Detections
Analytics

5.10.2 Ensure that Alpha clusters are not used for production workloads

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Alpha clusters are not covered by an SLA and are not production-ready.

Alpha clusters are designed for early adopters to experiment with workloads that take advantage of new features before those features are production-ready. They have all Kubernetes API features enabled, but are not covered by the GKE SLA, do not receive security updates, have node auto-upgrade and node auto-repair disabled, and cannot be upgraded. They are also automatically deleted after 30 days.

Solution

Alpha features cannot be disabled. To remediate, a new cluster must be created.

Using Google Cloud Console

 - Go to Kubernetes Engine by visiting https://console.cloud.google.com/kubernetes/
 - Click CREATE CLUSTER, and choose "SWITCH TO STANDARD CLUSTER" in the upper right corner of the screen.
 - Under Features in the the CLUSTER section, "Enable Kubernetes alpha features in this cluster" will not be available by default and to use Kubernetes alpha features in this cluster, first disable release channels.
Note: It will only be available if the cluster is created with a Static version for the Control plane version, along with both Automatically upgrade nodes to the next available version and Enable auto-repair being checked under the Node pool details for each node.
 - Configure the other settings as required and click CREATE.

Using Command Line:

Upon creating a new cluster

gcloud container clusters create <cluster name> --location <location>

Do not use the --enable-kubernetes-alpha argument.

Impact:

Users and workloads will not be able to take advantage of features included within Alpha clusters.

See Also

https://workbench.cisecurity.org/benchmarks/24112

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7, CSCv7|18.9

Plugin: GCP

Control ID: 1e04f16373ddac7cd98a1cc16e16b2f22e29c1a18103e61b74728cef4a5eb9ff