Detections
Analytics

5.5.3 Verify node auto-upgrade is enabled for GKE node pools

Information

Verify node auto-upgrade is enabled for GKE node pools so nodes receive supported Kubernetes versions, node image updates, and security fixes through the managed upgrade process. Node auto-upgrade is enabled by default for new GKE node pools, but it should still be reviewed for older node pools.

Node auto-upgrade helps keep node pools aligned with supported GKE versions and current node image updates without requiring manual upgrade coordination for every patch or security release. When enabled, GKE automatically schedules eligible node pools for upgrade as new auto-upgrade targets become available, while considering release channel behavior, maintenance policies, and other upgrade constraints.

From a security and reliability perspective, keeping node auto-upgrade enabled reduces the risk of running outdated node software, unsupported Kubernetes versions, or node images that are missing important fixes. It also helps keep nodes compatible with the upgraded control plane, because GKE nodes must run the same or an earlier version than the control plane.

Solution

Enable node auto-upgrade for any GKE node pool where the audit result is not true. This allows GKE to automatically schedule eligible node pools for upgrades when upgrade targets become available, subject to maintenance windows, maintenance exclusions, release channel behavior, and upgrade rollout constraints.

gcloud container node-pools update $POOL_NAME \\
 --cluster $CLUSTER_NAME \\
 --location $LOCATION \\
 --project $PROJECT_ID \\
 --enable-autoupgrade

After remediation, rerun the audit command and confirm that management.autoUpgrade returns true . If multiple node pools are present, repeat the audit and remediation for each applicable node pool.

Impact:

Enabling node auto-upgrade does not immediately upgrade nodes. Automatic upgrades are scheduled by GKE and can be influenced by maintenance windows, maintenance exclusions, release channel behavior, and upgrade rollout constraints. During a node pool upgrade, workloads might be rescheduled as nodes are recreated, so production workloads should use appropriate replicas, PodDisruptionBudgets, surge or blue green upgrade strategies, and maintenance policies to reduce disruption.

See Also

https://workbench.cisecurity.org/benchmarks/24956

Item Details

Category: RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|RA-5, 800-53|SI-2, 800-53|SI-2(2), CSCv7|2.2, CSCv7|3.4, CSCv7|3.5

Plugin: GCP

Control ID: 08f133393b98f6da6e60017515d86e6dfdfc4f6f543c5dff7ac51142ad6a4d7d