Google Cloud Compliance ControlsGoogle Kubernetes Engine
GKE clusters should have legacy metadata endpoints disabled
Check that legacy metadata endpoints are disabled on Kubernetes clusters (disabled by default since GKE 1.12+). The powerpipe check `disable_gke_legacy_endpoints` runs the query `kubernetes_cluster_legacy_endpoints_disabled`.
What this control checks
Requires GKE clusters to disable legacy metadata endpoints
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
disable_gke_legacy_endpoints - Powerpipe Control:
gcp_compliance.control.disable_gke_legacy_endpoints
Last reviewed: 2026-10-09