GKE cluster shielded nodes should have secure boot enabled
Checkov CKV_GCP_68 is titled "Ensure Secure Boot for Shielded GKE Nodes is Enabled". The Powerpipe check is titled "GKE clusters shielded node secure boot should be enabled". The control is non-compliant if shielded node secure boot is disabled.
What this control checks
Checks GKE cluster nodes against a secure boot requirement tied to shielded node settings
Common pitfalls
FAILED when shielded_instance_config is not set
The check returns FAILED when shielded_instance_config is missing from node_config.
UNKNOWN result when node_config is not present
The check returns UNKNOWN when node_config is absent.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.kubernetes_cluster_shielded_node_secure_boot_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_68.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to ID.RA-09 (The authenticity and integrity of hardware and software are assessed prior to acquisition and use.), PR.IR-02 (The organization's technology assets are protected from environmental threats.), PR.IR-03 (Mechanisms are implemented to achieve resilience requirements in normal and adverse situations.) and 3 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kubernetes_cluster_shielded_node_secure_boot_enabled - Checkov Check:
CKV_GCP_68 - Powerpipe Control:
gcp_compliance.control.kubernetes_cluster_shielded_node_secure_boot_enabled
Last reviewed: 2026-10-09