Regulatory support in Google Kubernetes Engine

This document describes the features, configurations and APIs in Google Kubernetes Engine that align with the controls for supported control packages. This document assumes that you're using Assured Workloads.

Data Boundary for ITAR

Supported services

The following table lists the Google Kubernetes Engine APIs and versions that meet the requirements of Data Boundary for ITAR.

Service Version Status
container.googleapis.com v1 SUPPORTED
container.googleapis.com v1alpha1 SUPPORTED
container.googleapis.com v1beta1 SUPPORTED
containersecurity.googleapis.com v1 SUPPORTED
containersecurity.googleapis.com v1beta SUPPORTED

Compliance supported regions

Google Kubernetes Engine is available for Data Boundary for ITAR in the following Google Cloud regions:

  • us-central1
  • us-central2
  • us-east1
  • us-east4
  • us-east5
  • us-south1
  • us-west1
  • us-west2
  • us-west3
  • us-west4

Applicable settings

The following table describes the organization policy constraints and product settings that apply to Data Boundary for ITAR. By default, these are set by Assured Workloads. If you change these settings, you must first consider how that change impacts your compliance status. For instructions on configuring organization policies, see Creating and managing organization policies.

Setting Required value
container.restrictNoncompliantDiagnosticDataAccess
  • True

Fields not intended for Sensitive data

The following table provides an illustrative list of field categories and specific fields that aren't suitable for sensitive information. To maintain compliance, avoid placing protected data in these fields. For a complete list, contact your Google Cloud representative.

Category Fields
Authentication and authorization
  • audiences
  • spec.groups
  • spec.token
  • spec.user
Filtering and searching
  • filter
Kubernetes configuration
  • cluster.nodeConfig.kubeletConfig.cpuManagerPolicy
  • cluster.nodePoolDefaults.nodeConfigDefaults.nodeKubeletConfig.cpuCfsQuotaPeriod
  • cluster.nodePools.config.kubeletConfig.evictionSoft.imagefsAvailable
Network configuration
  • cluster.ipAllocationPolicy.nodeIpv4CidrBlock
  • cluster.networkConfig.dnsConfig.clusterDnsDomain
  • cluster.nodePools.networkConfig.network
Parent resources
  • parent
Resource identification
  • clusterId
  • location
  • masterProjectId
  • name
  • projectId
  • zone
Resource management and labels
  • cluster.nodeConfig.resourceManagerTags.tags.key
  • cluster.resourceLabels.key
  • cluster.resourceLabels.value
Storage and disk configuration
  • cluster.nodeConfig.bootDiskKmsKey
  • cluster.nodeConfig.diskType
  • cluster.nodePools.config.storagePools
Update parameters
  • updateMask.paths
Versioning and specifications
  • apiVersion
  • kind
  • version

What's next