Google CloudOverview
Authorized networks restrict which source IP ranges can reach a GKE control plane when the cluster uses IP-based endpoints. This adds an important network layer around the Kubernetes API and reduces exposure if administrator credentials are exposed.
Rationale
Google now recommends using the DNS-based control plane endpoint with IAM-based access where possible. If your cluster still uses IP-based control plane endpoints, you should enable authorized networks and allow only trusted corporate ranges, bastion ranges, VPN ranges, or other approved administration networks.
Remediation guidance
Using Google Cloud Console
- Open
Kubernetes Enginein Google Cloud Console. - Select the affected cluster.
- Open
Networking. - In the
Control Plane AccessorAuthorized networkssection, enable authorized networks. - Add only the CIDR ranges that should be allowed to reach the control plane.
- Save the change.
Using Command Line
Enable authorized networks and specify the approved source ranges:
gcloud container clusters update [CLUSTER_NAME] --location [LOCATION] --enable-master-authorized-networks --master-authorized-networks 203.0.113.0/24,198.51.100.10/32
Validate the configuration:
gcloud container clusters describe [CLUSTER_NAME] --location [LOCATION] --format='yaml(controlPlaneEndpointsConfig,masterAuthorizedNetworksConfig,privateClusterConfig)'
Better platform fix
If you do not need IP-based access at all, prefer migrating cluster administration to the DNS-based control plane endpoint with IAM and, where required, VPC Service Controls. If you keep IP-based endpoints, authorized networks should be treated as mandatory.
Impact
Administrators connecting from home networks, dynamic public IPs, or unapproved jump hosts can lose access after the change. Confirm your approved admin paths before rollout.
References
- https://cloud.google.com/kubernetes-engine/docs/concepts/network-isolation
- https://cloud.google.com/kubernetes-engine/docs/how-to/latest/network-isolation
Service-wide remediation
Recommended when many resources are affected: fix the control-plane access model once in the platform baseline instead of maintaining per-cluster IP allowlists by hand.
Standardize cluster creation modules so every cluster either uses the DNS-based endpoint with IAM controls or enables authorized networks by default for IP-based access.
Operational rollout
- Inventory the current administrator source IP ranges and bastion paths first.
- Apply authorized networks to non-production clusters before production clusters.
- Re-scan after rollout and track any temporary broad ranges as exceptions with an expiry date.
Query logic
These are the stored checks tied to this control.
Master authorized networks is set to Enabled on Kubernetes Engine Clusters
Connectors
Covered asset types
Expected check: eq []
gkeClusters(where:{masterAuthorizedNetworksConfigEnabled_NOT:true}){...AssetFragment}
