TMA-GKE-5.5.3
Verify node auto-upgrade is enabled for GKE node pools
Mô tả
Verify node auto-upgrade is enabled for GKE node pools so nodes receive supported Kubernetes versions, node image updates, and security fixes through the managed upgrade process. Node auto-upgrade is enabled by default for new GKE node pools, but it should still be reviewed for older node pools. Requires gcloud with container.clusters.get; the cluster comes from GKE_CLUSTER and GKE_LOCATION (optional GKE_PROJECT, else the gcloud default project). Every node pool is checked.
Cách kiểm tra
Phương pháp kiểm tra: Lệnh shell
out=$(gcloud container node-pools list --cluster "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(name,management.autoUpgrade)') || exit 1
bad=$(printf '%s\n' "$out" | awk -F '\t' 'NF && !($2=="True") {print $1 ": " $2}')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad"; fi- Đầu ra mong đợi
compliant
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
Enable node auto-upgrade for any GKE node pool where the audit result is not true. This allows GKE to automatically schedule eligible node pools for upgrades when upgrade targets become available, subject to maintenance windows, maintenance exclusions, release channel behavior, and upgrade rollout constraints. gcloud container node-pools update $POOL_NAME \ --cluster $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --enable-autoupgrade After remediation, rerun the audit command and confirm that management.autoUpgrade returns true. If multiple node pools are present, repeat the audit and remediation for each applicable node pool.
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- gkemanaged-services
- Tham chiếu
- CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 5.5.3 Verify node auto-upgrade is enabled for GKE node pools
Kiểm tra máy này
Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.
tmaegis scan --target gke --level 2