Detections
Analytics

5.10.1 Do not use GKE alpha clusters for production workloads

Information

Do not use GKE alpha clusters for production workloads. Alpha clusters are intended only for short lived testing of Kubernetes alpha APIs and features, and they are not covered by the GKE SLA.

Alpha clusters enable Kubernetes alpha APIs and feature gates so teams can experiment with functionality that is not production ready. They are not appropriate for production because they cannot be upgraded, cannot be enrolled in a release channel, do not receive security updates, and are automatically deleted after 30 days. GKE also does not automatically save data stored on alpha clusters before deletion.

Solution

Alpha cluster behavior is selected at cluster creation and should not be used for production workloads. To remediate a production workload running on an alpha cluster, create a supported non alpha GKE cluster, migrate workloads and required data, validate application health, and decommission the alpha cluster. Alpha clusters expire after 30 days, do not receive security updates, cannot be upgraded, and are not covered by the GKE SLA.

gcloud container clusters create $CLUSTER_NAME \\
 --location $LOCATION \\
 --project $PROJECT_ID

Do not include the --enable-kubernetes-alpha flag when creating the replacement production cluster. If alpha features are needed for testing, use a separate nonproduction alpha cluster and migrate any required data before the 30 day expiration window.

Impact:

Production workloads must use supported GKE clusters instead of alpha clusters. Teams that need alpha capabilities should isolate testing in nonproduction environments, avoid storing durable data there, plan for the 30 day deletion window, and migrate any test artifacts or findings before the alpha cluster expires.

See Also

https://workbench.cisecurity.org/benchmarks/24956

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7, CSCv7|18.9

Plugin: GCP

Control ID: 9f6f92eea654c5baa0847cf962e91a119bdbba67e2740858fe924a551e5f35ee