Detections
Analytics

5.5.2 Verify node auto-repair is enabled for GKE node pools

Information

Verify node auto-repair is enabled for GKE node pools so unhealthy nodes are automatically repaired and returned to a healthy running state. Node auto-repair is enabled by default for new node pools, but for older node pools should still be reviewed for compliance.

Node auto-repair helps maintain cluster reliability by periodically checking node health and initiating repair when a node remains unhealthy for an extended period. When repair is triggered, GKE drains and re-creates the affected node, helping reduce the risk of workloads remaining scheduled on degraded or nonfunctional infrastructure.

Keeping auto-repair enabled reduces the need for manual node recovery and helps ensure that node level failures are remediated consistently across node pools. This is especially important for production clusters where unhealthy nodes can affect workload availability, scheduling capacity, and operational response time.

Solution

Enable node auto-repair for any GKE node pool where the audit result is not true. This allows GKE to monitor nodes in the node pool and automatically repair nodes that fail health checks for an extended period.

gcloud container node-pools update $POOL_NAME \\
 --cluster=$CLUSTER_NAME \\
 --location=$LOCATION \\
 --project=$PROJECT_ID \\
 --enable-autorepair

After remediation, rerun the audit command and confirm that management.autoRepair returns true . If multiple node pools are present, repeat the audit and remediation for each applicable node pool.

Impact:

If node auto-repair is triggered, workloads on the affected node can be disrupted while GKE drains and re-creates the node. If multiple nodes require repair, GKE might repair nodes in parallel, with repair concurrency based on cluster size and the number of unhealthy nodes. Workloads should use appropriate replica counts, disruption budgets, and scheduling practices to tolerate node replacement events.

See Also

https://workbench.cisecurity.org/benchmarks/24956

Item Details

Category: RISK ASSESSMENT

References: 800-53|RA-5, CSCv7|3.1

Plugin: GCP

Control ID: 31a6a97b5f53e334999fc2640b064a53dd9d6fc6b2daa3a2e5a83a7c15abbc1e