Google Cloud Compliance ControlsGoogle Kubernetes Engine
GKE clusters should have 'Master authorized networks' set to 'Enabled'
Checks that GKE clusters have `master authorized networks` enabled. When authorized networks are enabled, access to the cluster control plane (master) can be restricted to a fixed set of CIDR ranges instead of being open broadly.
What this control checks
Checks the GKE cluster Master authorized networks setting
Framework mappings
The clauses this control is mapped to in each framework.
- 1.3.2 Limit inbound Internet traffic to IP addresses within the DMZ
- Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment, and specifically deny all other traffic
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
enable_gke_master_authorized_networks - Checkov Check:
CKV_GCP_20 - Powerpipe Control:
gcp_compliance.control.enable_gke_master_authorized_networks - Trivy Check:
GCP-0061
Last reviewed: 2026-10-09