Other Cluster Configurations

6.10 Other Cluster Configurations

6.10.1 Ensure Kubernetes Web UI is Disabled (Scored)

Recommended Action

Using Command Line: To disable the Kubernetes Dashboard on an existing cluster, run the following command:

gcloud container clusters update [CLUSTER_NAME] \
  --zone [ZONE] \
  --update-addons=KubernetesDashboard=DISABLED

6.10.2 Ensure that Alpha clusters are not used for production workloads (Scored)

Recommended Action

Using Command Line: Upon creating a new cluster

gcloud container clusters create [CLUSTER_NAME] \
  --zone [COMPUTE_ZONE]

Do not use the –enable-kubernetes-alpha argument.

6.10.3 Ensure Pod Security Policy is Enabled and set as appropriate (Not Scored)

Recommended Action

Using Command Line: To enable Pod Security Policy for an existing cluster, run the following command:

gcloud beta container clusters update [CLUSTER_NAME] \
  --zone [COMPUTE_ZONE] \
  --enable-pod-security-policy

6.10.4 Consider GKE Sandbox for running untrusted workloads (Not Scored)

Recommended Action

Using Command Line: To enable GKE Sandbox on an existing cluster, a new Node pool must be created.

gcloud container node-pools create [NODE_POOL_NAME] \
  --zone=[COMPUTE-ZONE] \
  --cluster=[CLUSTER_NAME] \
  --image-type=cos_containerd \
  --sandbox type=gvisor

6.10.5 Ensure use of Binary Authorization (Scored)

Recommended Action

Using Command Line: Firstly, update the cluster to enable Binary Authorization:

gcloud container cluster update [CLUSTER_NAME] \
  --zone [COMPUTE-ZONE] \
  --enable-binauthz

Create a Binary Authorization Policy using the Binary Authorization Policy Reference (https://cloud.google.com/binary-authorization/docs/policy-yaml-reference) for guidance.

Import the policy file into Binary Authorization:

gcloud container binauthz policy import [YAML_POLICY]

6.10.6 Enable Cloud Security Command Center (Cloud SCC) (Not Scored)

Recommended Action

Using Command Line: Follow the instructions at https://cloud.google.com/security-command- center/docs/quickstart-scc-setup.