GKE clusters should have legacy metadata endpoints disabled
Check that legacy metadata endpoints are disabled on Kubernetes clusters (disabled by default since GKE 1.12+). The powerpipe check `disable_gke_legacy_endpoints` runs the query `kubernetes_cluster_legacy_endpoints_disabled`.
What this control checks
Requires GKE clusters to disable legacy metadata endpoints
Common pitfalls
Disabled by default since GKE 1.12+
The check is titled "Check that legacy metadata endpoints are disabled on Kubernetes clusters(disabled by default since GKE 1.12+)".
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.disable_gke_legacy_endpoints.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
disable_gke_legacy_endpoints - Powerpipe Control:
gcp_compliance.control.disable_gke_legacy_endpoints
Last reviewed: 2026-10-09