Node Metadata Security

Node metadata value disables metadata concealment.

If the workload_metadata_config block within node_config is included, the node_metadata attribute should be configured securely.

The attribute should be set to SECURE to use metadata concealment, or GKE_METADATA_SERVER if workload identity is enabled. This ensures that the VM metadata is not unnecessarily exposed to pods.

Impact

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

resource "google_container_cluster" "primary" {
  name     = "my-gke-cluster"
  location = "us-central1"

  remove_default_node_pool = true
  initial_node_count       = 1
}

resource "google_container_node_pool" "good_example" {
  cluster = google_container_cluster.primary.id
  node_config {
    workload_metadata_config {
      node_metadata = "SECURE"
    }
  }
}

Links

• https://cloud.google.com/kubernetes-engine/docs/how-to/protecting-cluster-metadata#create-concealed