Description

GKE Shielded node pools should enable Secure Boot to verify the digital signature of all node boot components and halt the boot process if signature verification fails. This helps ensure that only authentic, untampered software runs during system initialization.

Remediation

Secure Boot cannot be enabled on an existing node pool. Create a new node pool with Secure Boot enabled, migrate workloads to it, then delete the non-conforming pool. See Using Shielded GKE nodes for guidance.

References

• Using Shielded GKE nodes
• CIS Google Kubernetes Engine (GKE) Benchmark