Google CloudOverview
Dashboard is a web-based Kubernetes user interface. You can use Dashboard to deploy containerized applications to a Kubernetes cluster, troubleshoot your containerized application, and manage the cluster itself along with its attendant resources. You can use Dashboard to get an overview of applications running on your cluster, as well as for creating or modifying individual Kubernetes resources (such as Deployments, Jobs, DaemonSets, etc). For example, you can scale a Deployment, initiate a rolling update, restart a pod or deploy new applications using a deploy wizard.
Rationale
You should disable the Kubernetes Web UI (Dashboard) when running on Kubernetes Engine. The Kubernetes Web UI (Dashboard) is backed by a highly privileged Kubernetes Service Account.
Remediation guidance
From Console
- Go to
Kubernetes Engine. - Go to
Kubernetes clusters. - For every
Kubernetes clusterclick on edit. - Click on
Add-ons. - Select Disabled from dropdown of
Kubernetes dashboard.
Using Command line
To disable the Kubernetes Web UI:
gcloud container clusters update \[CLUSTER_NAME\] --update-addons=KubernetesDashboard=DISABLED --zone \[ZONE\]
Default Value
The Kubernetes web UI (Dashboard) does not have admin access by default in Kubernetes Engine 1.7 and higher. The Kubernetes web UI is disabled by default in Kubernetes Engine 1.10 and higher.
References
- https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
Google Cloud
Use organization or folder policies where available, shared project templates, logs and alerting baselines, and IaC modules so new resources inherit the secure setting.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
Kubernetes web UI / Dashboard is disabled
Connectors
Covered asset types
Expected check: eq []
gkeClusters(where:{kubernetesDashboardDisabled:false}){...AssetFragment}
