> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Container-Optimized OS Should Be Enabled

### More Info:

Ensures all Kubernetes cluster nodes have Container-Optimized OS enabled. Container-Optimized OS is optimized to enhance node security. It is backed by a team at Google that can quickly patch it.

### Risk Level

Medium

### Address

Security

### Compliance Standards

CISGKE

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of "Container-Optimized OS Should Be Enabled" in GCP, you can follow the below steps using the GCP console:

        1. Open the GCP Console and go to the Compute Engine page.
        2. Select the instance for which you want to enable Container-Optimized OS.
        3. Click on the "Edit" button on the top of the page.
        4. Scroll down to the "Cloud API access scopes" section.
        5. Expand the "Compute Engine default service account" section.
        6. Click on the "Set access for each API" button.
        7. In the "Compute Engine" section, select the "Read Write" access level.
        8. Click on the "Save" button to save the changes.
        9. Scroll up to the "Boot disk" section.
        10. Click on the "Change" button.
        11. In the "Operating system" section, select "Container-Optimized OS".
        12. Click on the "Select" button to save the changes.
        13. Click on the "Save" button to apply the changes to the instance.

        Once the above steps are completed, the Container-Optimized OS will be enabled for the selected instance.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To enable Container-Optimized OS on GCP using GCP CLI, follow these steps:

        1. Open the Cloud Shell on the GCP Console.
        2. Run the following command to enable the Container-Optimized OS:

        ```
        gcloud compute instances create [INSTANCE_NAME] \
        --image-project cos-cloud \
        --image-family cos-stable \
        --boot-disk-size [DISK_SIZE] \
        --boot-disk-type pd-standard \
        --boot-disk-device-name [DEVICE_NAME]
        ```

        Replace \[INSTANCE\_NAME] with the name of the instance that you want to enable Container-Optimized OS on, \[DISK\_SIZE] with the size of the boot disk in GB, and \[DEVICE\_NAME] with the name of the boot disk device.

        3. Once the instance is created, SSH into the instance and verify that Container-Optimized OS is enabled by running the following command:

        ```
        cat /etc/os-release
        ```

        This command should output information about the OS, including the line "ID=cos".

        That's it! Container-Optimized OS is now enabled on your GCP instance.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of "Container-Optimized OS Should Be Enabled" in GCP using Python, you can follow the below steps:

        1. Import the necessary libraries:

        ```
        from googleapiclient.discovery import build
        from google.oauth2 import service_account
        ```

        2. Set the project ID and the service account credentials:

        ```
        project_id = "<PROJECT_ID>"
        credentials = service_account.Credentials.from_service_account_file('<SERVICE_ACCOUNT_KEY_FILE_PATH>')
        ```

        3. Build the GCP Compute Engine API client:

        ```
        compute_client = build('compute', 'v1', credentials=credentials)
        ```

        4. Get the list of instances in the project:

        ```
        instances = compute_client.instances().list(project=project_id, zone='<ZONE>').execute()
        ```

        5. Loop through the instances and check if the Container-Optimized OS is enabled:

        ```
        for instance in instances['items']:
            instance_name = instance['name']
            instance_id = instance['id']
            instance_zone = instance['zone'].split('/')[-1]
            
            # Get the instance metadata
            metadata = compute_client.instances().get(project=project_id, zone=instance_zone, instance=instance_name).execute()['metadata']['items']
            
            # Check if Container-Optimized OS is enabled
            cos_enabled = False
            for item in metadata:
                if item['key'] == 'google-container-os':
                    if item['value'] == 'true':
                        cos_enabled = True
                        break
            
            # If Container-Optimized OS is not enabled, enable it
            if not cos_enabled:
                metadata.append({
                    'key': 'google-container-os',
                    'value': 'true'
                })
                compute_client.instances().update(project=project_id, zone=instance_zone, instance=instance_name, body={
                    'metadata': {
                        'items': metadata
                    }
                }).execute()
                print(f"Container-Optimized OS enabled for instance {instance_name} (ID: {instance_id}) in zone {instance_zone}")
            else:
                print(f"Container-Optimized OS already enabled for instance {instance_name} (ID: {instance_id}) in zone {instance_zone}")
        ```

        This code will check all the instances in the specified zone of the project and enable the Container-Optimized OS if it is not already enabled.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://cloud.google.com/container-optimized-os/](https://cloud.google.com/container-optimized-os/)
* [https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster](https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster)