Enroll GKE clusters in release channels for automated version management

ThấpCấp 1Tự độnggke

Mô tả

Enroll GKE clusters in an appropriate release channel to automate version management and align cluster upgrades with the organization’s required balance of feature availability, upgrade predictability, and production stability. Release channels let teams choose how quickly clusters receive supported Kubernetes versions, patches, security fixes, and GKE updates without manually selecting every version. Requires gcloud with container.clusters.get; the cluster comes from GKE_CLUSTER and GKE_LOCATION (optional GKE_PROJECT, else the gcloud default project).

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

v=$(gcloud container clusters describe "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(releaseChannel.channel)') || exit 1
if case "$v" in REGULAR|STABLE) true;; *) false;; esac; then echo compliant; else echo "noncompliant: releaseChannel.channel=$v"; fi

Đầu ra mong đợi: compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Enroll the existing GKE cluster in an approved release channel rather than recreating the cluster. Use regular or stable unless the organization has approved another channel for a documented use case. Before changing the release channel, confirm that the cluster control plane version is available in the target channel and configure maintenance windows or exclusions if upgrade timing needs to be controlled. gcloud container clusters update $CLUSTER_NAME \ --location=$LOCATION \ --project=$PROJECT_ID \ --release-channel=$RELEASE_CHANNEL After remediation, rerun the audit command and verify that .releaseChannel.channel returns the approved channel. For clusters enrolled in a release channel, node auto-upgrade is managed as part of the GKE release channel upgrade process, so maintenance policies should be reviewed to reduce workload disruption during automatic upgrades.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: gkemanaged-services
Tham chiếu: CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 5.5.4 Enroll GKE clusters in release channels for automated version management

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target gke