Authentication

GKE using Basic Authentication

Platform(s)
Compliance Frameworks
  • GKE CIS
  • ,
  • K8s OWASP Top 10
  • ,
  • NIST 800-190

Description

Basic Authentication allows a user to authenticate to a Kubernetes cluster with a username and static password which is stored in plaintext (without any encryption). Disabling Basic Authentication will prevent attacks like brute force and credential stuffing. It was detected that {GcpGkeCluster} uses basic auth to authenticate requests to the API server.