Initial Access: GKE NodePort service created

This document describes a threat finding type in Security Command Center. Threat findings are generated by threat detectors when they detect a potential threat in your cloud resources. For a full list of available threat findings, see Threat findings index.

Finding description

Someone created a NodePort service. NodePort services expose Pods directly on a node's IP address and static port, which makes the Pods accessible from outside the cluster. This can introduce a significant security risk because it could allow an attacker to exploit vulnerabilities in the exposed service to gain access to the cluster or sensitive data.

  1. Review the service's configuration to determine its purpose.
  2. Consider restricting network policies to secure the service.

What's next