Use the Conformity Knowledge Base AI to help improve your Cloud Posture

Enable Critical Notifications

Trend Cloud One™ – Conformity is a continuous assurance tool that provides peace of mind for your cloud infrastructure, delivering over 1000 automated best practice checks.

Risk Level: Medium (should be achieved)

Ensure that critical alert notifications are enabled for your Google Kubernetes Engine (GKE) clusters in order to receive important Pub/Sub messages from Google Cloud about upgrades, security bulletins, and other relevant information.

Security

Configuring critical notifications for your Google Kubernetes Engine (GKE) clusters with Pub/Sub enables you to proactively manage your GKE environment by receiving timely alerts about scheduled upgrades, security bulletins, and new GKE version releases. This ensures smooth operations, minimizes downtime, and helps you stay informed about potential risks and opportunities for optimization.


Audit

To determine if critical alert notifications are enabled for your Google Kubernetes Engine (GKE) clusters, perform the following operations:

Using GCP Console

01 Sign in to the Google Cloud Management Console.

02 Select the Google Cloud Platform (GCP) project that you want to examine from the console top navigation bar.

03 Navigate to Kubernetes Engine console available at https://console.cloud.google.com/kubernetes.

04 In the left navigation panel, under Resource Management, choose Clusters and select the OVERVIEW tab to access the list of GKE clusters provisioned for the selected GCP project.

05 Click on the name (link) of the GKE cluster that you want to examine.

06 Select the DETAILS tab to view the configuration information available for the selected cluster.

07 In the Automation section, check the Notifications attribute value to determine if alert notifications via Pub/Sub are enabled for your cluster. If Notifications is set to Disabled, critical alert notifications are not enabled for the selected Google Kubernetes Engine (GKE) cluster.

08 Repeat steps no. 5 – 7 for each GKE cluster provisioned within the selected GCP project.

09 Repeat steps no. 2 – 8 for each GCP project deployed in your Google Cloud account.

Using GCP CLI

01 Run projects list command (Windows/macOS/Linux) with custom output filters to list the ID of each GCP project available in your Google Cloud account:

gcloud projects list
	--format="table(projectId)"

02 The command output should return the requested GCP project IDS:

PROJECT_ID
cc-web-project-123123
cc-dev-project-112233

03 Run container clusters list command (Windows/macOS/Linux) with the ID of the GCP project that you want to examine as the identifier parameter and custom output filters to describe the name and the region of each GKE cluster provisioned for the selected project:

gcloud container clusters list
	--project cc-web-project-123123
	--format="table(NAME,ZONE)"

04 The command output should return the requested cluster names and their regions:

NAME: cc-gke-backend-cluster
ZONE: us-central1

NAME: cc-gke-frontend-cluster
ZONE: us-central1

05 Run container clusters describe command (Windows/macOS/Linux) with the name of the GKE cluster that you want to examine as the identifier parameter and custom output filters to determine if alert notifications via Pub/Sub are enabled for the selected cluster:

gcloud container clusters describe cc-gke-backend-cluster
	--region=us-central1
	--format="json(notificationConfig.pubsub.enabled)"

06 The command output should return the Pub/Sub notifications configuration status:

null

If the container clusters describe command output returns null, as shown in the example above, critical alert notifications are not enabled for the selected Google Kubernetes Engine (GKE) cluster.

07 Repeat steps no. 5 and 6 for each GKE cluster provisioned for the selected GCP project.

08 Repeat steps no. 3 – 7 for each GCP project deployed in your Google Cloud account.

Remediation / Resolution

To enable and configure critical alert notifications via Pub/Sub for your Google Kubernetes Engine (GKE) clusters, perform the following operations:

Using GCP Console

01 Sign in to the Google Cloud Management Console.

02 Select the Google Cloud Platform (GCP) project that you want to access from the console top navigation bar.

03 Navigate to Pub/Sub console available at https://console.cloud.google.com/cloudpubsub, choose CREATE TOPIC, and perform the following actions to set up the required Pub/Sub topic and subscription:

  1. Provide a unique identifier for the new topic in the Topic ID box.
  2. Check the Add a default subscription setting checkbox to create a subscription for your new topic.
  3. For Encryption, choose Cloud KMS key, and select your own Customer-Managed Encryption Key (CMEK) from the Select a Cloud KMS key dropdown list.
  4. Choose CREATE to deploy your new Pub/Sub topic and subscription.

04 Navigate to Kubernetes Engine console available at https://console.cloud.google.com/kubernetes.

05 In the left navigation panel, under Resource Management, choose Clusters and select the OVERVIEW tab to access the list of GKE clusters deployed for the selected GCP project.

06 Click on the name (link) of the GKE cluster that you want to configure.

07 Select the DETAILS tab to view the configuration information available for the selected cluster.

08 In the Automation section, click on the Edit notifications button (i.e., pencil icon) available next to Notifications to modify the feature settings.

09 Inside the Edit notifications configuration box, perform the following actions to enable and configure critical alert notifications via Pub/Sub:

  1. Check the Enable notifications setting checkbox.
  2. Select the Pub/Sub topic created at step no. 3 from the Cloud Pub/Sub topic dropdown list.
  3. (Optional) To filter notifications, check the Filter notification types setting checkbox, and choose what type of alert notifications you want to receive. If no filters are applied, you will receive all types of critical notifications (recommended).
  4. Choose SAVE CHANGES to apply the changes.

10 Repeat steps no. 6 – 9 for each GKE cluster that you want to configure, created for the selected GCP project.

11 Repeat steps no. 2 – 10 for each GCP project available in your Google Cloud account.

Using GCP CLI

01 Run pubsub topics create command (Windows/macOS/Linux) to create the Pub/Sub topic that will handle alert notifications for your Google Kubernetes Engine (GKE) clusters:

gcloud pubsub topics create cc-gke-notifications-topic
	--project cc-web-project-123123

02 The command output should return the full resource identifier of the newly created topic:

Created topic [projects/cc-web-project-123123/topics/cc-gke-notifications-topic].

03 Run pubsub subscriptions create command (Windows/macOS/Linux) to create the Pub/Sub topic subscription that will receive alert notifications from Google Kubernetes Engine (GKE):

gcloud pubsub subscriptions create cc-gke-alert-subscription
	--topic=cc-gke-notifications-topic
	--topic-project=cc-web-project-123123

04 The command output should return the resource ID of the new Pub/Sub topic subscription:

Created subscription [projects/cc-web-project-123123/subscriptions/cc-notifications-subscription].

05 Run container clusters update command (Windows/macOS/Linux) with the name of the Google Kubernetes Engine (GKE) cluster that you want to configure as the identifier parameter, to enable critical alert notifications via Pub/Sub for the selected GKE cluster. Use the --notification-config parameter to specify the required Pub/Sub topic, created at step no. 1. To filter notifications, add the filter=\<notification-types\> key-value pair to the --notification-config parameter as described here. If no filters are applied, you will receive all types of critical notifications (recommended):

gcloud container clusters update cc-gke-backend-cluster
	--region=us-central1
	--notification-config=pubsub=ENABLED,pubsub-topic=projects/cc-web-project-123123/topics/cc-gke-notifications-topic

06 The command output should return the full URL of the modified GKE cluster:

Updating cc-gke-backend-cluster... done.
Updated [https://container.googleapis.com/v1/projects/cc-web-project-123123/zones/us-central1/clusters/cc-gke-backend-cluster].

07 Repeat steps no. 5 and 6 for each GKE cluster that you want to configure, available within the selected GCP project.

08 Repeat steps no. 1 – 7 for each GCP project deployed in your Google Cloud account.

References

Publication date Dec 3, 2024