Use COS_CONTAINERD node images for GKE node pools

How it is checked

Audit method: Shell command

out=$(gcloud container node-pools list --cluster "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(name,config.imageType)') || exit 1
bad=$(printf '%s\n' "$out" | awk -F '\t' 'NF && !(toupper($2)=="COS_CONTAINERD") {print $1 ": " $2}')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad"; fi

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Update noncompliant GKE node pools to use COS_CONTAINERD unless there is a documented requirement for Ubuntu or Windows node images. This remediation changes the node image for the selected node pool and should be planned as a node pool upgrade activity. gcloud container clusters upgrade $CLUSTER_NAME \ --location=$LOCATION \ --project=$PROJECT_ID \ --node-pool=$NODE_POOL \ --image-type=COS_CONTAINERD After the upgrade completes, rerun the audit command and verify that the node pool reports COS_CONTAINERD. Validate workloads before and after the change, especially anything that depends on host level packages, Ubuntu specific behavior, Windows nodes, or Docker Engine access.

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target gke