Enable Workload Vulnerability Scanning

01 Sign in to the Google Cloud Management Console.

02 Select the Google Cloud Platform (GCP) project that you want to examine from the console top navigation bar.

03 Navigate to Kubernetes Engine console available at https://console.cloud.google.com/kubernetes.

04 In the left navigation panel, under Resource Management, choose Clusters and select the OVERVIEW tab to access the list of GKE clusters provisioned for the selected GCP project.

05 Click on the name (link) of the GKE cluster that you want to examine.

06 Select the DETAILS tab to view the configuration information available for the selected cluster.

07 In the Security section, check the Workload vulnerability scanning attribute value to determine the feature status. If Workload vulnerability scanning is set to Disabled, workload vulnerability scanning is not enabled for the selected Google Kubernetes Engine (GKE) cluster.

08 Repeat steps no. 5 – 7 for each GKE cluster provisioned within the selected GCP project.

09 Repeat steps no. 2 – 8 for each GCP project deployed in your Google Cloud account.

01 Run projects list command (Windows/macOS/Linux) with custom output filters to list the ID of each GCP project available in your Google Cloud account:

gcloud projects list
	--format="table(projectId)"

02 The command output should return the requested GCP project IDS:

PROJECT_ID
cc-web-project-123123
cc-dev-project-112233

03 Run container clusters list command (Windows/macOS/Linux) with the ID of the GCP project that you want to examine as the identifier parameter and custom output filters to describe the name and the region of each GKE cluster provisioned for the selected project:

gcloud container clusters list
	--project cc-web-project-123123
	--format="table(NAME,ZONE)"

04 The command output should return the requested cluster names and their regions:

NAME: cc-gke-backend-cluster
ZONE: us-central1

NAME: cc-gke-frontend-cluster
ZONE: us-central1

05 Run container clusters describe command (Windows/macOS/Linux) with the name of the GKE cluster that you want to examine as the identifier parameter and custom output filters to determine the Workload Vulnerability Scanning feature status, available for the selected cluster:

gcloud container clusters describe cc-gke-backend-cluster
	--region=us-central1
	--format="value(securityPostureConfig.vulnerabilityMode)"

06 The command output should return the workload vulnerability scanning mode (tier) configured for the selected GKE cluster:

VULNERABILITY_MODE_UNSPECIFIED

07 Repeat steps no. 5 and 6 for each GKE cluster provisioned for the selected GCP project.

08 Repeat steps no. 3 – 7 for each GCP project deployed in your Google Cloud account.

01 Sign in to the Google Cloud Management Console.

02 Select the Google Cloud Platform (GCP) project that you want to access from the console top navigation bar.

03 Navigate to Kubernetes Engine console available at https://console.cloud.google.com/kubernetes.

04 In the left navigation panel, under Resource Management, choose Clusters and select the OVERVIEW tab to access the list of GKE clusters deployed for the selected GCP project.

05 Click on the name (link) of the GKE cluster that you want to configure.

06 Select the DETAILS tab to view the configuration information available for the selected cluster.

07 In the Security section, click on the Edit workload vulnerability scanning button (i.e., pencil icon) available next to Workload vulnerability scanning to modify the feature settings.

08 Inside the Edit workload vulnerability scanning configuration box, check the Enable workload vulnerability scanning setting checkbox, choose the vulnerability scanning mode (tier) that you want to use for your workloads, and select SAVE CHANGES to apply the changes. You can choose between two tiers: Basic, which provides container OS vulnerability scanning (requires Kubernetes version 1.23 or higher), and Advanced, which adds language package vulnerability scanning on top of the scanning capabilities available in the Basic tier (requires Kubernetes version 1.27 or higher).

09 Repeat steps no. 5 – 8 for each GKE cluster that you want to configure, created for the selected GCP project.

10 Repeat steps no. 2 – 9 for each GCP project available in your Google Cloud account.

01 Run container clusters update command (Windows/macOS/Linux) with the name of the Google Kubernetes Engine (GKE) cluster that you want to configure as the identifier parameter, to enable workload vulnerability scanning for your GKE cluster. You can choose between two tiers: Basic, which provides container OS vulnerability scanning (requires Kubernetes version 1.23 or higher), and Advanced, which adds language package vulnerability scanning on top of the scanning capabilities already available in the Basic tier (requires Kubernetes version 1.27 or higher). To use the Basic tier, set the --workload-vulnerability-scanning parameter to standard. To use the Advanced tier, set --workload-vulnerability-scanning to enterprise, as shown in the example below:

gcloud container clusters update cc-gke-backend-cluster
	--region=us-central1
	--workload-vulnerability-scanning=enterprise

02 The command output should return the full URL of the modified GKE cluster:

Updating cc-gke-backend-cluster... done.
Updated [https://container.googleapis.com/v1/projects/cc-web-project-123123/zones/us-central1/clusters/cc-gke-backend-cluster].

03 Repeat steps no. 1 and 2 for each GKE cluster that you want to configure, available within the selected GCP project.

04 Repeat steps no. 1 – 3 for each GCP project deployed in your Google Cloud account.