Verify node auto-repair is enabled for GKE node pools

DüşükDüzey 2Otomatikgke

Açıklama

Verify node auto-repair is enabled for GKE node pools so unhealthy nodes are automatically repaired and returned to a healthy running state. Node auto-repair is enabled by default for new node pools, but for older node pools should still be reviewed for compliance. Requires gcloud with container.clusters.get; the cluster comes from GKE_CLUSTER and GKE_LOCATION (optional GKE_PROJECT, else the gcloud default project). Every node pool is checked.

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

out=$(gcloud container node-pools list --cluster "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(name,management.autoRepair)') || exit 1
bad=$(printf '%s\n' "$out" | awk -F '\t' 'NF && !($2=="True") {print $1 ": " $2}')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad"; fi

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Enable node auto-repair for any GKE node pool where the audit result is not true. This allows GKE to monitor nodes in the node pool and automatically repair nodes that fail health checks for an extended period. gcloud container node-pools update $POOL_NAME \ --cluster=$CLUSTER_NAME \ --location=$LOCATION \ --project=$PROJECT_ID \ --enable-autorepair After remediation, rerun the audit command and confirm that management.autoRepair returns true. If multiple node pools are present, repeat the audit and remediation for each applicable node pool.

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: gkemanaged-services
Referans: CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 5.5.2 Verify node auto-repair is enabled for GKE node pools

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target gke --level 2