0

How to check if PoDSecurityPolicy is enabled on a GKE cluster or not ? Using gcloud container clusters describe <clustername>, I could not find anything.

If I enable it on a cluster where this plugin is already enabled, it displays that the plugin has been enabled so there is no way actually to know that if plugin is already enabled on a cluster

 $ gcloud beta container clusters update mycluster --enable-pod-security-policy --zone us-east1-c
 Updating podsecpolicy-poc...done.
 Updated [https://container.googleapis.com/v1beta1/projects/<project>/zones/us-east1-c/clusters/mycluster].
Zama Ques
  • 1,497
  • 5
  • 26
  • 45

1 Answers1

2

Since PodSecurityPolicy is still a beta feature in GKE, it can only be accessed by GKE beta API. To check if PodSecurityPolicy controller is enabled on your GKE cluster, run:

$ gcloud beta container clusters describe <cluster-name> --zone=<zone> --format json | jq '.podSecurityPolicyConfig'

Sample command with its result:

$ gcloud beta container clusters describe my-gke-cluster --zone=europe-west4-c --format json | jq '.podSecurityPolicyConfig'
{
  "enabled": true
}

Update:

When PodSecurityPolicy is not enabled on GKE cluster, the above query returns:

null

as there is no podSecurityPolicyConfig section available. You can also serch for it with grep. If PodSecurityPolicy is enabled, the result will look as follows:

$ gcloud beta container clusters describe my-gke-cluster --zone=europe-west4-c | grep -iA 1 podsecuritypolicy
podSecurityPolicyConfig:
  enabled: true

If it is not, you won't find this section at all.

mario
  • 9,858
  • 1
  • 26
  • 42
  • It shows null when not enabled in a cluster . `$ gcloud beta container clusters describe podsecpolicy-poc --zone us-east1-c --format json | jq '.podSecurityPolicyConfig' null` – Zama Ques Mar 16 '21 at 13:15
  • 1
    Yes, when it isn't `enabled`, there is no `podSecurityPolicyConfig` section, so the query returns `null`. I'll update my answer. – mario Mar 16 '21 at 14:08
  • Thanks Mario for the detailed response. Is it enabled by default on new GKE Clusters ? – Zama Ques Mar 16 '21 at 17:02
  • No, it is not enabled by default unless you enable it explicitly when creating your cluster. Refer to [this section](https://cloud.google.com/kubernetes-engine/docs/how-to/pod-security-policies#enabling_podsecuritypolicy_controller) of the GCP docs. – mario Mar 26 '21 at 21:35