Information
Enable Secure Boot for Shielded GKE Nodes to verify the digital signature of node boot components.
Rationale:
An attacker may seek to alter boot components to persist malware or root kits during system initialisation. Secure Boot helps ensure that the system only runs authentic software by verifying the digital signature of all boot components, and halting the boot process if signature verification fails.
Solution
Once a Node pool is provisioned, it cannot be updated to enable Secure Boot. You must create new Node pools within the cluster with Secure Boot enabled.
Using Google Cloud Console
Go to Kubernetes Engine by visiting https://console.cloud.google.com/kubernetes/list
From the list of clusters, click on the cluster requiring the update and click ADD NODE POOL
Ensure that the 'Secure boot' checkbox is checked under the 'Shielded options' Heading
Click SAVE.
You will also need to migrate workloads from existing non-conforming Node pools to the newly created Node pool, then delete the non-conforming pools.
Using Command Line
To create a Node pool within the cluster with Secure Boot enabled, run the following command:
gcloud beta container node-pools create [NODEPOOL_NAME] \
--cluster [CLUSTER_NAME] --zone [COMPUTE_ZONE] \
--shielded-secure-boot
You will also need to migrate workloads from existing non-conforming Node pools to the newly created Node pool, then delete the non-conforming pools.
Impact:
Secure Boot will not permit the use of third-party unsigned kernel modules.
Default Value:
By default, Secure Boot is disabled in GKE clusters. By default, Secure Boot is disabled when Shielded GKE Nodes is enabled.