Description

Every node stores its metadata on a metadata server. Some of this metadata, such as kubelet credentials and the VM instance identity token, is sensitive and should not be exposed to a Kubernetes workload. Enabling the GKE Metadata server prevents pods (that are not running on the host network) from accessing this metadata and facilitates Workload Identity. It was detected that {GcpGkeCluster.NodePools} is using nodes that are exposing it's metadata server to it's underlying pods.

• 

  Recommended Mitigation

  Consider enabling The GKE Metadata Server for all nodepools. For more info: <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/protecting-cluster-metadata#concealment" target="_blank" rel="noopener noreferrer">https://cloud.google.com/kubernetes-engine/docs/how-to/protecting-cluster-metadata#concealment</a>