GKE clusters should be private clusters
Kubernetes Clusters must be created with Private Clusters enabled. The `private_cluster_config` must be defined. The attributes `enable_private_nodes` and `enable_private_endpoint` must be true.
What this control checks
private_cluster_config defined with enable_private_nodes and enable_private_endpoint true
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.allow_only_private_cluster.
Scans of the Terraform code that flag the same setting before deployment: KICS query "Private Cluster Disabled" (6ccb85d7-0420-4907-9380-50313f80946b).
Framework-specific interpretation
PCI DSS v3.2.1: Mapped to 1.3.2 (Limit inbound Internet traffic to IP addresses within the DMZ).
Framework mappings
The clauses this control is mapped to in each framework.
- 1.3.2 Limit inbound Internet traffic to IP addresses within the DMZ
Related controls
- GKE clusters should have private nodes configured
- GKE clusters should have 'Master authorized networks' set to 'Enabled'
- GKE clusters should not use the default service account for project access
- GKE node pools should all have automatic node repair enabled
- GKE clusters should have Kubernetes alpha enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
allow_only_private_cluster - Powerpipe Control:
gcp_compliance.control.allow_only_private_cluster - KICS Query:
6ccb85d7-0420-4907-9380-50313f80946b
Last reviewed: 2026-10-09