GKE clusters should have client certificate authentication enabled
This control ensures that client certificate authentication is enabled on GKE clusters. A cluster is reported as not meeting the control when client certificate authentication is not enabled, so clusters without it are flagged in the results.
What this control checks
GKE clusters client certificate authentication should be enabled
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.kubernetes_cluster_client_certificate_authentication_enabled.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to PR.AA-02 (Identities are proofed and bound to credentials based on the context of interactions.) and PR.AA-03 (Users, services, and hardware are authenticated.).
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- PR.AA-02: Identities are proofed and bound to credentials based on the context of interactions.
- PR.AA-03
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kubernetes_cluster_client_certificate_authentication_enabled - Powerpipe Control:
gcp_compliance.control.kubernetes_cluster_client_certificate_authentication_enabled
Last reviewed: 2026-10-09