GCP Terraform Misconfiguration: GKE Cluster HTTP Basic Authentication

A Terraform configuration enables HTTP Basic Authentication on a GKE cluster.

A Kubernetes API server, the central management entity of a cluster, accepts HTTP basic authentication to authenticate users. HTTP Basic Authentication is deprecated and susceptible to brute force attacks and exposes user credentials to attackers in a misconfigured environment.

Example 1: The following example shows a Terraform configuration that enables HTTP basic authentication on a GKE cluster by setting username and password to non-empty values in the master_auth block.

resource "google_container_cluster" "container_cluster_demo" {
...
  master_auth {
    username = "foo"
    password = "bar"
  }
...
}