An ephemeral, FedRAMP-realistic GKE cluster with four NIST 800-53 controls hard-coded into the cluster definition. Private nodes, KMS-backed secrets encryption, Calico network policy, and full audit logging — all enforced at the infrastructure layer and evidenced in machine-readable artifacts.
Kubernetes clusters are one of the hardest environments to evidence for compliance. The configuration options are numerous, security-relevant settings change between GKE versions, and most are buried deep enough that a standard checklist review misses them. The typical approach is to deploy a cluster, then run a checklist after the fact.
This primitive takes the opposite position. The controls are baked into the Terraform definition before the cluster exists. SC-28, CM-6, AC-3, and AU-3 are not audit findings waiting to happen — they are resource attributes. The evidence is captured in artifacts/plan.json and artifacts/terraform-state.json without any console interaction.
Every design choice was made to satisfy a specific compliance requirement. The cluster is intentionally minimal — two e2-small nodes, one zone, one lab session — so the compliance primitives are visible without being obscured by production complexity.
| Control ID | Mechanism | Evidence Field in State |
|---|---|---|
| SC-28 | KMS-backed application-layer secrets encryption, 90-day key rotation | database_encryption[].state + key_name |
| CM-6 | STABLE release channel, shielded nodes, secure boot, integrity monitoring, Calico, GKE_METADATA | cluster + node_pool config blocks |
| AC-3 | Private nodes, control plane locked to operator /32, workload identity, network policy, least-scope OAuth | private_cluster_config, master_authorized_networks_config, workload_identity_config |
| AU-3 | Five logging components + project audit log config for container.googleapis.com | logging_config.enable_components + google_project_iam_audit_config |
After apply, a single jq query against artifacts/terraform-state.json produces structured evidence for every enforced control. No console login, no manual evidence collection.
| Field in Output | Value | NIST 800-53 | NIST 800-171 | FedRAMP | CMMC L2 | SOC 2 |
|---|---|---|---|---|---|---|
| private_nodes | true | AC-3 | 3.1.1 · 3.1.2 | AC-3 | AC.L2-3.1.1 | CC6.1 |
| encryption_state | "ENCRYPTED" | SC-28 | 3.13.16 | SC-28 | SC.L2-3.13.16 | CC6.7 |
| release_channel | "STABLE" | CM-6 | 3.4.2 | CM-6 | CM.L2-3.4.2 | CC7.1 |
| workload_pool | *.svc.id.goog | AC-3 | 3.1.1 · 3.1.2 | AC-3 | AC.L2-3.1.2 | CC6.3 |
| logging_components | [5 components] | AU-3 | 3.3.1 | AU-3 | AU.L2-3.3.1 | CC7.2 |
The cluster is designed for a single lab session and torn down immediately after. The Makefile wraps every step so the session flow is consistent and reproducible.