Alpha Clusters Are Not Used For Production Workloads

More Info:

Do not run production workloads on alpha clusters, which enable unsupported features, lack SLAs, and cannot be upgraded. Use standard clusters for production.

Risk Level

Low

Address

Security

Compliance Standards

CIS GKE

Triage and Remediation

Remediation

Remediation

Manual Steps

Identify alpha clusters

Run on any machine with gcloud configured:

PROJECT_ID="<your-project-id>"

gcloud container clusters list --project "$PROJECT_ID" \
  --format="table(name,location,STATUS:label=STATUS,endpoint)"

For each cluster, check whether it has alpha enabled:

CLUSTER_NAME="<cluster-name>"
LOCATION="<cluster-location>"

gcloud container clusters describe "$CLUSTER_NAME" \
  --location "$LOCATION" \
  --project "$PROJECT_ID" \
  --format=json | jq '.enableKubernetesAlpha'

Record clusters where this value is true.

Determine whether the alpha cluster is used for production

For each cluster with .enableKubernetesAlpha == true, collect workload and usage evidence (from any machine with gcloud and, if desired, kubectl):

# List node pools and sizes
gcloud container node-pools list \
  --cluster "$CLUSTER_NAME" \
  --location "$LOCATION" \
  --project "$PROJECT_ID"

# If you have kubectl context for this cluster:
kubectl config use-context "gke_${PROJECT_ID}_${LOCATION}_${CLUSTER_NAME}"

# List namespaces and workloads
kubectl get ns
kubectl get deploy,statefulset,daemonset -A
kubectl get svc -A

Review: namespaces, workload names, labels/annotations, SLAs, and whether this cluster serves any production traffic or critical systems.

Decide the disposition for each alpha cluster
- For each alpha cluster flagged as production or unclear, decide one of:
  - Not production → keep as non-production (e.g., explicitly mark as dev/test) and ensure no production workloads are scheduled there.
  - Production or mixed → plan to migrate all production workloads to a non-alpha cluster and then decommission the alpha cluster.
- Document the decision, business owner, and target timeline.

Provision or identify a non‑alpha replacement cluster (if needed)

If you need a new cluster for production workloads, create it without enabling alpha (run on any machine with gcloud):

PROJECT_ID="<your-project-id>"
LOCATION="<region-or-zone>"
CLUSTER_NAME="<new-non-alpha-cluster-name>"

gcloud container clusters create "$CLUSTER_NAME" \
  --location "$LOCATION" \
  --project "$PROJECT_ID"

Confirm alpha is disabled:

gcloud container clusters describe "$CLUSTER_NAME" \
  --location "$LOCATION" \
  --project "$PROJECT_ID" \
  --format=json | jq '.enableKubernetesAlpha'
# Expect: false

Migrate production workloads off alpha clusters

From any machine with kubectl access to both clusters, export manifests from the alpha cluster and apply them to the non‑alpha cluster, adapting as needed:

# Source (alpha) context
kubectl config use-context "gke_${PROJECT_ID}_${LOCATION}_${ALPHA_CLUSTER_NAME}"

# Example: export workloads from a namespace
NAMESPACE="<prod-namespace>"
kubectl get all -n "$NAMESPACE" -o yaml > "${NAMESPACE}-workloads.yaml"

# Target (non-alpha) context
kubectl config use-context "gke_${PROJECT_ID}_${LOCATION}_${NEW_CLUSTER_NAME}"
kubectl create namespace "$NAMESPACE" || true
kubectl apply -f "${NAMESPACE}-workloads.yaml" -n "$NAMESPACE"

Update DNS, load balancers, and client configuration as needed to point to the new cluster, and validate application behavior and traffic.

Decommission or reclassify alpha clusters and verify

If the alpha cluster is no longer needed for production (ideally no workloads remain, or it is explicitly dev/test), either delete it or document its non‑production role:
```
# To delete (irreversible)
gcloud container clusters delete "$CLUSTER_NAME" \
  --location "$LOCATION" \
  --project "$PROJECT_ID"
```

Re-run the audit for all remaining clusters to confirm compliance (any alpha clusters must now be clearly non‑production):

PROJECT_ID="<your-project-id>"

for row in $(gcloud container clusters list --project "$PROJECT_ID" \
             --format="value(name,location)" | tr ' ' ','); do
  CLUSTER_NAME="${row%,*}"
  LOCATION="${row#*,}"
  echo "Cluster: $CLUSTER_NAME ($LOCATION)"
  gcloud container clusters describe "$CLUSTER_NAME" \
    --location "$LOCATION" \
    --project "$PROJECT_ID" \
    --format=json | jq '.enableKubernetesAlpha'
done

Ensure any cluster with .enableKubernetesAlpha == true is documented and treated as non‑production; no production workloads should remain on such clusters.

Using kubectl

kubectl cannot change whether a GKE cluster was created with --enable-kubernetes-alpha; that setting is part of the managed control-plane configuration in GCP (console/CLI/IaC), not a Kubernetes API object. To address this finding, follow the guidance in the Manual Steps section using the Google Cloud Console, gcloud, or your IaC definitions.

Automation

#!/usr/bin/env bash
# Report GKE clusters that have Kubernetes Alpha enabled.
# Requirements:
#   - gcloud CLI configured and authenticated
#   - jq installed

set -euo pipefail

# Optional: limit to specific projects by setting PROJECTS env var as a
# space-separated list, e.g.:
#   PROJECTS="proj-a proj-b"
if [[ -n "${PROJECTS:-}" ]]; then
  projects=$PROJECTS
else
  projects=$(gcloud projects list --format="value(projectId)")
fi

echo "project,location,cluster,enableKubernetesAlpha"

for project in $projects; do
  # List all GKE clusters (both zonal and regional) in the project
  while IFS= read -r cluster_uri; do
    # cluster_uri format:
    # //container.googleapis.com/projects/PROJECT/locations/LOCATION/clusters/CLUSTER_NAME
    location=$(printf '%s\n' "$cluster_uri" | awk -F/ '{print $(NF-3)}')
    cluster_name=$(printf '%s\n' "$cluster_uri" | awk -F/ '{print $NF}')

    alpha_enabled=$(
      gcloud container clusters describe "$cluster_name" \
        --location "$location" \
        --project "$project" \
        --format="value(enableKubernetesAlpha)" 2>/dev/null || echo "ERROR"
    )

    echo "$project,$location,$cluster_name,$alpha_enabled"
  done < <(
    gcloud container clusters list \
      --project "$project" \
      --format="value(selfLink)" 2>/dev/null || true
  )
done

How to run (from any machine with gcloud access)

chmod +x report_gke_alpha_clusters.sh
./report_gke_alpha_clusters.sh > gke_alpha_report.csv

How to interpret the output

The script prints a CSV with columns: project,location,cluster,enableKubernetesAlpha.
Any row where enableKubernetesAlpha is true indicates a cluster created with Kubernetes Alpha enabled.
Such clusters must be treated as non‑production. If they currently host production workloads, this violates the control and requires architectural and migration review, not an in-place automated fix.

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​