Enroll GKE clusters in release channels for automated version management

How it is checked

Audit method: Shell command

v=$(gcloud container clusters describe "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(releaseChannel.channel)') || exit 1
if case "$v" in REGULAR|STABLE) true;; *) false;; esac; then echo compliant; else echo "noncompliant: releaseChannel.channel=$v"; fi

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Enroll the existing GKE cluster in an approved release channel rather than recreating the cluster. Use regular or stable unless the organization has approved another channel for a documented use case. Before changing the release channel, confirm that the cluster control plane version is available in the target channel and configure maintenance windows or exclusions if upgrade timing needs to be controlled. gcloud container clusters update $CLUSTER_NAME \ --location=$LOCATION \ --project=$PROJECT_ID \ --release-channel=$RELEASE_CHANNEL After remediation, rerun the audit command and verify that .releaseChannel.channel returns the approved channel. For clusters enrolled in a release channel, node auto-upgrade is managed as part of the GKE release channel upgrade process, so maintenance policies should be reviewed to reduce workload disruption during automatic upgrades.

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target gke