Authentication and Authorization

5.8 Authentication and Authorization

5.8.1 Ensure Basic Authentication using static passwords is Disabled (Automated)

Recommended Action

Using Command Line: To update an existing cluster and disable Basic Authentication by removing the static password:

gcloud container clusters update [CLUSTER_NAME] \
  --no-enable-basic-auth

5.8.2 Ensure authentication using Client Certificates is Disabled (Automated)

Recommended Action

Using Command Line: Create a new cluster without a Client Certificate:

gcloud container clusters create [CLUSTER_NAME] \
  --no-issue-client-certificate

5.8.3 Manage Kubernetes RBAC users with Google Groups for GKE (Manual)

Recommended Action

Using Command Line: Follow the G Suite Groups instructions at https://cloud.google.com/kubernetes- engine/docs/how-to/role-based-access-control#google-groups-for-gke.

Then, create a cluster with

gcloud beta container clusters create my-cluster \
  --security-group="gke-security-groups@[yourdomain.com]"

Finally create Roles, ClusterRoles, RoleBindings, and ClusterRoleBindings that reference your G Suite Groups.

5.8.4 Ensure Legacy Authorization (ABAC) is Disabled (Automated)

Recommended Action

Using Command Line: To disable Legacy Authorization for an existing cluster, run the following command:

gcloud container clusters update [CLUSTER_NAME] \
  --zone [COMPUTE_ZONE] \
  --no-enable-legacy-authorization