GoogleCloudPlatform / gcpdiag

gcpdiag is a command-line diagnostics tool for GCP customers.
https://gcpdiag.dev/
Apache License 2.0
288 stars 67 forks source link

BP_EXT/2022_001 - Google Groups are Enabled #12

Closed taylorjstacey closed 2 years ago

taylorjstacey commented 3 years ago

This pull request includes three changes.

  1. Adds has_authenticator_group_enabled to the GKE query class. This checks to see if the ['authenticatorGroupsConfig']['enabled']key exists. If authentictor groups were previously enabled, the previously used gke-security-groups email will persist but the enabled key will disappear.
  2. Added in the lint check for BP/2021_002.
  3. Provides the documentation and justification for why Google Groups for RBAC should be considered a best practice.
google-cla[bot] commented 3 years ago

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

:memo: Please visit https://cla.developers.google.com/ to sign.

Once you've signed (or fixed any issues), please reply here with @googlebot I signed it! and we'll verify it.


What to do if you already signed the CLA

Individual signers
Corporate signers

ℹ️ Googlers: Go here for more info.

taylorjstacey commented 3 years ago

@googlebot I signed it!

schweikert commented 3 years ago

Thanks a lot Taylor for this pull request and welcome to the project!

SergeyKanzhelev commented 3 years ago

this is CIS 6.8.3 https://cloud.google.com/kubernetes-engine/docs/concepts/cis-benchmarks so I would suggest we take this rule. The only question is how to categorize it so it wouldn't be too noisy.

@schweikert do you think we might need another category of rules? Maybe CIS as a category by itself?

taylorjstacey commented 2 years ago

Added tests as needed and I greatly reduced to the text in the webpage summary for BP/2021_02 to make it more actionable.

Took @schweikert's note on the unnecessary list and removed that step.