-
Notifications
You must be signed in to change notification settings - Fork 1.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Restrict node access to cluster metadata service #166
Restrict node access to cluster metadata service #166
Conversation
2e6f313
to
f456604
Compare
@morgante @aaron-lane would you be able to review the above change? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the contribution. Instead of directly editing the files, can you update the autogen templates (https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/blob/master/autogen/cluster_regional.tf#L104) and then generate the modules from it?
Yeah, I can update that shortly. |
f456604
to
d3034dc
Compare
d3034dc
to
0d27c2a
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the contribution! Looks like workload_metadata_config is only available in beta so we will have to wait for the beta submodules with #124.
@dmyerscough #124 has been merged. There are now submodules specifically for public and private clusters with beta features enabled, and templating logic to support that. Are you available to update this branch accordingly? |
Superseded by #203. |
I was recently had my private GKE cluster pen test and one of the issues that were reported by this test was POD's had access the metadata service which exposes sensitive data:-
By default, GKE clusters expose "UNSPECIFIED". However, you can switch this off by setting
node_metadata
to "SECURE".This PR will allow the clusters to move along as normal but will give anyone the ability to shut off metadata service by specifying "SECURE" instead of the default "UNSPECIFIED".
I have tested this on our internal zonal cluster and it worked as expected.