GKE clusters should have private nodes configured
Trivy GCP-0059 says enabling private nodes ensures the nodes are only available internally, as they will only be assigned internal addresses. KICS says clusters must be created as Private Clusters, rather than public ones.
Enabling private nodes on a cluster ensures the nodes are only available internally as they will only be assigned internal addresses.
What this control checks
Checks whether a cluster has private nodes configured
Common pitfalls
Both private attributes must be true
Kubernetes Clusters must be created with Private Clusters enabled, meaning the 'private_cluster_config' must be defined and the attributes 'enable_private_nodes' and 'enable_private_endpoint' must be true
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.kubernetes_cluster_private_nodes_configured.
Scans of the Terraform code that flag the same setting before deployment: KICS query "Private Cluster Disabled" (6ccb85d7-0420-4907-9380-50313f80946b); Trivy check GCP-0059.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to PR.IR-01 (Networks and environments are protected from unauthorized logical access and usage.).
Framework mappings
The clauses this control is mapped to in each framework.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kubernetes_cluster_private_nodes_configured - Powerpipe Control:
gcp_compliance.control.kubernetes_cluster_private_nodes_configured - KICS Query:
6ccb85d7-0420-4907-9380-50313f80946b - Trivy Check:
GCP-0059
Last reviewed: 2026-10-09