Vendor services misconfigurations

GKE Nodepool creating nodes without GKE Metadata Server

Risk Level

Informational (4)



Every node stores its metadata on a metadata server. Some of this metadata, such as kubelet credentials and the VM instance identity token, is sensitive and should not be exposed to a Kubernetes workload. Enabling the GKE Metadata server prevents pods (that are not running on the host network) from accessing this metadata and facilitates Workload Identity. It was detected that {GcpGkeCluster.NodePools} is using nodes that are exposing it's metadata server to it's underlying pods.
  • Recommended Mitigation

    Consider enabling The GKE Metadata Server for all nodepools. For more info: <a href="" target="_blank" rel="noopener noreferrer"></a>