Ensure Node Auto-Upgrade Is Enabled For GKE Nodes

#!/usr/bin/env bash
# Report GKE node auto-upgrade status for all node pools in all clusters in a project.
# Runs with: any machine that has gcloud, jq, and appropriate IAM permissions.

set -euo pipefail

PROJECT_ID="YOUR_PROJECT_ID_HERE"

if [[ "$PROJECT_ID" == "YOUR_PROJECT_ID_HERE" ]]; then
  echo "ERROR: Set PROJECT_ID at the top of this script."
  exit 1
fi

echo "Project: $PROJECT_ID"
echo

# List all clusters (regional and zonal)
gcloud container clusters list \
  --project "$PROJECT_ID" \
  --format='value(name,location)' |
while read -r CLUSTER LOCATION; do
  if [[ -z "$CLUSTER" ]]; then
    continue
  fi

  echo "Cluster: $CLUSTER  (location: $LOCATION)"

  # List all node pools for this cluster
  gcloud container node-pools list \
    --cluster "$CLUSTER" \
    --location "$LOCATION" \
    --project "$PROJECT_ID" \
    --format='value(name)' |
  while read -r POOL; do
    if [[ -z "$POOL" ]]; then
      continue
    fi

    # Describe management settings and extract autoUpgrade flag
    MGMT_JSON=$(gcloud container node-pools describe "$POOL" \
      --cluster "$CLUSTER" \
      --location "$LOCATION" \
      --project "$PROJECT_ID" \
      --format=json | jq -r '.management')

    AUTO_UPGRADE=$(printf '%s\n' "$MGMT_JSON" | jq -r '.autoUpgrade')

    # Normalize missing field to "false"
    if [[ "$AUTO_UPGRADE" != "true" ]]; then
      AUTO_UPGRADE="false"
    fi

    # Mark non-compliant pools clearly
    if [[ "$AUTO_UPGRADE" == "true" ]]; then
      STATUS="OK"
    else
      STATUS="NON_COMPLIANT"
    fi

    echo "  Node pool: $POOL"
    echo "    management: $MGMT_JSON"
    echo "    autoUpgrade: $AUTO_UPGRADE  <-- $STATUS"
  done

  echo
done