Skip to main content

When Creating New Clusters - Automate Gke Version

More Info:​

Subscribe To The Regular Or Stable Release Channel To Automate Version Upgrades To The Gke Cluster And To Reduce Version Management Complexity To The Number Of Features And Level Of Stability Required.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS GKE
  • Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework

Triage and Remediation​

Remediation​

Manual Steps

  1. Identify current release channel setting

    • On any machine with gcloud configured for the project, run: 
      gcloud container clusters list --project <PROJECT_ID> \
        --format='table(name,location,releaseChannel.channel)'
      For any cluster where releaseChannel.channel is null, that cluster is not using a release channel.

  2. Drill into each non-compliant cluster

    • For each cluster with releaseChannel.channel: null, run: 
      gcloud container clusters describe <CLUSTER_NAME> \
        --location <LOCATION> \
        --project <PROJECT_ID> \
        --format='json' | jq '.name, .location, .currentMasterVersion, .currentNodeVersion, .releaseChannel'
    • Capture this output for change review and risk assessment.

  3. Decide target release channel (stable vs. regular)

    • Based on your org’s risk appetite and feature requirements, choose:
      • stable for maximum stability and slower, well‑tested updates.
      • regular for newer features with more frequent updates.
    • Document the chosen channel per cluster.
    • Note: existing clusters cannot be switched into a release channel; you must plan for migration.

  4. Plan migration to a release-channel-managed cluster

    • Design a replacement cluster for each non-compliant cluster, specifying the release channel: 
      gcloud container clusters create <NEW_CLUSTER_NAME> \
        --location <LOCATION> \
        --release-channel <stable|regular> \
        --project <PROJECT_ID> \
        [other required flags to match your current config]
    • Plan workload migration (node pools, network settings, addons, IAM, etc.) and a rollback strategy.

  5. Migrate workloads and decommission old clusters

    • Update your kubeconfig to point at the new cluster: 
      gcloud container clusters get-credentials <NEW_CLUSTER_NAME> \
        --location <LOCATION> \
        --project <PROJECT_ID>
    • Recreate required namespaces, RBAC, and workloads from version‑controlled manifests or IaC.
    • Validate application behavior, then delete the old cluster when safe: 
      gcloud container clusters delete <OLD_CLUSTER_NAME> \
        --location <LOCATION> \
        --project <PROJECT_ID>

  6. Verify compliance across all clusters

    • After migration, confirm all remaining clusters use a release channel: 
      gcloud container clusters list --project <PROJECT_ID> \
        --format='table(name,location,releaseChannel.channel)'
    • Ensure each cluster shows stable or regular under releaseChannel.channel.
Using kubectl

kubectl cannot configure GKE release channels; this setting is only managed on the cloud provider control plane via gcloud, console, or IaC at cluster creation time. Refer to the Manual Steps section for how to review and configure the cluster’s release channel.

Automation
#!/usr/bin/env bash
#
# Report GKE release channel configuration for all clusters in one or more projects.
# Requires:
#   - gcloud
#   - jq
#
# Run from: any machine with gcloud access to the target projects.

set -euo pipefail

# --- CONFIGURATION ----------------------------------------------------------

# Comma-separated list of project IDs to check.
# EDIT THIS LINE to include all relevant projects.
PROJECTS_CSV="my-project-1,my-project-2"

# If you want to limit to specific locations, set this (space-separated) and
# uncomment the LOCATION_FILTER in the loop below.
# Example: LOCATIONS_FILTER="us-central1 us-east1 us-west1"
LOCATIONS_FILTER=""

# ---------------------------------------------------------------------------

IFS=',' read -r -a PROJECTS <<< "$PROJECTS_CSV"

echo "Checking GKE release channel configuration..."
echo

for PROJECT in "${PROJECTS[@]}"; do
  PROJECT="$(echo "$PROJECT" | xargs)" # trim spaces
  [ -z "$PROJECT" ] && continue

  echo "== Project: $PROJECT =="

  # List all clusters in the project (both zonal and regional).
  # 'location' works for both regions and zones with modern gcloud.
  CLUSTERS_JSON="$(gcloud container clusters list \
    --project "$PROJECT" \
    --format=json || true)"

  if [ -z "$CLUSTERS_JSON" ] || [ "$CLUSTERS_JSON" = "[]" ]; then
    echo "  No GKE clusters found."
    echo
    continue
  fi

  echo "$CLUSTERS_JSON" | jq -c '.[]' | while read -r CLUSTER; do
    NAME="$(echo "$CLUSTER" | jq -r '.name')"
    LOCATION="$(echo "$CLUSTER" | jq -r '.location')"
    STATUS="$(echo "$CLUSTER" | jq -r '.status')"

    # If restricting by location, uncomment next two lines:
    # if ! grep -qw "$LOCATION" <<< "$LOCATIONS_FILTER"; then
    #   continue
    # fi

    # Describe cluster to fetch release channel info.
    DESC="$(gcloud container clusters describe "$NAME" \
      --location "$LOCATION" \
      --project "$PROJECT" \
      --format=json || true)"

    if [ -z "$DESC" ]; then
      echo "  [ERROR] Failed to describe cluster $NAME in $LOCATION"
      continue
    fi

    CHANNEL="$(echo "$DESC" | jq -r '.releaseChannel.channel // "NONE"')"

    # Normalize for interpretation:
    #   - "STABLE" or "REGULAR" are acceptable (per benchmark).
    #   - "RAPID" or "NONE" (no release channel set) are conditions to review.
    #   - Any other value is unexpected and should be investigated.
    STATUS_FLAG="OK"
    REASON=""

    case "$CHANNEL" in
      STABLE|REGULAR)
        STATUS_FLAG="OK"
        ;;
      RAPID)
        STATUS_FLAG="REVIEW"
        REASON="Uses RAPID channel (less stable, not aligned with benchmark 5.5.4)."
        ;;
      NONE)
        STATUS_FLAG="REVIEW"
        REASON="No release channel configured (manual version management)."
        ;;
      *)
        STATUS_FLAG="REVIEW"
        REASON="Unexpected channel value: $CHANNEL"
        ;;
    esac

    echo "  Cluster: $NAME"
    echo "    Location     : $LOCATION"
    echo "    Status       : $STATUS"
    echo "    ReleaseChannel: $CHANNEL"
    echo "    Assessment   : $STATUS_FLAG${REASON:+ - $REASON}"
    echo
  done

  echo
done

How to interpret the output

  • Clusters with:

    • ReleaseChannel: STABLE and Assessment: OK, or
    • ReleaseChannel: REGULAR and Assessment: OK
      are aligned with CIS GKE 5.5.4.

  • Clusters with:

    • ReleaseChannel: NONE and Assessment: REVIEW, or
    • ReleaseChannel: RAPID and Assessment: REVIEW, or
    • any other unexpected channel value
      indicate a problem or at least a deviation from the benchmark recommendation and require manual review and a decision on whether to recreate/migrate the cluster into the STABLE or REGULAR channel.

Additional Reading:​