Ensure Container-Optimized OS Is Used For GKE Node Images

Manual Steps

List all node pools and their image types
Run on any machine with gcloud configured:

PROJECT_ID="<YOUR_PROJECT_ID>"
LOCATION="<CLUSTER_LOCATION>"
CLUSTER_NAME="<CLUSTER_NAME>"

gcloud container node-pools list \
  --cluster "${CLUSTER_NAME}" \
  --location "${LOCATION}" \
  --project "${PROJECT_ID}" \
  --format="table(name,config.imageType)"

Identify non‑compliant node pools
From the output, note any node pool where config.imageType is not COS_CONTAINERD (e.g. UBUNTU, UBUNTU_CONTAINERD, COS) for further review.
Assess workload and feature compatibility before changing images
For each non‑COS_CONTAINERD node pool:
- Confirm workloads don’t rely on OS‑specific packages, custom agents, or kernel modules only present on the current image.
- Confirm any node‑level DaemonSets (monitoring, logging, security agents) support cos_containerd.
- If unsure, create or use a test cluster/node pool with cos_containerd and validate workloads there first.
Plan and execute node pool image migration
For each node pool you decide to migrate, run on any machine with gcloud configured:
PROJECT_ID="<YOUR_PROJECT_ID>" LOCATION="<CLUSTER_LOCATION>" CLUSTER_NAME="<CLUSTER_NAME>" NODE_POOL_NAME="<NODE_POOL_NAME>" gcloud container clusters upgrade "${CLUSTER_NAME}" \ --location "${LOCATION}" \ --node-pool "${NODE_POOL_NAME}" \ --image-type "COS_CONTAINERD" \ --project "${PROJECT_ID}"
This recreates nodes in that pool with the new image and will cause pod evictions and rescheduling; perform during a maintenance window and ensure PodDisruptionBudgets and autoscaling are configured appropriately.

Verify node pool image types after upgrade
Re‑run, on any machine with gcloud configured:

gcloud container node-pools list \
  --cluster "${CLUSTER_NAME}" \
  --location "${LOCATION}" \
  --project "${PROJECT_ID}" \
  --format="table(name,config.imageType)"

Confirm all intended node pools now show COS_CONTAINERD as config.imageType.

Spot‑check via the original audit command
Optionally, for each node pool, run:

NODE_POOL_NAME="<NODE_POOL_NAME>"

gcloud container node-pools describe "${NODE_POOL_NAME}" \
  --cluster "${CLUSTER_NAME}" \
  --location "${LOCATION}" \
  --project "${PROJECT_ID}" \
  --format json | jq '.config.imageType'

Ensure the value returned is "COS_CONTAINERD" for compliant node pools.

Using kubectl

kubectl cannot modify the node image type or node pool configuration; this setting is managed at the GKE control-plane / cloud-provider level (gcloud, console, or IaC). To address this finding, follow the guidance in the Manual Steps section using the appropriate GCP tools.

Automation

#!/usr/bin/env bash
#
# Report GKE node pool image types and flag any that are NOT cos_containerd.
# Run on: any machine with gcloud, jq, and access to the GCP project(s).
#
# Usage:
#   PROJECT_ID=my-project \
#   gcloud config set project "${PROJECT_ID}"
#   ./check_gke_nodepool_images.sh
#
# Optional env vars:
#   PROJECT_ID   – if unset, uses current gcloud config project
#   LOCATION     – if set, limits to this region/zone (e.g. us-central1, us-central1-a)

set -euo pipefail

PROJECT_ID="${PROJECT_ID:-$(gcloud config get-value project 2>/dev/null)}"
if [[ -z "${PROJECT_ID}" || "${PROJECT_ID}" == "(unset)" ]]; then
  echo "ERROR: PROJECT_ID not set and no default project in gcloud config." >&2
  exit 1
fi

LOCATION_FILTER=""
if [[ -n "${LOCATION:-}" ]]; then
  LOCATION_FILTER="--locations=${LOCATION}"
fi

echo "Project: ${PROJECT_ID}"
echo "Location filter: ${LOCATION:-<all locations>}"
echo

# List all clusters (regional and zonal)
clusters_json="$(gcloud container clusters list \
  --project "${PROJECT_ID}" \
  ${LOCATION_FILTER} \
  --format=json)"

if [[ "$(echo "${clusters_json}" | jq 'length')" -eq 0 ]]; then
  echo "No GKE clusters found in project ${PROJECT_ID} (with given location filter)."
  exit 0
fi

bad_found=0

echo "Cluster,nodePool,location,imageType,COMPLIANT"
echo "${clusters_json}" | jq -r '.[] | [.name, .location] | @tsv' | while IFS=$'\t' read -r CLUSTER LOCATION_VAL; do
  # List node pools for each cluster
  np_json="$(gcloud container node-pools list \
    --cluster "${CLUSTER}" \
    --location "${LOCATION_VAL}" \
    --project "${PROJECT_ID}" \
    --format=json)"

  if [[ "$(echo "${np_json}" | jq 'length')" -eq 0 ]]; then
    # Cluster with no node pools (unusual but handle it)
    echo "${CLUSTER},<none>,${LOCATION_VAL},<none>,NON_COMPLIANT"
    bad_found=1
    continue
  fi

  echo "${np_json}" | jq -r '.[] | [.name, .config.imageType] | @tsv' | \
  while IFS=$'\t' read -r NP_NAME IMAGE_TYPE; do
    if [[ "${IMAGE_TYPE}" == "cos_containerd" ]]; then
      echo "${CLUSTER},${NP_NAME},${LOCATION_VAL},${IMAGE_TYPE},COMPLIANT"
    else
      echo "${CLUSTER},${NP_NAME},${LOCATION_VAL},${IMAGE_TYPE},NON_COMPLIANT"
      bad_found=1
    fi
  done
done

# Explanation of output:
cat <<'EOF'

Interpretation:
- Each line after the headers is:
  Cluster,nodePool,location,imageType,COMPLIANT
- COMPLIANT      – imageType == cos_containerd
- NON_COMPLIANT  – imageType is anything else (e.g. UBUNTU, COS, UBUNTU_CONTAINERD)

Node pools marked NON_COMPLIANT are the ones that need manual review and
a potential upgrade, for example:
  gcloud container clusters upgrade <cluster_name> \
    --image-type cos_containerd \
    --location <location> \
    --node-pool <node_pool_name>
EOF

GCP Introduction

GCP Pricing

GCP Threats

GCP Misconfigurations

Resources

GCP Threats

Ensure Container-Optimized OS Is Used For GKE Node Images

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation