Verify node auto-upgrade is enabled for GKE node pools

Како се проверава

Метод провере: Команда љуске

out=$(gcloud container node-pools list --cluster "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(name,management.autoUpgrade)') || exit 1
bad=$(printf '%s\n' "$out" | awk -F '\t' 'NF && !($2=="True") {print $1 ": " $2}')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad"; fi

Очекивани излаз

compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Enable node auto-upgrade for any GKE node pool where the audit result is not true. This allows GKE to automatically schedule eligible node pools for upgrades when upgrade targets become available, subject to maintenance windows, maintenance exclusions, release channel behavior, and upgrade rollout constraints. gcloud container node-pools update $POOL_NAME \ --cluster $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --enable-autoupgrade After remediation, rerun the audit command and confirm that management.autoUpgrade returns true. If multiple node pools are present, repeat the audit and remediation for each applicable node pool.

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

tmaegis scan --target gke --level 2