted-gke
  namespace: config-control
spec:
  location: us-central1
  initialNodeCount: 1
  databaseEncryption:
    state: ENCRYPTED
    keyName: "projects/PROJECT_ID/locations/us-central1/keyRings/gke-kr/cryptoKeys/etcd-key"

Compliance mapping

(logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
           AND resource.type="gke_cluster"
           AND protoPayload.methodName="google.container.v1.ClusterManager.UpdateCluster"
           AND protoPayload.request.update.desiredDatabaseEncryption.state="DECRYPTED")
          OR
          (logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
           AND protoPayload.serviceName="cloudkms.googleapis.com"
           AND protoPayload.methodName=~".*CryptoKey.*"
           AND protoPayload.request.cryptoKey.name=~".*gke-etcd.*")

Equivalent controls in other providers: EKS KMS envelope encryption, AKS KMS etcd encryption, OKE Vault secrets encryption.

GKE Autopilot: Binary Authorization is NOT enforced by default in Autopilot clusters — it must be explicitly configured. Both Autopilot and Standard clusters require the Binary Authorization API to be enabled and an admission policy to be set. GKE Standard: Same configuration required — enable the Binary Authorization API, create an attestor, and set the cluster evaluation mode. CIS GKE Autopilot Benchmark v1.3.0 documents Autopilot-specific defaults.

Enable Binary Authorization with an attestor-required policy so only container images that have been cryptographically verified and attested by a trusted build pipeline can be deployed to the cluster. This is a GKE-unique differentiator — it prevents unsigned, unverified, or tampered images from running regardless of which tag or digest is referenced at deploy time. The default policy (evaluationMode: ALWAYS_ALLOW) provides no protection; change to REQUIRE_ATTESTATION in ENFORCED_BLOCK_AND_AUDIT_LOG mode. Mutable image tags are the silent supply-chain risk: Binary Authorization locks image identity to a cryptographic attestation, not a tag string.

Remediation — Binary Authorization Policy (YAML)

# Binary Authorization policy — attestor-required
# Save as policy.yaml, import with: gcloud container binauthz policy import policy.yaml
admissionWhitelistPatterns: []
defaultAdmissionRule:
  evaluationMode: REQUIRE_ATTESTATION
  enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG
  requireAttestationsBy:
    - projects/MY_PROJECT/attestors/build-attestor
clusterAdmissionRules:
  REGION.CLUSTER_NAME:
    evaluationMode: REQUIRE_ATTESTATION
    enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG
    requireAttestationsBy:
      - projects/MY_PROJECT/attestors/build-attestor

Remediation — Terraform

# Terraform Google provider ~> 6.0
# Note: google_binary_authorization_policy may require hashicorp/google-beta
# at authoring time — verify provider tier at registry.terraform.io/providers/hashicorp/google
resource "google_binary_authorization_attestor" "build_attestor" {
  name = "build-attestor"
  attestation_authority_note {
    note_reference = google_container_note.build_note.name
  }
}

# Enable Binary Authorization enforcement on the cluster
resource "google_container_cluster" "hardened" {
  name     = "hardened-cluster"
  location = var.region

  binary_authorization {
    evaluation_mode = "PROJECT_SINGLETON_POLICY_ENFORCE"
  }
}

Remediation — gcloud

# Import the policy
gcloud container binauthz policy import policy.yaml --project=PROJECT_ID

# Enable enforcement on the cluster
gcloud container clusters update CLUSTER_NAME \
  --binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE \
  --region REGION

Remediation — Config Connector

apiVersion: binaryauthorization.cnrm.cloud.google.com/v1beta1
kind: BinaryAuthorizationPolicy
metadata:
  name: binauthz-policy
  namespace: config-control
spec:
  projectRef:
    external: "projects/PROJECT_ID"
  defaultAdmissionRule:
    evaluationMode: REQUIRE_ATTESTATION
    enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG
    requireAttestationsBy:
    - "projects/PROJECT_ID/attestors/prod-build-attestor"
  globalPolicyEvaluationMode: ENABLE

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.serviceName="binaryauthorization.googleapis.com"
          AND (protoPayload.methodName=~".*UpdatePolicy"
               OR protoPayload.methodName=~".*DeleteAttestor")
          AND (protoPayload.request.policy.defaultAdmissionRule.evaluationMode="ALWAYS_ALLOW"
               OR resource.type="binaryauthorization.googleapis.com/Attestor")

GKE Autopilot: Shielded Nodes are enabled by default and are not individually configurable — Google manages the node boot process. Autopilot nodes run with Secure Boot, vTPM, and integrity monitoring automatically. GKE Standard: Enable Shielded Nodes at the node-pool level with --shielded-secure-boot, --shielded-vtpm, and --shielded-integrity-monitoring. CIS GKE Autopilot Benchmark v1.3.0 documents Autopilot-specific defaults.

Enable Shielded GKE Nodes to protect the node boot process using Secure Boot (prevents loading unsigned kernel modules at boot), vTPM (virtual Trusted Platform Module for cryptographic attestation of the boot sequence), and integrity monitoring (detects changes to the measured boot baseline by comparing boot measurements against known-good values). This prevents rootkit installation at the node level — an attacker who escapes a container cannot silently persist a kernel-level implant across node restarts. This is a GKE-unique hardware-based control with no direct equivalent in EKS or AKS standard configurations.

Remediation — Terraform

# Terraform Google provider ~> 6.0
resource "google_container_node_pool" "hardened_nodes" {
  name       = "hardened-node-pool"
  cluster    = google_container_cluster.hardened.name
  location   = var.region

  node_config {
    shielded_instance_config {
      enable_secure_boot          = true
      enable_integrity_monitoring = true
    }

    # Container-Optimized OS with containerd runtime
    image_type = "COS_CONTAINERD"
  }
}

Remediation — gcloud

gcloud container node-pools create NODE_POOL \
  --cluster=CLUSTER_NAME \
  --shielded-secure-boot \
  --shielded-integrity-monitoring \
  --image-type=COS_CONTAINERD \
  --region REGION

Remediation — Config Connector

apiVersion: container.cnrm.cloud.google.com/v1beta1
kind: ContainerNodePool
metadata:
  name: shielded-pool
  namespace: config-control
spec:
  location: us-central1
  clusterRef:
    name: hardened-gke
  nodeConfig:
    shieldedInstanceConfig:
      enableSecureBoot: true
      enableIntegrityMonitoring: true
    workloadMetadataConfig:
      mode: GKE_METADATA

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND resource.type="gke_node_pool"
          AND (protoPayload.methodName="google.container.v1.ClusterManager.UpdateNodePool"
               OR protoPayload.methodName="google.container.v1.ClusterManager.CreateNodePool")
          AND (protoPayload.request.update.desiredNodePoolAutoConfig.shieldedInstanceConfig.enableSecureBoot=false
               OR protoPayload.request.nodePool.config.shieldedInstanceConfig.enableIntegrityMonitoring=false)

GKE Autopilot: Cloud Audit Log Admin Activity logs are enabled by default in both Autopilot and Standard clusters. Data Access audit logs for container.googleapis.com are OFF by default in BOTH modes and must be explicitly enabled. GKE Standard: Same requirement — enable Data Access logs via the project IAM audit configuration. CIS GKE Autopilot Benchmark v1.3.0 documents Autopilot-specific defaults.

Enable Cloud Audit Logs Data Access for container.googleapis.com in your GCP project IAM audit configuration. Data Access logs — covering ADMIN_READ, DATA_READ, and DATA_WRITE operations — are disabled by default and must be explicitly enabled. Without Data Access logs, API operations such as kubectl exec, kubectl log, pod creation, and secret reads are not logged to Cloud Audit Logs. Admin Activity logs (cluster creation, deletion, RBAC changes) are automatically enabled and cannot be disabled.

Remediation — Terraform

# Terraform Google provider ~> 6.0
resource "google_project_iam_audit_config" "gke_audit" {
  project = var.project_id
  service = "container.googleapis.com"

  audit_log_config {
    log_type = "DATA_READ"
  }
  audit_log_config {
    log_type = "DATA_WRITE"
  }
  audit_log_config {
    log_type = "ADMIN_READ"
  }
}

Remediation — gcloud

# Check current audit configuration
gcloud projects get-iam-policy PROJECT_ID --format=json | jq '.auditConfigs'

# Enable Data Access logs via policy file
# Create audit-policy.json with the auditConfigs block, then:
gcloud projects set-iam-policy PROJECT_ID audit-policy.json

Remediation — Config Connector

apiVersion: logging.cnrm.cloud.google.com/v1beta1
kind: LoggingLogSink
metadata:
  name: gke-audit-sink
  namespace: config-control
spec:
  projectRef:
    external: "projects/PROJECT_ID"
  destination:
    bigQueryDatasetRef:
      external: "projects/PROJECT_ID/datasets/gke_audit"
  filter: 'resource.type="k8s_cluster" AND logName:"cloudaudit.googleapis.com"'

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.serviceName="logging.googleapis.com"
          AND (protoPayload.methodName="google.logging.v2.ConfigServiceV2.UpdateSink"
               OR protoPayload.methodName="google.logging.v2.ConfigServiceV2.DeleteSink")
          AND protoPayload.request.sink.filter=~".*k8s_cluster.*"

Equivalent controls in other providers: EKS control-plane logs, AKS control-plane audit logs, OKE OCI audit logging.

GKE Autopilot: VPC-native networking is enforced by default. Dataplane V2 (Cilium-based) is also the default in Autopilot, making NetworkPolicy enforcement available without additional configuration. GKE Standard: Create the cluster with --enable-dataplane-v2 (or legacy --enable-network-policy for Calico) and --enable-ip-alias for VPC-native networking. NetworkPolicy objects are not enforced without a CNI that supports them. CIS GKE Autopilot Benchmark v1.3.0 documents Autopilot-specific defaults.

Create a VPC-native GKE cluster (alias IP ranges — NOT routes-based legacy networking) and enable GKE Dataplane V2 for NetworkPolicy enforcement via Cilium. Routes-based networking is deprecated and does not support NetworkPolicy. VPC-native enables private IP ranges for pods, reducing the routing blast radius of a compromised pod. Without a NetworkPolicy-capable CNI and explicit deny rules, every pod in the cluster can reach every other pod and the node metadata endpoint on the flat pod network.

Remediation — Terraform

# Terraform Google provider ~> 6.0
resource "google_container_cluster" "hardened" {
  name     = "hardened-cluster"
  location = var.region

  # VPC-native cluster (alias IP ranges — required for NetworkPolicy)
  ip_allocation_policy {}

  # Dataplane V2 enables NetworkPolicy enforcement via Cilium
  datapath_provider = "ADVANCED_DATAPATH"

  private_cluster_config {
    enable_private_nodes    = true
    enable_private_endpoint = true
    master_ipv4_cidr_block  = "172.16.0.0/28"
  }
}

Remediation — gcloud

gcloud container clusters create CLUSTER_NAME \
  --enable-ip-alias \
  --enable-dataplane-v2 \
  --region REGION

# Apply default-deny NetworkPolicy to every namespace
kubectl apply -f default-deny-all.yaml --namespace NAMESPACE

Default-deny NetworkPolicy

# Default-deny NetworkPolicy — apply in every namespace before adding allows
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress

Remediation — Config Connector

apiVersion: container.cnrm.cloud.google.com/v1beta1
kind: ContainerCluster
metadata:
  name: dpv2-gke
  namespace: config-control
spec:
  location: us-central1
  initialNodeCount: 1
  datapathProvider: ADVANCED_DATAPATH
  networkPolicy:
    enabled: true
    provider: PROVIDER_UNSPECIFIED

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND resource.type="gke_cluster"
          AND protoPayload.methodName="google.container.v1.ClusterManager.UpdateCluster"
          AND (protoPayload.request.update.desiredDatapathProvider="LEGACY_DATAPATH"
               OR protoPayload.request.update.desiredNetworkPolicy.enabled=false)

Equivalent controls in other providers: EKS default-deny NetworkPolicy, AKS Azure CNI network policy, OKE Calico network policy.

GKE Autopilot: Autopilot enforces the Baseline Pod Security Standards profile by default on all namespaces — privileged containers, hostNetwork, hostPID, and hostPath mounts are blocked without explicit configuration. GKE Standard: Apply namespace labels to enforce PSS profiles: pod-security.kubernetes.io/enforce: restricted. The Privileged profile should only be permitted in kube-system with documented justification. CIS GKE Autopilot Benchmark v1.3.0 documents Autopilot-specific defaults.

Enforce Pod Security Standards (PSS) via the built-in PodSecurity admission controller (available and stable since Kubernetes 1.23). Use namespace labels to declare the security profile. Target the restricted profile for all application namespaces; baseline as the minimum for legacy workloads that cannot yet be ported to restricted. Avoid the privileged profile outside kube-system. PSS is the successor to the PSP admission controller (removed in Kubernetes 1.25) — use only the PodSecurity namespace label approach for all new and migrated configurations.

Remediation — Namespace PSS labels (YAML)

# Enforce PSS Restricted profile on namespace (gcp/kubernetes.html GKE-08)
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted

Remediation — gcloud / kubectl

# Label namespace to enforce restricted PSS profile
kubectl label namespace NAMESPACE \
  pod-security.kubernetes.io/enforce=restricted \
  pod-security.kubernetes.io/enforce-version=latest

# Verify applied labels
kubectl get namespace NAMESPACE -o jsonpath='{.metadata.labels}'

Remediation — Config Connector

apiVersion: container.cnrm.cloud.google.com/v1beta1
kind: ContainerCluster
metadata:
  name: pss-gke
  namespace: config-control
spec:
  location: us-central1
  initialNodeCount: 1
  podSecurityPolicyConfig:
    enabled: false  # PSP deprecated — enforce PSS via admission controller
  enableShieldedNodes: true

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Fk8s_cluster"
          AND resource.type="k8s_cluster"
          AND (protoPayload.methodName="io.k8s.core.v1.pods.create"
               OR protoPayload.methodName="io.k8s.core.v1.namespaces.patch")
          AND (protoPayload.request.metadata.labels."pod-security.kubernetes.io/enforce"="privileged"
               OR protoPayload.request.spec.containers.securityContext.privileged=true
               OR protoPayload.request.spec.hostNetwork=true)

Equivalent controls in other providers: EKS PSS, AKS Azure Policy add-on, OKE PSS.

GKE Autopilot: Legacy ABAC, kubelet read-only port, and legacy metadata endpoints are all disabled by default in Autopilot. GKE Standard: Explicitly configure --no-enable-legacy-authorization, disable the kubelet read-only port, and use Container-Optimized OS as the node image type. CIS GKE Autopilot Benchmark v1.3.0 documents Autopilot-specific defaults.

This control bundles three node and cluster hardening items that share a common theme — disabling legacy or insecure defaults:

1. Disable legacy ABAC (--enable-legacy-authorization=false) — ABAC was superseded by RBAC in Kubernetes 1.6. Legacy ABAC allows any authenticated user unrestricted access to the API by default. Disable it on any cluster where it may have been enabled for compatibility.
2. Disable kubelet read-only port — kubelet port 10255 is unauthenticated and exposes pod metadata, resource consumption, and running container information without any credential. An attacker with network access to the node can enumerate all workloads and their configurations without authentication.
3. Use Container-Optimized OS (COS) — COS is Google's hardened node operating system with a locked-down kernel, read-only root filesystem, and verified boot process. Use COS instead of Ubuntu or custom images unless a specific compatibility requirement mandates otherwise.

Remediation — Terraform

# Terraform Google provider ~> 6.0
resource "google_container_cluster" "hardened" {
  name     = "hardened-cluster"
  location = var.region

  # Disable legacy ABAC — RBAC is the only authorization mechanism
  enable_legacy_abac = false
}

resource "google_container_node_pool" "hardened_nodes" {
  name    = "hardened-node-pool"
  cluster = google_container_cluster.hardened.name

  node_config {
    # Container-Optimized OS with containerd (COS_CONTAINERD)
    image_type = "COS_CONTAINERD"

    # Shielded instance config (see GKE-05 for full shielded node config)
    shielded_instance_config {
      enable_secure_boot          = true
      enable_integrity_monitoring = true
    }
  }
}

Remediation — gcloud

gcloud container clusters create CLUSTER_NAME \
  --no-enable-legacy-authorization \
  --image-type=COS_CONTAINERD \
  --region REGION

# Verify legacy ABAC is disabled on an existing cluster
gcloud container clusters describe CLUSTER_NAME \
  --region REGION \
  --format="value(legacyAbac.enabled)"

Remediation — Config Connector

apiVersion: container.cnrm.cloud.google.com/v1beta1
kind: ContainerCluster
metadata:
  name: rbac-only-gke
  namespace: config-control
spec:
  location: us-central1
  initialNodeCount: 1
  enableLegacyAbac: false
  masterAuth:
    clientCertificateConfig:
      issueClientCertificate: false

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND resource.type="gke_cluster"
          AND protoPayload.methodName=~".*UpdateCluster.*"
          AND (protoPayload.request.update.desiredLegacyAbac.enabled=true
               OR protoPayload.request.update.desiredEnableKubernetesAlpha=true
               OR protoPayload.request.update.desiredMasterAuth.username!="")

Equivalent controls in other providers: EKS IMDSv2 enforcement, AKS managed cluster identity, OKE IAM least privilege.

GKE Autopilot: gVisor (runsc) is NOT available for standard Autopilot pods — Autopilot's isolation model differs from Standard. GKE Sandbox (which uses gVisor) is a separate Autopilot configuration requiring runtimeClassName: gvisor-autopilot. GKE Standard: Create a node pool with --sandbox-type=gvisor and create a RuntimeClass object with handler: runsc; assign runtimeClassName: gvisor in the pod spec. CIS GKE Autopilot Benchmark v1.3.0 documents Autopilot-specific defaults.

Enable GKE Sandbox (gVisor) to provide an additional isolation layer for untrusted or externally-sourced workloads. gVisor (runsc) intercepts system calls from the container at the user-space level, running a guest kernel in user space that translates syscalls before they reach the host kernel. This significantly reduces the host kernel attack surface for container workloads. MEDIUM severity reflects that gVisor is a defense-in-depth additive layer — it does not replace Pod Security Standards enforcement, network policy, or Workload Identity, but reduces the blast radius of a zero-day container exploit. Not all workloads are compatible with gVisor's system-call subset; test compatibility before enabling in production.

Remediation — RuntimeClass (YAML)

# RuntimeClass for gVisor-isolated workloads (GKE Sandbox)
apiVersion: node.k8s.io/v1
kind: RuntimeClass
metadata:
  name: gvisor
handler: runsc
---
# Apply to a Pod — assigns gVisor as the container runtime
apiVersion: v1
kind: Pod
metadata:
  name: sandboxed-workload
spec:
  runtimeClassName: gvisor
  containers:
    - name: app
      image: gcr.io/MY_PROJECT/my-app:DIGEST

Remediation — Terraform

# Terraform Google provider ~> 6.0
resource "google_container_node_pool" "sandbox_pool" {
  name    = "gvisor-sandbox-pool"
  cluster = google_container_cluster.hardened.name

  node_config {
    sandbox_config {
      sandbox_type = "gvisor"
    }
    image_type = "COS_CONTAINERD"
  }
}

Remediation — gcloud

gcloud container node-pools create SANDBOX_POOL \
  --cluster=CLUSTER_NAME \
  --sandbox-type=gvisor \
  --image-type=COS_CONTAINERD \
  --region REGION

Remediation — Config Connector

apiVersion: container.cnrm.cloud.google.com/v1beta1
kind: ContainerNodePool
metadata:
  name: gvisor-sandbox-pool
  namespace: config-control
spec:
  location: us-central1
  clusterRef:
    name: hardened-gke
  nodeConfig:
    sandboxConfig:
      sandboxType: gvisor
    machineType: e2-standard-4

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND resource.type="gke_node_pool"
          AND protoPayload.methodName="google.container.v1.ClusterManager.UpdateNodePool"
          AND NOT protoPayload.request.update.desiredNodePoolAutoConfig.sandboxConfig.type="gvisor"