Google CloudOverview
Basic authentication uses a static username and password to access the Kubernetes API server. In GKE this method is deprecated and has been removed in newer versions, because static credentials are harder to rotate, audit, and protect than IAM-based access.
Rationale
If a cluster still exposes basic authentication, an attacker only needs those static credentials to attempt access. Modern GKE administration should use IAM and short-lived credentials instead of long-lived usernames and passwords.
Remediation guidance
Using Command Line
For older clusters where basic authentication still exists, disable it:
gcloud container clusters update [CLUSTER_NAME] --location [LOCATION] --no-enable-basic-auth
Validate that static basic-auth credentials are no longer configured:
gcloud container clusters describe [CLUSTER_NAME] --location [LOCATION] --format='yaml(masterAuth)'
Better platform fix
Prefer the DNS-based control plane endpoint with IAM-based access for administrators. This removes the operational need for static Kubernetes API credentials.
Impact
Any automation or administrators still using static username/password credentials will stop working. Migrate them to IAM-backed access before the change.
Notes
Google documents basic authentication as deprecated and removed in GKE 1.19 and later. If this control still fires, treat it as a legacy cluster hygiene issue that should be remediated quickly.
References
- https://cloud.google.com/kubernetes-engine/docs/how-to/api-server-authentication
Service-wide remediation
Recommended when many resources are affected: remove static API credentials from the cluster operating model entirely and standardize on IAM-backed administration.
Update cluster templates and administrator runbooks so new clusters never rely on basic authentication.
Operational rollout
- Identify every user or script that still uses static cluster credentials.
- Migrate those paths to IAM-backed access.
- Disable basic authentication and re-scan the environment.
Query logic
These are the stored checks tied to this control.
Basic Authentication is disabled on Kubernetes Engine Clusters
Connectors
Covered asset types
Expected check: eq []
{gkeClusters(where:{OR:[{masterAuthUsername_NOT:"" masterAuthPassword_NOT:""}]}){...AssetFragment}}
