Google Cloud Compliance ControlsGoogle Kubernetes Engine
GKE clusters should have Alias IP ranges enabled at creation
Kubernetes Clusters must be created with Alias IP ranges enabled. The attribute `ip_allocation_policy` must be defined. If defined, the attribute `networking_mode` must be `VPC_NATIVE`.
What this control checks
GKE clusters are created with Alias IP ranges enabled
Framework mappings
The clauses this control is mapped to in each framework.
- 1.3.7 Do not disclose private IP addresses and routing information to unauthorized parties
- Do not allow unauthorized outbound traffic from the cardholder data environment to the Internet
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
enable_alias_ip_ranges - Checkov Check:
CKV_GCP_23 - Powerpipe Control:
gcp_compliance.control.enable_alias_ip_ranges - KICS Query:
c606ba1d-d736-43eb-ac24-e16108f3a9e0 - Trivy Check:
GCP-0049
Last reviewed: 2026-10-09