GKE Hardening

IT 运维与安全

生成符合CIS基准的Google Kubernetes Engine集群安全加固配置。

安全扫描配置生成

380

下载量

安装量

收藏量

★ 5.0

综合评分ⓘ

概述

更多信息

Overview#

The GKE Security Hardening Tool is a specialized security configuration generator designed to help DevOps engineers and security teams harden Google Kubernetes Engine (GKE) clusters according to Center for Internet Security (CIS) Benchmark standards. The tool automates the creation of security-focused configuration files, reducing manual setup time and ensuring compliance with industry-recognized security standards.

This tool is ideal for organizations deploying GKE in regulated environments, security-conscious teams implementing defense-in-depth strategies, and DevOps teams seeking to automate cluster hardening workflows. By leveraging the CIS Benchmarks, the tool ensures that generated configurations align with proven security practices and reduce the attack surface of Kubernetes deployments.

Key capabilities include generating hardened configuration files based on selected security options, retrieving all available hardening parameters, and tracking requests through session and user identifiers for audit and compliance purposes.

Usage#

Example Request#

Generate a hardened GKE configuration with specific security options:

json

{
  "hardeningOptions": {
    "networkPolicy": ["enabled", "restrictive"],
    "rbac": ["enabled"],
    "podSecurityPolicy": ["enabled", "restricted"],
    "auditLogging": ["enabled", "verbose"],
    "encryptionAtRest": ["enabled"]
  },
  "sessionId": "sess_abc123def456",
  "userId": 12345,
  "timestamp": "2024-01-15T10:30:00Z"
}

Example Response#

json

{
  "configFiles": [
    {
      "filename": "network-policy.yaml",
      "content": "apiVersion: networking.k8s.io/v1\nkind: NetworkPolicy\nmetadata:\n  name: default-deny\nspec:\n  podSelector: {}\n  policyTypes:\n  - Ingress\n  - Egress"
    },
    {
      "filename": "rbac-config.yaml",
      "content": "apiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n  name: minimal-access\nrules:\n- apiGroups: [\"\"]\n  resources: [\"pods\"]\n  verbs: [\"get\", \"list\"]"
    },
    {
      "filename": "pod-security-policy.yaml",
      "content": "apiVersion: policy/v1beta1\nkind: PodSecurityPolicy\nmetadata:\n  name: restricted\nspec:\n  privileged: false\n  allowPrivilegeEscalation: false\n  requiredDropCapabilities:\n  - ALL"
    }
  ],
  "sessionId": "sess_abc123def456",
  "generatedAt": "2024-01-15T10:30:05Z",
  "status": "success"
}

Endpoints#

GET /#

Description: Health check endpoint for service availability verification.

Parameters: None

Response: Returns JSON object confirming service status.

POST /api/gke/hardening/generate#

Description: Generates GKE security hardening configuration files based on provided hardening options.

Parameters:

NameTypeRequiredDescriptionhardeningOptionsobjectYesDictionary mapping hardening feature names to arrays of configuration values (e.g., {"networkPolicy": ["enabled", "restrictive"]})sessionIdstringYesUnique session identifier for tracking and audit purposesuserIdinteger or nullNoUser identifier for audit logging and usage attributiontimestampstringYesISO 8601 formatted timestamp of the request

Response: Returns JSON object containing:

configFiles: Array of objects with filename and content properties containing generated YAML configurations
sessionId: Echo of the request session identifier
generatedAt: Timestamp of configuration generation
status: "success" or error status