GKE control planes reachable from any IP because authorized networks are off

An API server anyone can knock on

The Kubernetes API server is the most privileged component in a cluster. Authorized networks are an IP allowlist in front of it. Google’s network isolation overview describes them as an IP-based firewall for the GKE control plane, configured as a list of CIDR blocks. The gcloud reference spells out the alternative: with --no-enable-master-authorized-networks, the public internet (0.0.0.0/0) is allowed to connect to the control plane over HTTPS.

Authentication still applies, so an open endpoint is not an open cluster. But it means a leaked kubeconfig, a stolen service account key or an unpatched API server flaw can be exploited from any network on earth rather than only from your office or CI runners.

Checking the allowlist on each cluster

gcloud container clusters list \
  --format="table(name,location,masterAuthorizedNetworksConfig.enabled)"

gcloud container clusters describe CLUSTER_NAME --location=LOCATION \
  --format="yaml(masterAuthorizedNetworksConfig)"

The second command shows the CIDR blocks already allowed on a cluster that has the feature on.

How the finding is triggered

ZopNight records whether authorized networks are enabled for every GKE cluster it inventories, and fires only when the value is explicitly disabled. A cluster with no recorded value is skipped.

Clusters this does not cover

The rule checks that the allowlist exists, not what is in it. A cluster that has authorized networks on with a 0.0.0.0/0 entry is not flagged, so review the CIDR list yourself. Node exposure is a different question, handled by GKE Cluster Not Private.

Critical severity with no saving

No saving is attached. The fix is a configuration change; the real effort is collecting the right source ranges.

Restricting the control plane

1. Collect the ranges that genuinely need API access: admin VPN egress, CI runners, bastion hosts.
2. Enable the allowlist with those ranges:

   gcloud container clusters update CLUSTER_NAME --location=LOCATION \
     --enable-master-authorized-networks \
     --master-authorized-networks=203.0.113.0/24,198.51.100.10/32

3. Run gcloud container clusters get-credentials CLUSTER_NAME --location=LOCATION and a kubectl get nodes from an allowed network to confirm access.
4. Consider the DNS-based endpoint or a private endpoint for stronger isolation.