Legacy client authentication methods utilized.
Explanation
It is recommended to use Serivce Accounts and OAuth as authentication methods for accessing the master in the container cluster.
Basic authentication should be disabled by explicitly unsetting the username
and password
on the master_auth
block.
Insecure Example
The following example will fail the GCP008 check.
resource "google_container_cluster" "gke" {
}
resource "google_container_cluster" "gke" {
master_auth {
username = ""
password = ""
client_certificate_config {
issue_client_certificate = true
}
}
}
Secure Example
The following example will pass the GCP008 check.
resource "google_container_cluster" "gke" {
master_auth {
username = ""
password = ""
}
}