Checks

Automatic repair will monitor nodes and attempt repair when a node fails multiple subsequent health checks

It is recommended to use Service Accounts and OAuth as authentication methods for accessing the master in the container cluster.

Basic authentication should be disabled by explicitly unsetting the <code>username</code> and <code>password</code> on the <code>master_auth</code> block.

Keys should be rotated on a regular basis to limit exposure if a given key should become compromised.

Using unmanaged keys makes rotation and general management difficult.

Secure boot helps ensure that the system only runs authentic software.

In GitHub Actions, one can authenticate to Google Cloud by setting values for workload_identity_provider and service_account and requesting a short-lived OIDC token which is then used to execute commands as that Service Account. If you don't specify a condition in the workload identity provider pool configuration, then any GitHub Action can assume this role and act as that Service Account.

Service accounts and user accounts used in IAM bindings should follow organization email policies (e.g., no personal emails).

Firewall rules should restrict RDP (TCP/3389) access to specific IP ranges. Open RDP access can be a security risk.

Firewall rules should restrict SSH (TCP/22) access to specific IPs. Open SSH can be a security risk.

Firewall rules should not be wide open to all ports. Lock down rules to only required ports.

Ensures that Google Cloud's default firewall rules are disabled, as they may be overly permissive and pose security risks. The default network comes with pre-populated firewall rules that allow broad access and should be replaced with more restrictive custom rules.

Firewall rules allowing broad port ranges can be risky. Ensure rules are as specific as possible.

Private Google Access allows instances in a subnet to reach Google APIs and services via internal IP, which should be enabled for private networks.

Flow logs for subnets should be enabled to capture network traffic details for security analysis.

Cloud Storage bucket access logs should be enabled for audit purposes.

Object versioning in Cloud Storage is recommended to protect against accidental or malicious deletions.

IAM Audit Logging should be configured for all services and the appropriate log types to track changes and accesses.

GitHub repository should be set to be private.

You can do this by either setting <code>private</code> attribute to 'true' or <code>visibility</code> attribute to 'internal' or 'private'.

For the purposes of security, the contents of the plaintext_value field have been marked as sensitive to Terraform, but this does not hide it from state files. State should be treated as sensitive always.

GitHub repository should be set to use vulnerability alerts.

You can do this by setting the <code>vulnerability_alerts</code> attribute to 'true'.

GitHub branch protection should be set to require signed commits.

You can do this by setting the <code>require_signed_commits</code> attribute to 'true'.

Disable anonymous requests to the API server.

Do not use token based authentication.

This admission controller rejects all net-new usage of the Service field externalIPs.