Skip to main content

More Info:

Ensures all Kubernetes cluster nodes have automatic upgrades enabled. Enabling automatic upgrades on nodes ensures that each node stays current with the latest version of the master branch, also ensuring that the latest security patches are installed to provide the most secure environment.

Risk Level

Low

Address

Security, Reliability

Compliance Standards

HITRUST, SOC2, NISTCSF, PCIDSS

Triage and Remediation

Remediation

Using Console

To remediate the misconfiguration “Automatic Node Upgrades Should Be Enabled” for GCP using GCP console, you can follow the below steps:
  1. Open the Google Kubernetes Engine (GKE) console.
  2. Select the cluster for which you want to enable automatic node upgrades.
  3. Click on the “Edit” button at the top of the page.
  4. Scroll down to the “Node Pools” section and click on the “Default pool” or the pool for which you want to enable automatic node upgrades.
  5. Under the “Auto-upgrade” section, select the checkbox next to “Enable auto-upgrade”.
  6. Choose the desired maintenance window during which automatic node upgrades should be performed.
  7. Click on the “Save” button at the bottom of the page to save the changes.
Once you have followed these steps, automatic node upgrades will be enabled for the selected node pool. This will ensure that your nodes are always up-to-date with the latest security patches and bug fixes.

To remediate the misconfiguration “Automatic Node Upgrades Should Be Enabled” in GCP using GCP CLI, follow the below steps:
  1. Open the terminal and login to your GCP account using the command:
  2. Set the project in which you want to enable automatic node upgrades using the command:
    Replace PROJECT_ID with your GCP project ID.
  3. Enable automatic node upgrades for the node pool using the command:
    Replace NODE_POOL_NAME with the name of the node pool for which you want to enable automatic node upgrades, and replace CLUSTER_NAME with the name of the cluster in which the node pool is present.
  4. Verify that automatic node upgrades are enabled for the node pool using the command:
    This command will return the status of automatic node upgrades for the specified node pool.
By following the above steps, you can remediate the misconfiguration “Automatic Node Upgrades Should Be Enabled” in GCP using GCP CLI.
To remediate the automatic node upgrades misconfiguration on GCP using Python, you can follow the below steps:
  1. Import the necessary libraries:
  1. Set up the credentials:
  1. Create a container client:
  1. Get the current cluster configuration:
  1. Check if automatic node upgrades are enabled:
  1. Run the Python script to enable automatic node upgrades.
Note: Make sure to replace the path/to/your/credentials.json, your-project-id, your-zone, and your-cluster-id with the appropriate values for your GCP environment.

Additional Reading: