GKE Platform Security

GKE平台安全

This reference covers platform-level security hardening and cluster configuration for Google Kubernetes Engine (GKE). For workload-level security controls (such as Workload Identity Service Account bindings, SecretProviderClass volume mounts, Network Policies, and Pod Security Standards), refer to the

gke-workload-security

skill.

MCP Tools:

gke:get_cluster

,

k8s:check_k8s_auth

,

k8s:get_k8s_resource

,

k8s:apply_k8s_manifest

,

gke:update_cluster

本参考文档涵盖Google Kubernetes Engine (GKE)的平台级安全强化与集群配置。如需工作负载级安全控制（例如Workload Identity服务账号绑定、SecretProviderClass卷挂载、网络策略和Pod安全标准），请参考

gke-workload-security

技能。

MCP工具：

gke:get_cluster

,

k8s:check_k8s_auth

,

k8s:get_k8s_resource

,

k8s:apply_k8s_manifest

,

gke:update_cluster

Golden Path Security Defaults

黄金路径安全默认配置

Setting	Golden Path Value	Day-0/1	Notes
`workloadIdentityConfig.workloadPool`	`<PROJECT>.svc.id.goog`	Day-0	Workload Identity Federation for cluster pods
`secretManagerConfig.enabled`	`true`	Day-1	Google Secret Manager cluster add-on integration
`secretManagerConfig.rotationConfig`	`enabled: true, rotationInterval: 120s`	Day-1	Automatic secret rotation at the cluster level
`rbacBindingConfig.enableInsecureBindingSystemAuthenticated`	`false`	Day-0	Blocks legacy `system:authenticated` bindings
`rbacBindingConfig.enableInsecureBindingSystemUnauthenticated`	`false`	Day-0	Blocks legacy `system:unauthenticated` bindings
`nodeConfig.shieldedInstanceConfig.enableSecureBoot`	`true`	Day-0	Verifiable boot integrity
`nodeConfig.shieldedInstanceConfig.enableIntegrityMonitoring`	`true`	Day-0	Runtime integrity checks
`nodeConfig.workloadMetadataConfig.mode`	`GKE_METADATA`	Day-0	Blocks legacy metadata API, enforces Workload Identity
Private cluster + Dataplane V2 settings	See the `gke-networking` skill	Day-0	Private nodes, private endpoint enforcement, ADVANCED_DATAPATH

设置项	黄金路径值	实施阶段	说明
`workloadIdentityConfig.workloadPool`	`<PROJECT>.svc.id.goog`	初始部署	为集群Pod提供Workload Identity联邦能力
`secretManagerConfig.enabled`	`true`	运维初期	集成Google Secret Manager集群插件
`secretManagerConfig.rotationConfig`	`enabled: true, rotationInterval: 120s`	运维初期	在集群层面启用密钥自动轮换
`rbacBindingConfig.enableInsecureBindingSystemAuthenticated`	`false`	初始部署	阻止旧版 `system:authenticated` 绑定
`rbacBindingConfig.enableInsecureBindingSystemUnauthenticated`	`false`	初始部署	阻止旧版 `system:unauthenticated` 绑定
`nodeConfig.shieldedInstanceConfig.enableSecureBoot`	`true`	初始部署	可验证的启动完整性
`nodeConfig.shieldedInstanceConfig.enableIntegrityMonitoring`	`true`	初始部署	运行时完整性检查
`nodeConfig.workloadMetadataConfig.mode`	`GKE_METADATA`	初始部署	阻止旧版元数据API，强制使用Workload Identity
私有集群 + Dataplane V2设置	请参考 `gke-networking` 技能	初始部署	私有节点、私有端点强制启用、ADVANCED_DATAPATH

Secret Manager Add-on Enablement

Secret Manager插件启用

The golden path enables Secret Manager at the cluster level with automatic secret rotation.

bash

undefined

黄金路径在集群层面启用Secret Manager并配置密钥自动轮换。

bash

undefined

Verify Secret Manager is enabled on cluster

验证集群上是否已启用Secret Manager

gcloud container clusters describe <CLUSTER_NAME> --region <REGION>
--format="value(secretManagerConfig.enabled)"
--quiet

Enable if not already (Day-1 change)

若未启用则开启（运维初期变更）

gcloud container clusters update <CLUSTER_NAME> --region <REGION>
--enable-secret-manager
--secret-manager-rotation-interval=120s
--quiet


> **Note:** For configuring `SecretProviderClass` manifests and mounting secrets
> as volumes inside application deployments, see the `gke-workload-security`
> skill.

gcloud container clusters update <CLUSTER_NAME> --region <REGION>
--enable-secret-manager
--secret-manager-rotation-interval=120s
--quiet


> **注意：** 如需配置`SecretProviderClass`清单并在应用部署中将密钥挂载为卷，请参考`gke-workload-security`技能。

RBAC Hardening

RBAC权限强化

The golden path disables insecure legacy RBAC bindings that grant broad access to

system:authenticated

and

system:unauthenticated

groups.

bash

undefined

黄金路径会禁用授予

system:authenticated

和

system:unauthenticated

组广泛权限的不安全旧版RBAC绑定。

bash

undefined

Verify insecure bindings are disabled

验证不安全绑定是否已禁用

gcloud container clusters describe <CLUSTER_NAME> --region <REGION>
--format="yaml(rbacBindingConfig)"
--quiet


**Best practices for RBAC:**

-   Use namespace-scoped Roles over cluster-wide ClusterRoles.
-   Bind to specific Groups or ServiceAccounts, never to `system:authenticated`
    or `system:unauthenticated`.
-   Audit permissions via MCP: `k8s:check_k8s_auth(parent="...", verb="list",
    resourceType="pods", namespace="...")` (or `kubectl auth can-i --list
    --as=<user>`).
-   Review bindings via MCP: `k8s:get_k8s_resource(parent="...",
    resourceType="clusterrolebinding")` (or `kubectl get
    clusterrolebindings,rolebindings --all-namespaces`).

> See the `gke-multitenancy` skill for enterprise RBAC planning and
> https://docs.cloud.google.com/kubernetes-engine/docs/best-practices/rbac.md.txt

gcloud container clusters describe <CLUSTER_NAME> --region <REGION>
--format="yaml(rbacBindingConfig)"
--quiet


**RBAC最佳实践：**

-   使用命名空间级别的Role而非集群级别的ClusterRoles。
-   绑定到特定的组或服务账号，切勿绑定到`system:authenticated`或`system:unauthenticated`。
-   通过MCP审计权限：`k8s:check_k8s_auth(parent="...", verb="list",
    resourceType="pods", namespace="...")`（或`kubectl auth can-i --list
    --as=<user>`）。
-   通过MCP查看绑定关系：`k8s:get_k8s_resource(parent="...",
    resourceType="clusterrolebinding")`（或`kubectl get
    clusterrolebindings,rolebindings --all-namespaces`）。

> 如需企业级RBAC规划，请参考`gke-multitenancy`技能，以及https://docs.cloud.google.com/kubernetes-engine/docs/best-practices/rbac.md.txt

Binary Authorization

Not enabled in golden path by default but recommended for enforcing production image provenance across the cluster:

bash

undefined

默认未在黄金路径中启用，但建议在集群范围内强制实施生产镜像来源验证：

bash

undefined

Enable Binary Authorization

启用Binary Authorization

gcloud container clusters update <CLUSTER_NAME> --region <REGION>
--binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE
--quiet

undefined

gcloud container clusters update <CLUSTER_NAME> --region <REGION>
--binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE
--quiet

undefined

Shielded Nodes & GKE Sandbox Enablement

Shielded Nodes与GKE Sandbox启用

Enabling verifiable node boot integrity and kernel isolation features at the cluster level:

bash

undefined

在集群层面启用可验证的节点启动完整性和内核隔离功能：

bash

undefined

Enable Shielded Nodes on an existing cluster

在现有集群上启用Shielded Nodes

gcloud container clusters update <CLUSTER_NAME> --region <REGION>
--enable-shielded-nodes
--quiet

Enable GKE Sandbox (gVisor) runtime on an existing cluster

在现有集群上启用GKE Sandbox (gVisor)运行时

gcloud container clusters update <CLUSTER_NAME> --region <REGION>
--enable-gke-sandbox
--quiet


> **Note:** To run workloads inside the gVisor sandbox, specify
> `runtimeClassName: gvisor` in your Pod specs as detailed in the
> `gke-workload-security` skill.

gcloud container clusters update <CLUSTER_NAME> --region <REGION>
--enable-gke-sandbox
--quiet


> **注意：** 如需在gVisor沙箱中运行工作负载，请在Pod规格中指定`runtimeClassName: gvisor`，详情请参考`gke-workload-security`技能。

Common IAM Roles

常用IAM角色

The five most common predefined IAM roles for GKE platform and cluster access:

Role	Purpose	When to Use
`roles/container.admin`	Full control over	Platform team admins
: : clusters and : managing cluster :
: : Kubernetes : lifecycle :
: : resources : :
`roles/container.clusterAdmin`	Manage clusters but	Cluster operators
: : not project-level : who create/delete :
: : IAM : clusters :
`roles/container.developer`	Deploy workloads	Application
: : (pods, services, : developers deploying :
: : deployments) : to existing clusters :
`roles/container.viewer`	Read-only access to	Monitoring,
: : clusters and : auditing, or :
: : Kubernetes : read-only dashboards :
: : resources : :
`roles/container.clusterViewer`	List and get	CI/CD pipelines that
: : cluster details : need cluster :
: : only : metadata :

Principle of least privilege: Start with
roles/container.viewer
or
roles/container.developer
and escalate only as needed. Avoid granting
roles/container.admin
broadly across teams.

用于GKE平台和集群访问的五种最常见预定义IAM角色：

角色	用途	使用场景
`roles/container.admin`	完全控制集群和Kubernetes资源	平台团队管理员管理集群生命周期
`roles/container.clusterAdmin`	管理集群但无项目级IAM权限	负责创建/删除集群的集群操作员
`roles/container.developer`	部署工作负载（Pod、服务、Deployment）	向现有集群部署应用的开发者
`roles/container.viewer`	对集群和Kubernetes资源的只读访问	监控、审计或只读仪表盘场景
`roles/container.clusterViewer`	仅查看集群详情	需要集群元数据的CI/CD流水线

最小权限原则：从
roles/container.viewer
或
roles/container.developer
开始，仅在必要时提升权限。避免广泛授予
roles/container.admin
权限给多个团队。

Service Accounts & Agents

服务账号与代理

GKE Service Agent (
```
service-<PROJECT_NUMBER>@container-engine-robot.iam.gserviceaccount.com
```
): Automatically created. Manages nodes, networking, and cluster operations on your behalf. Do not remove or modify its permissions.
Node Service Account: By default, nodes use the Compute Engine default service account. For production platforms, create a dedicated Google Service Account with minimal required permissions (
```
roles/monitoring.metricWriter
```
,
```
roles/logging.logWriter
```
) and assign it at node pool creation time.
Workload Identity: For binding Google Service Accounts to Kubernetes Service Accounts (
```
roles/iam.workloadIdentityUser
```
), refer to the
```
gke-workload-security
```
skill.

GKE服务代理 (
```
service-<PROJECT_NUMBER>@container-engine-robot.iam.gserviceaccount.com
```
): 自动创建。代表您管理节点、网络和集群操作。请勿移除或修改其权限。
节点服务账号：默认情况下，节点使用Compute Engine默认服务账号。对于生产平台，请创建一个具有最小必要权限（
```
roles/monitoring.metricWriter
```
,
```
roles/logging.logWriter
```
）的专用Google服务账号，并在节点池创建时分配给它。
Workload Identity：如需将Google服务账号绑定到Kubernetes服务账号（
```
roles/iam.workloadIdentityUser
```
），请参考
```
gke-workload-security
```
技能。

Cross-Service Authentication Patterns

跨服务认证模式

Common project-level IAM policy binding patterns for granting backend Google Service Accounts (GSAs) access to external Google Cloud services before linking via Workload Identity:

bash

undefined

在通过Workload Identity关联之前，授予后端Google服务账号（GSA）访问外部Google Cloud服务的常见项目级IAM策略绑定模式：

bash

undefined

Grant a GSA access to Cloud Storage objects

授予GSA访问Cloud Storage对象的权限

gcloud projects add-iam-policy-binding <PROJECT_ID>
--member "serviceAccount:<GSA_NAME>@<PROJECT_ID>.iam.gserviceaccount.com"
--role "roles/storage.objectViewer"
--quiet

Grant a GSA access to Cloud SQL databases

授予GSA访问Cloud SQL数据库的权限

gcloud projects add-iam-policy-binding <PROJECT_ID>
--member "serviceAccount:<GSA_NAME>@<PROJECT_ID>.iam.gserviceaccount.com"
--role "roles/cloudsql.client"
--quiet

Grant a GSA access to Pub/Sub subscriptions

授予GSA访问Pub/Sub订阅的权限

gcloud projects add-iam-policy-binding <PROJECT_ID>
--member "serviceAccount:<GSA_NAME>@<PROJECT_ID>.iam.gserviceaccount.com"
--role "roles/pubsub.subscriber"
--quiet

undefined

Resources

参考资源

undefined

gke-platform-security

Original

Translation

GKE Platform Security

GKE平台安全

Golden Path Security Defaults

黄金路径安全默认配置

Secret Manager Add-on Enablement

Secret Manager插件启用

Verify Secret Manager is enabled on cluster

验证集群上是否已启用Secret Manager

Enable if not already (Day-1 change)

若未启用则开启（运维初期变更）

RBAC Hardening

RBAC权限强化

Verify insecure bindings are disabled

验证不安全绑定是否已禁用

Binary Authorization

Binary Authorization

Enable Binary Authorization

启用Binary Authorization

Shielded Nodes & GKE Sandbox Enablement

Shielded Nodes与GKE Sandbox启用

Enable Shielded Nodes on an existing cluster

在现有集群上启用Shielded Nodes

Enable GKE Sandbox (gVisor) runtime on an existing cluster

在现有集群上启用GKE Sandbox (gVisor)运行时

Common IAM Roles

常用IAM角色

Service Accounts & Agents

服务账号与代理

Cross-Service Authentication Patterns

跨服务认证模式

Grant a GSA access to Cloud Storage objects

授予GSA访问Cloud Storage对象的权限

Grant a GSA access to Cloud SQL databases

授予GSA访问Cloud SQL数据库的权限

Grant a GSA access to Pub/Sub subscriptions

授予GSA访问Pub/Sub订阅的权限

Resources

参考资源