Google CloudOverview
In GKE, legacy authorization predates Kubernetes RBAC and grants broad static permissions that are hard to reason about. Modern GKE clusters should rely on RBAC and keep legacy authorization disabled.
Rationale
Kubernetes authorization is additive: if any enabled authorizer allows a request, the request succeeds. Leaving legacy authorization enabled can bypass the tighter permissions you intended to enforce with RBAC. For a cloud ops team, the practical rule is simple: use RBAC for cluster permissions and do not keep older authorization modes enabled unless you are explicitly maintaining a legacy cluster with a documented exception.
Remediation guidance
Using Google Cloud Console
- Open
Kubernetes Enginein Google Cloud Console. - Select the affected cluster.
- Open the security or access configuration for the cluster.
- If the cluster still exposes a
Legacy authorizationoption, set it toDisabledand save the change.
Using Command Line
For older GKE clusters where the setting is still supported, disable legacy authorization:
gcloud container clusters update [CLUSTER_NAME] --location [LOCATION] --no-enable-legacy-authorization
Validate the result:
gcloud container clusters describe [CLUSTER_NAME] --location [LOCATION]
Confirm that legacy authorization is disabled and that your RBAC roles and bindings still allow the expected administrative and workload actions.
Impact
If administrators or workloads still depend on legacy authorization or ABAC-era permissions, they can lose access after this change. Review RoleBinding and ClusterRoleBinding objects before rollout.
Notes
This control is mainly relevant for older clusters. In modern GKE versions, legacy authorization should already be disabled or no longer be part of normal cluster configuration.
References
- https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control
Service-wide remediation
Recommended when many resources are affected: standardize on RBAC-only cluster templates and treat any cluster that still relies on legacy authorization as an exception that must be migrated or retired.
Use GKE cluster templates, Terraform modules, and platform guardrails that always create clusters with RBAC and without older authorization modes.
Operational rollout
- Identify legacy clusters first and confirm whether any workloads or operators still rely on older authorization behavior.
- Fix RBAC roles and bindings before disabling legacy authorization.
- Re-scan after the change and document any approved exceptions with an owner and an expiry date.
Query logic
These are the stored checks tied to this control.
Legacy Authorization is set to Disabled on Kubernetes Engine Clusters
Connectors
Covered asset types
Expected check: eq []
gkeClusters(where:{legacyAbacEnabled_NOT:false}){...AssetFragment}
