Use the Conformity Knowledge Base AI to help improve your Cloud Posture

Use Labels for Resource Management

Trend Cloud One™ – Conformity is a continuous assurance tool that provides peace of mind for your cloud infrastructure, delivering over 1000 automated best practice checks.

Risk Level: Low (generally tolerable level of risk)

Ensure that user-defined labels are being used to tag, collect, and organize GKE clusters within your Google Cloud Platform (GCP) projects. User-defined labels are a lightweight and efficient way to group together related or associated cloud resources. These are unrelated to Kubernetes labels.

Security
Reliability
Performance
efficiency
Cost
optimisation

As your Google Cloud Platform (GCP) projects grow increasingly complex, effective management strategies become essential. User-defined labels can significantly enhance visibility and organization across your Google Cloud resources. By strategically labeling your GKE clusters, you can streamline organization, simplify search queries, and optimize resource management. This lightweight yet powerful approach allows you to group related services, such as production, staging, and development environments, for efficient identification and control.


Audit

To determine if your GKE clusters are labeled for better resource management, perform the following operations:

Using GCP Console

01 Sign in to the Google Cloud Management Console.

02 Select the Google Cloud Platform (GCP) project that you want to examine from the console top navigation bar.

03 Navigate to Kubernetes Engine console available at https://console.cloud.google.com/kubernetes.

04 In the left navigation panel, under Resource Management, choose Clusters and select the OVERVIEW tab to access the list of GKE clusters provisioned for the selected GCP project.

05 Select the GKE cluster that you want to examine and choose LABELS to view the labels defined for selected service. The panel with the service labels opens.

06 Review the Labels for panel to determine if any user-defined labels are configured for the selected resource. If there are no user-defined labels listed on this panel, the selected Google Kubernetes Engine (GKE) cluster is not labeled with user-defined labels for resource management.

07 Repeat steps no. 5 and 6 for each GKE cluster provisioned within the selected GCP project.

08 Repeat steps no. 2 – 7 for each GCP project deployed in your Google Cloud account.

Using GCP CLI

01 Run projects list command (Windows/macOS/Linux) with custom output filters to list the ID of each GCP project available in your Google Cloud account:

gcloud projects list
	--format="table(projectId)"

02 The command output should return the requested GCP project IDS:

PROJECT_ID
cc-web-project-123123
cc-dev-project-112233

03 Run container clusters list command (Windows/macOS/Linux) with the ID of the GCP project that you want to examine as the identifier parameter and custom output filters to describe the name and the region of each GKE cluster provisioned for the selected project:

gcloud container clusters list
	--project cc-web-project-123123
	--format="table(NAME,ZONE)"

04 The command output should return the requested cluster names and their regions:

NAME: cc-gke-backend-cluster
ZONE: us-central1

NAME: cc-gke-frontend-cluster
ZONE: us-central1

05 Run container clusters describe command (Windows/macOS/Linux) with the name of the GKE cluster that you want to examine as the identifier parameter and custom output filters to describe the user-defined resource labels configured for the selected GKE cluster:

gcloud container clusters describe cc-gke-backend-cluster
	--region=us-central1
	--format="json(resourceLabels)"

06 The command output should return the requested resource labels:

null

If the container clusters describe command output returns null, as shown in the example above, the selected Google Kubernetes Engine (GKE) cluster is not labeled with user-defined labels for resource management.

07 Repeat steps no. 5 and 6 for each GKE cluster provisioned for the selected GCP project.

08 Repeat steps no. 3 – 7 for each GCP project deployed in your Google Cloud account.

Remediation / Resolution

To ensure that all your Google Kubernetes Engine (GKE) clusters are labeled with user-defined labels for better resource management, perform the following operations:

Using GCP Console

01 Sign in to the Google Cloud Management Console.

02 Select the Google Cloud Platform (GCP) project that you want to access from the console top navigation bar.

03 Navigate to Kubernetes Engine console available at https://console.cloud.google.com/kubernetes.

04 In the left navigation panel, under Resource Management, choose Clusters and select the OVERVIEW tab to access the list of GKE clusters provisioned for the selected GCP project.

05 Select the GKE cluster that you want to configure and choose LABELS. The panel with the service labels opens.

06 In the Labels for panel, choose ADD LABEL, and use the Key and Value text fields to define your own user-defined labels for the selected service. You can use labels such as: environment (e.g., prod, test, dev), team (e.g., frontend, backend, secops), billing (e.g., project5, engineering), version (e.g., v1.3, v2.1) or owner (e.g., john-doe, team-lead). Choose SAVE to apply the changes.

07 Repeat steps no. 5 and 6 for each GKE cluster that you want to configure, created for the selected GCP project.

08 Repeat steps no. 2 – 7 for each GCP project available in your Google Cloud account.

Using GCP CLI

01 Run container clusters update command (Windows/macOS/Linux) with the name of the Google Kubernetes Engine (GKE) cluster that you want to configure as the identifier parameter, to set user-defined labels for the selected GKE cluster. Use the --update-labels command parameter to supply your own labels. If the specified label exists, its value is modified. Otherwise, a new label is created. You can use labels such as: environment (e.g., prod, test, dev), team (e.g., frontend, backend, secops), billing (e.g., project5, engineering), version (e.g., v1.5, v2.1) or owner (e.g., john-doe, team-lead):

gcloud container clusters update cc-gke-backend-cluster
	--region=us-central1
	--update-labels=environment=prod,team=engineering

02 The command output should return the full URL of the modified GKE cluster:

Updating cc-gke-backend-cluster... done.
Updated [https://container.googleapis.com/v1/projects/cc-web-project-123123/zones/us-central1/clusters/cc-gke-backend-cluster].

03 Repeat steps no. 1 and 2 for each GKE cluster that you want to configure, available within the selected GCP project.

04 Repeat steps no. 1 – 3 for each GCP project deployed in your Google Cloud account.

References

Publication date Dec 3, 2024