Enroll GKE clusters in release channels for automated version management

Kako se proverava

Metod provere: Komanda ljuske

v=$(gcloud container clusters describe "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(releaseChannel.channel)') || exit 1
if case "$v" in REGULAR|STABLE) true;; *) false;; esac; then echo compliant; else echo "noncompliant: releaseChannel.channel=$v"; fi

Očekivani izlaz

compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Enroll the existing GKE cluster in an approved release channel rather than recreating the cluster. Use regular or stable unless the organization has approved another channel for a documented use case. Before changing the release channel, confirm that the cluster control plane version is available in the target channel and configure maintenance windows or exclusions if upgrade timing needs to be controlled. gcloud container clusters update $CLUSTER_NAME \ --location=$LOCATION \ --project=$PROJECT_ID \ --release-channel=$RELEASE_CHANNEL After remediation, rerun the audit command and verify that .releaseChannel.channel returns the approved channel. For clusters enrolled in a release channel, node auto-upgrade is managed as part of the GKE release channel upgrade process, so maintenance policies should be reviewed to reduce workload disruption during automatic upgrades.

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

tmaegis scan --target gke