> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure That Alpha Clusters Are Not Used For Production Workloads

### More Info:

Do not run production workloads on alpha clusters, which enable unsupported features, lack SLAs, and cannot be upgraded. Use standard clusters for production.

### Risk Level

Low

### Address

Security

### Compliance Standards

* CIS GKE

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. **Identify alpha clusters**
           * Run on any machine with `gcloud` configured:
             ```bash theme={null}
             PROJECT_ID="<your-project-id>"

             gcloud container clusters list --project "$PROJECT_ID" \
               --format="table(name,location,STATUS:label=STATUS,endpoint)"
             ```
           * For each cluster, check whether it has alpha enabled:
             ```bash theme={null}
             CLUSTER_NAME="<cluster-name>"
             LOCATION="<cluster-location>"

             gcloud container clusters describe "$CLUSTER_NAME" \
               --location "$LOCATION" \
               --project "$PROJECT_ID" \
               --format=json | jq '.enableKubernetesAlpha'
             ```
           * Record clusters where this value is `true`.

        2. **Determine whether the alpha cluster is used for production**
           * For each cluster with `.enableKubernetesAlpha == true`, collect workload and usage evidence (from any machine with `gcloud` and, if desired, `kubectl`):
             ```bash theme={null}
             # List node pools and sizes
             gcloud container node-pools list \
               --cluster "$CLUSTER_NAME" \
               --location "$LOCATION" \
               --project "$PROJECT_ID"

             # If you have kubectl context for this cluster:
             kubectl config use-context "gke_${PROJECT_ID}_${LOCATION}_${CLUSTER_NAME}"

             # List namespaces and workloads
             kubectl get ns
             kubectl get deploy,statefulset,daemonset -A
             kubectl get svc -A
             ```
           * Review: namespaces, workload names, labels/annotations, SLAs, and whether this cluster serves any production traffic or critical systems.

        3. **Decide the disposition for each alpha cluster**
           * For each alpha cluster flagged as production or unclear, decide one of:
             * **Not production** → keep as non-production (e.g., explicitly mark as dev/test) and ensure no production workloads are scheduled there.
             * **Production or mixed** → plan to **migrate** all production workloads to a non-alpha cluster and then decommission the alpha cluster.
           * Document the decision, business owner, and target timeline.

        4. **Provision or identify a non‑alpha replacement cluster (if needed)**
           * If you need a new cluster for production workloads, create it without enabling alpha (run on any machine with `gcloud`):
             ```bash theme={null}
             PROJECT_ID="<your-project-id>"
             LOCATION="<region-or-zone>"
             CLUSTER_NAME="<new-non-alpha-cluster-name>"

             gcloud container clusters create "$CLUSTER_NAME" \
               --location "$LOCATION" \
               --project "$PROJECT_ID"
             ```
           * Confirm alpha is disabled:
             ```bash theme={null}
             gcloud container clusters describe "$CLUSTER_NAME" \
               --location "$LOCATION" \
               --project "$PROJECT_ID" \
               --format=json | jq '.enableKubernetesAlpha'
             # Expect: false
             ```

        5. **Migrate production workloads off alpha clusters**
           * From any machine with `kubectl` access to both clusters, export manifests from the alpha cluster and apply them to the non‑alpha cluster, adapting as needed:
             ```bash theme={null}
             # Source (alpha) context
             kubectl config use-context "gke_${PROJECT_ID}_${LOCATION}_${ALPHA_CLUSTER_NAME}"

             # Example: export workloads from a namespace
             NAMESPACE="<prod-namespace>"
             kubectl get all -n "$NAMESPACE" -o yaml > "${NAMESPACE}-workloads.yaml"

             # Target (non-alpha) context
             kubectl config use-context "gke_${PROJECT_ID}_${LOCATION}_${NEW_CLUSTER_NAME}"
             kubectl create namespace "$NAMESPACE" || true
             kubectl apply -f "${NAMESPACE}-workloads.yaml" -n "$NAMESPACE"
             ```
           * Update DNS, load balancers, and client configuration as needed to point to the new cluster, and validate application behavior and traffic.

        6. **Decommission or reclassify alpha clusters and verify**
           * If the alpha cluster is no longer needed for production (ideally no workloads remain, or it is explicitly dev/test), either delete it or document its non‑production role:
             ```bash theme={null}
             # To delete (irreversible)
             gcloud container clusters delete "$CLUSTER_NAME" \
               --location "$LOCATION" \
               --project "$PROJECT_ID"
             ```
           * Re-run the audit for all remaining clusters to confirm compliance (any alpha clusters must now be clearly non‑production):
             ```bash theme={null}
             PROJECT_ID="<your-project-id>"

             for row in $(gcloud container clusters list --project "$PROJECT_ID" \
                          --format="value(name,location)" | tr ' ' ','); do
               CLUSTER_NAME="${row%,*}"
               LOCATION="${row#*,}"
               echo "Cluster: $CLUSTER_NAME ($LOCATION)"
               gcloud container clusters describe "$CLUSTER_NAME" \
                 --location "$LOCATION" \
                 --project "$PROJECT_ID" \
                 --format=json | jq '.enableKubernetesAlpha'
             done
             ```
           * Ensure any cluster with `.enableKubernetesAlpha == true` is documented and treated as non‑production; no production workloads should remain on such clusters.
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot change whether a GKE cluster was created with `--enable-kubernetes-alpha`; that setting is part of the managed control-plane configuration in GCP (console/CLI/IaC), not a Kubernetes API object. To address this finding, follow the guidance in the Manual Steps section using the Google Cloud Console, `gcloud`, or your IaC definitions.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        # Report GKE clusters that have Kubernetes Alpha enabled.
        # Requirements:
        #   - gcloud CLI configured and authenticated
        #   - jq installed

        set -euo pipefail

        # Optional: limit to specific projects by setting PROJECTS env var as a
        # space-separated list, e.g.:
        #   PROJECTS="proj-a proj-b"
        if [[ -n "${PROJECTS:-}" ]]; then
          projects=$PROJECTS
        else
          projects=$(gcloud projects list --format="value(projectId)")
        fi

        echo "project,location,cluster,enableKubernetesAlpha"

        for project in $projects; do
          # List all GKE clusters (both zonal and regional) in the project
          while IFS= read -r cluster_uri; do
            # cluster_uri format:
            # //container.googleapis.com/projects/PROJECT/locations/LOCATION/clusters/CLUSTER_NAME
            location=$(printf '%s\n' "$cluster_uri" | awk -F/ '{print $(NF-3)}')
            cluster_name=$(printf '%s\n' "$cluster_uri" | awk -F/ '{print $NF}')

            alpha_enabled=$(
              gcloud container clusters describe "$cluster_name" \
                --location "$location" \
                --project "$project" \
                --format="value(enableKubernetesAlpha)" 2>/dev/null || echo "ERROR"
            )

            echo "$project,$location,$cluster_name,$alpha_enabled"
          done < <(
            gcloud container clusters list \
              --project "$project" \
              --format="value(selfLink)" 2>/dev/null || true
          )
        done
        ```

        **How to run (from any machine with gcloud access)**

        ```bash theme={null}
        chmod +x report_gke_alpha_clusters.sh
        ./report_gke_alpha_clusters.sh > gke_alpha_report.csv
        ```

        **How to interpret the output**

        * The script prints a CSV with columns: `project,location,cluster,enableKubernetesAlpha`.
        * Any row where `enableKubernetesAlpha` is `true` indicates a cluster created with Kubernetes Alpha enabled.
        * Such clusters must be treated as **non‑production**. If they currently host production workloads, this violates the control and requires architectural and migration review, not an in-place automated fix.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>