GCP Terraform Misconfiguration: GKE Cluster Publicly Accessible

A Terraform configuration makes a GKE Cluster accessible through the public internet.

Failure to block unwanted network traffic expands a cloud service's attack surface. Services open to interaction with the public are subjected to almost continuous scanning and probing by malicious entities.

Private GKE nodes do not have external IP addresses. Pods that run on these nodes cannot communicate beyond the cluster perimeter. Disabling a public endpoint protects the GKE cluster by limiting its management to internal private IP addresses. Failure to enforce a private endpoint and private nodes exposes the cluster to the public.

Example 1: The following Terraform configuration permits any public IP address to access cluster nodes and the control plane because enable_private_nodes and enable_private_endpoint are set to false.

resource "google_container_cluster" "cluster-demo" {
...
  private_cluster_config {
    enable_private_endpoint = false
    enable_private_nodes = false
  }
...
}