Integrity Monitoring for Shielded GKE Nodes should be enabled

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Description

GKE node pools should have Integrity Monitoring enabled for Shielded GKE Nodes so administrators are notified of inconsistencies during the node boot sequence and can prevent compromised nodes from joining the cluster. Integrity Monitoring cannot be enabled on an existing node pool; create a new node pool with the control enabled and migrate workloads.

Remediation

Integrity Monitoring cannot be enabled on an existing node pool. Create a replacement node pool with Integrity Monitoring enabled (via the Shielded options in the console, or gcloud container node-pools create), migrate workloads, then delete the non-conforming pool. See Using Shielded GKE Nodes for the full procedure.

References