Upgrades And Updates Should Be Enabled
More Info:
GKE cluster should be proactively receive updates about GKE upgrades and GKE versionsRisk Level
LowAddress
Security, Reliability, Operational Excellence, Performance EfficiencyCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “Upgrades and Updates Should Be Enabled” in GCP, follow the steps below:
- Open the GCP console and navigate to the project that has the misconfiguration.
- Click on the hamburger menu on the top left corner and select “Compute Engine”.
- Click on “VM instances” to view all the virtual machine instances in the project.
- For each virtual machine instance, click on the instance name to view its details.
- Click on the “Edit” button at the top of the page.
- Scroll down to the “Management” section and check the box next to “Automatic restart”.
- Check the box next to “Enable guest environment”.
- Under “OS patch management”, select “On” for “Enable OS patch management”.
- Click on “Save” to apply the changes.
Using CLI
Using CLI
To remediate the misconfiguration “Upgrades and Updates Should Be Enabled” for GCP using GCP CLI, you can follow the below steps:This command should return This command should return
- Open the Cloud Shell by clicking on the icon in the top right corner of the GCP console.
- Run the following command to enable automatic updates for all the VM instances in your project:
- Verify that the metadata is added to the project by running the following command:
true, indicating that automatic updates are enabled.- If you have existing instances that were created before enabling automatic updates, you can manually enable automatic updates on those instances by following these steps:
- Stop the instance
- Edit the instance settings
- Add the following metadata key-value pair:
enable-osconfig:true - Start the instance
- Verify that automatic updates are enabled on the instance by running the following command:
true, indicating that automatic updates are enabled on the instance.By following these steps, you can remediate the misconfiguration “Upgrades and Updates Should Be Enabled” for GCP using GCP CLI.Using Python
Using Python
To remediate the misconfiguration “Upgrades and Updates Should Be Enabled” in GCP using Python, follow the below steps:This code will enable automatic restarts, migrate instances on host maintenance, and enable virtio-rng for all the instances in the specified project and zone.Note: Make sure you have the required permissions to update instances in the specified project and zone.
- Import the required libraries:
- Set up the client:
- Retrieve the instance(s) for which you want to enable upgrades and updates:
- Iterate through the instances and update the instance(s) to enable upgrades and updates: