Skip to main content

lacework-global-778

Enable Customer-Managed Encryption Keys (CMEK) for Google Kubernetes Engine (GKE) Persistent Disks (PD) (Automated)​

Description​

Use Customer-Managed Encryption Keys (CMEK) to encrypt node boot and dynamically provisioned attached Google Compute Engine Persistent Disks (PDs) using keys managed within Cloud Key Management Service (KMS).

Remediation​

Note: Lacework does not support Autopilot mode clusters, so the remediation only considers the standard mode cluster option.

It is not possible to remediate this by updating an existing cluster. You must either recreate the node pool or create a new cluster.

Using Google Cloud Console:

For node boot disks:

To create a new node pool:

  1. Go to Kubernetes Engine by visiting: https://console.cloud.google.com/kubernetes/list.
  2. Select Kubernetes clusters with node boot disk CMEK disabled.
  3. Click Add Node Pool.
  4. In the Nodes section, under machine configuration, ensure Boot disk type is Standard persistent disk or Solid-State Drive (SSD) persistent disk.
  5. Select Enable customer-managed encryption for Boot Disk and select the Cloud KMS encryption key to use.
  6. Click CREATE.

To create a new cluster:

  1. Go to Kubernetes Engine by visiting: https://console.cloud.google.com/kubernetes/list.
  2. Click CREATE and click CONFIGURE under Standard mode cluster.
  3. Under Node Pools, expand the default-pool list and click Nodes.
  4. In the Configure node settings pane, select Standard persistent disk or SSD Persistent Disk as the Boot disk type.
  5. Select Enable customer-managed encryption for Boot Disk checkbox and choose the Cloud KMS encryption key to use.
  6. Configure the rest of the cluster settings as required.
  7. Click CREATE.

For attached disks:

This is not possible using Google Cloud Console.

Using Command Line:

For node boot disks:

Create a new node pool using customer-managed encryption keys for the node boot disk, of <disk_type> either pd-standard or pd-ssd:

gcloud container node-pools create <cluster_name> --disk-type <disk_type> --boot-disk-kms-key projects/<key_project_id>/locations/<location>/keyRings/<ring_name>/cryptoKeys/<key_name>

Create a cluster using customer-managed encryption keys for the node boot disk, of <disk_type> either pd-standard or pd-ssd:

gcloud container clusters create <cluster_name> --disk-type <disk_type> --boot-disk-kms-key projects/<key_project_id>/locations/<location>/keyRings/<ring_name>/cryptoKeys/<key_name>

For attached disks:

Follow the instructions detailed at: https://cloud.google.com/kubernetes-engine/docs/how-to/using-cmek.

References​

https://cloud.google.com/kubernetes-engine/docs/how-to/using-cmek
https://cloud.google.com/compute/docs/disks/customer-managed-encryption
https://cloud.google.com/security/encryption-at-rest/default-encryption
https://cloud.google.com/kubernetes-engine/docs/concepts/persistent-volumes
https://cloud.google.com/sdk/gcloud/reference/container/node-pools/create

Last updated on