Skip to content

fix(terraform): CKV_GCP_13 pass when client_certificate_config is omitted #7569

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
arpitjain099 wants to merge 2 commits into
base: main
Choose a base branch
from
Open

fix(terraform): CKV_GCP_13 pass when client_certificate_config is omitted #7569

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
47a50bc
fix(terraform): CKV_GCP_13 pass when client_certificate_config is omi…
arpitjain099 Jun 4, 2026
ed16f79
Merge branch 'main' into fix/ckv-gcp-13-omitted-client-cert-fp
arpitjain099 Jun 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions checkov/terraform/checks/resource/gcp/GKEClientCertificateDisabled.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
from checkov.common.models.enums import CheckCategories
from checkov.common.models.enums import CheckCategories, CheckResult


class GKEClientCertificateDisabled(BaseResourceValueCheck):
Expand All @@ -8,7 +8,11 @@ def __init__(self):
id = "CKV_GCP_13"
supported_resources = ['google_container_cluster']
categories = [CheckCategories.KUBERNETES]
super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
# The google provider defaults issue_client_certificate to false, which is exactly the
# desired state. Omitting master_auth/client_certificate_config therefore leaves client
# certificate auth disabled, so a missing block should pass rather than fail.
super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,
missing_block_result=CheckResult.PASSED)

def get_inspected_key(self):
"""
Expand Down
7 changes: 7 additions & 0 deletions tests/terraform/checks/resource/gcp/test_GKEClientCertificateDisabled.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,13 @@ def test_success(self):
scan_result = check.scan_resource_conf(conf=resource_conf)
self.assertEqual(CheckResult.PASSED, scan_result)

def test_success_omitted_block(self):
# The google provider defaults issue_client_certificate to false, so a cluster that omits
# master_auth/client_certificate_config still has client certificate auth disabled.
resource_conf = {'name': ['google_cluster'], 'location': ['us-central1']}
scan_result = check.scan_resource_conf(conf=resource_conf)
self.assertEqual(CheckResult.PASSED, scan_result)

def test_failure(self):
resource_conf = {'name': ['google_cluster'], 'master_auth': [{'client_certificate_config': [{'issue_client_certificate': [True]}]}]}
scan_result = check.scan_resource_conf(conf=resource_conf)
Expand Down