Restrict Access To The Control Plane Endpoint

#!/usr/bin/env bash
#
# audit-gke-master-authorized-networks.sh
#
# Purpose:
#   Report whether Master Authorized Networks are enabled for a set of GKE clusters
#   and list the allowed CIDR ranges where enabled.
#
# Requirements:
#   - gcloud CLI installed and authenticated
#   - jq installed
#
# Scope:
#   - This runs from any machine with gcloud access to the relevant project(s).
#
# Usage:
#   # Single project, all regions/zones:
#   ./audit-gke-master-authorized-networks.sh PROJECT_ID
#
#   # Multiple projects:
#   ./audit-gke-master-authorized-networks.sh PROJECT_ID_1 PROJECT_ID_2 ...
#

set -euo pipefail

if ! command -v gcloud >/dev/null 2>&1; then
  echo "ERROR: gcloud CLI not found in PATH" >&2
  exit 1
fi

if ! command -v jq >/dev/null 2>&1; then
  echo "ERROR: jq not found in PATH" >&2
  exit 1
fi

if [ "$#" -lt 1 ]; then
  echo "Usage: $0 PROJECT_ID [PROJECT_ID...]" >&2
  exit 1
fi

echo "timestamp,project,location,cluster_name,endpoint_private,master_authorized_networks_enabled,allowed_cidrs"

for PROJECT in "$@"; do
  # List all clusters (regional and zonal) in the project
  # Output in JSON to be parsed reliably
  CLUSTERS_JSON=$(gcloud container clusters list \
    --project="${PROJECT}" \
    --format=json)

  # If no clusters, continue
  if [ "$(echo "${CLUSTERS_JSON}" | jq 'length')" -eq 0 ]; then
    continue
  fi

  echo "${CLUSTERS_JSON}" | jq -c '.[]' | while read -r cluster; do
    NAME=$(echo "${cluster}" | jq -r '.name')
    LOCATION=$(echo "${cluster}" | jq -r '.location')

    # Get full description including masterAuthorizedNetworksConfig
    DESC_JSON=$(gcloud container clusters describe "${NAME}" \
      --project="${PROJECT}" \
      --region="${LOCATION}" \
      --format=json 2>/dev/null || \
      gcloud container clusters describe "${NAME}" \
        --project="${PROJECT}" \
        --zone="${LOCATION}" \
        --format=json 2>/dev/null || echo "{}")

    # Detect whether private endpoint is enabled (private cluster)
    ENDPOINT_PRIVATE=$(echo "${DESC_JSON}" | jq -r '.privateClusterConfig.enablePrivateEndpoint // false')

    # Detect whether Master Authorized Networks is enabled
    MAN_ENABLED=$(echo "${DESC_JSON}" | jq -r '.masterAuthorizedNetworksConfig.enabled // false')

    # Collect all CIDR blocks (if enabled)
    CIDRS=$(echo "${DESC_JSON}" \
      | jq -r '[.masterAuthorizedNetworksConfig.cidrBlocks[]?.cidrBlock] | join(";")')

    # If MAN is disabled, set CIDRS to empty string for clarity
    if [ "${MAN_ENABLED}" != "true" ]; then
      CIDRS=""
    fi

    printf "%s,%s,%s,%s,%s,%s,%s\n" \
      "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
      "${PROJECT}" \
      "${LOCATION}" \
      "${NAME}" \
      "${ENDPOINT_PRIVATE}" \
      "${MAN_ENABLED}" \
      "${CIDRS}"
  done
done