Ensure Use Of VPC-Native Clusters

More Info:

Create Alias IPs for the node network CIDR range in order to subsequently configure IPbased policies and firewalling for pods. A cluster that uses Alias IPs is called a VPC-native cluster

Risk Level

Medium

Address

Operational Excellence, Performance Efficiency, Reliability, Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CIS GKE
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration of not using VPC-Native Clusters in GCP, you can follow the below steps using the GCP console:

1. Open the GCP console and navigate to the Kubernetes Engine page.

2. Select your cluster that you want to make VPC-native.

3. Click on the “Edit” button at the top of the page.

4. Scroll down to the “Networking” section and click on “Enable VPC-native (using alias IP)”.

5. Select the VPC network that you want to use for your cluster.

6. Select the subnet that you want to use for your cluster.

7. Click on the “Save” button at the bottom of the page to apply the changes.

8. Verify that the VPC-native configuration is applied by checking the “Networking” section of your cluster details page.

By following these steps, you will be able to remediate the misconfiguration of not using VPC-Native Clusters in GCP and ensure that your cluster is using VPC-native networking.

Using CLI

To remediate the misconfiguration “Ensure Use Of VPC-Native Clusters” for GCP using GCP CLI, follow the below steps:

1. Open the GCP Cloud Shell.

2. Run the following command to enable VPC-native clusters for the default network:

gcloud container clusters update [CLUSTER_NAME] --zone [ZONE] --enable-ip-alias

Replace [CLUSTER_NAME] with the name of the cluster that you want to update and [ZONE] with the zone in which the cluster is located.

3. Run the following command to verify that the VPC-native clusters are enabled:

gcloud container clusters describe [CLUSTER_NAME] --zone [ZONE] | grep -i ipallocationpolicy

This command will display the IP allocation policy for the cluster. If the IP allocation policy is “Use IP aliases”, then VPC-native clusters are enabled.

4. Repeat the above steps for all the GCP clusters in your environment.

By following the above steps, you can ensure the use of VPC-native clusters in GCP using GCP CLI.

Using Python

To remediate the misconfiguration “Ensure Use Of VPC-Native Clusters” for GCP using Python, you can follow the below steps:

1. Install the necessary Python libraries:

pip install google-auth google-auth-oauthlib google-auth-httplib2 google-cloud-container google-cloud-storage

2. Authenticate with GCP using a service account:

from google.oauth2 import service_account

credentials = service_account.Credentials.from_service_account_file('path/to/service_account.json')

3. Import the necessary libraries:

from google.cloud import container_v1
from google.cloud.container_v1.types import Cluster

client = container_v1.ClusterManagerClient(credentials=credentials)

4. Get the list of existing clusters in the project:

project_id = 'your-project-id'
zone = 'your-zone'

cluster_list = client.list_clusters(project_id, zone)

5. Check if each cluster is VPC-native or not:

for cluster in cluster_list.clusters:
    if not cluster.ip_allocation_policy.use_ip_aliases:
        # Update the cluster to use VPC-native
        cluster.ip_allocation_policy.use_ip_aliases = True
        update_request = Cluster(name=cluster.name, ip_allocation_policy=cluster.ip_allocation_policy)
        operation = client.update_cluster(project_id, zone, update_request)
        operation.result()

6. After running the script, all the clusters that are not VPC-native would be updated to use VPC-native.

Note: Make sure to replace ‘your-project-id’ and ‘your-zone’ with the actual project ID and zone where your GKE clusters are located. Also, make sure to have the necessary permissions to update the clusters.

Using Terraform

resource "google_container_cluster" "GKE_CLUSTER" {
  name     = "GKE_CLUSTER_NAME"          # <-- replace with your cluster name
  location = "GCP_REGION_OR_ZONE"        # <-- e.g. "us-central1" (regional) or "us-central1-a" (zonal)

  network    = "projects/PROJECT_ID/global/networks/VPC_NAME"              # <-- replace
  subnetwork = "projects/PROJECT_ID/regions/REGION/subnetworks/SUBNET_NAME" # <-- replace

  # This enables a VPC-native (Alias IP) cluster
  networking_mode = "VPC_NATIVE"

  ip_allocation_policy {
    # EITHER reference existing secondary ranges on the subnetwork:
    cluster_secondary_range_name  = "PODS_SECONDARY_RANGE_NAME"     # <-- replace with pods secondary range name
    services_secondary_range_name = "SERVICES_SECONDARY_RANGE_NAME" # <-- replace with services secondary range name

    # OR, if you want GKE to create ranges automatically instead, comment the above
    # two lines and use explicit CIDR blocks like:
    # cluster_ipv4_cidr_block  = "10.20.0.0/14"
    # services_ipv4_cidr_block = "10.24.0.0/20"
  }

  # ...other cluster settings...
}

Enabling networking_mode = "VPC_NATIVE" and ip_allocation_policy on an existing routes-based (non–VPC-native) cluster forces replacement of the cluster; plan for downtime and stateful workloads accordingly, as there is no in-place conversion.

Verification: terraform plan should show networking_mode changing to VPC_NATIVE (if it was ROUTES before) and an ip_allocation_policy block being added, and for an existing routes-based cluster it will show the cluster resource being destroyed and recreated.

Additional Reading:

• https://cloud.google.com/kubernetes-engine/docs/how-to/alias-ips