Link Search Menu Expand Document

Legacy client authentication methods utilized.

Explanation

It is recommended to use Serivce Accounts and OAuth as authentication methods for accessing the master in the container cluster.

Basic authentication should be disabled by explicitly unsetting the username and password on the master_auth block.

Insecure Example

The following example will fail the GCP008 check.

resource "google_container_cluster" "gke" {
}

resource "google_container_cluster" "gke" {
	master_auth {
	    username = ""
	    password = ""
		client_certificate_config {
			issue_client_certificate = true
	    }
	}
}

Secure Example

The following example will pass the GCP008 check.

resource "google_container_cluster" "gke" {
	master_auth {
	    username = ""
	    password = ""
	}
}