Skip to main content

Alpha Clusters Are Not Used For Production Workloads

More Info:​

Alpha Clusters Are Not Covered By An Sla And Are Not Production-Ready.

Risk Level​

High

Address​

Security

Compliance Standards​

  • CIS GKE

Triage and Remediation​

Remediation​

Manual Steps

  1. On any machine with the gcloud CLI configured, list all clusters in the relevant project and locations:

    gcloud container clusters list --project YOUR_PROJECT_ID

    Identify any clusters that are suspected to be production.

  2. For each suspected production cluster, check whether Kubernetes alpha is enabled:

    CLUSTER_NAME="YOUR_CLUSTER_NAME"
    LOCATION="YOUR_CLUSTER_LOCATION"
    PROJECT_ID="YOUR_PROJECT_ID"

    gcloud container clusters describe "$CLUSTER_NAME" \
      --location "$LOCATION" \
      --project "$PROJECT_ID" \
      --format json | jq '.enableKubernetesAlpha'

    Record the value; true indicates an alpha cluster.

  3. For any cluster where .enableKubernetesAlpha is true, confirm its business criticality by reviewing:

    • The namespaces and deployments running on it: 
      kubectl config use-context gke_${PROJECT_ID}_${LOCATION}_${CLUSTER_NAME}
      kubectl get ns
      kubectl get deployments --all-namespaces
    • Internal ownership / documentation to determine whether the cluster is intended for production, staging, or testing.

  4. If an alpha cluster is determined to be production or to host production-critical workloads, plan a migration to a non-alpha cluster (alpha cannot be “turned off” in-place). Using your IaC or cluster creation process, ensure new clusters are created without the alpha flag, for example:

    gcloud container clusters create NEW_CLUSTER_NAME \
      --location LOCATION \
      --project PROJECT_ID
      # Note: deliberately omit --enable-kubernetes-alpha

  5. Migrate workloads from the alpha cluster to the new non-alpha cluster by:

    • Exporting manifests from the alpha cluster: 
      kubectl get all --all-namespaces -o yaml > cluster-backup.yaml
    • Adapting and applying them to the new cluster: 
      kubectl config use-context gke_${PROJECT_ID}_${LOCATION}_NEW_CLUSTER_NAME
      kubectl apply -f cluster-backup.yaml

    Validate application behavior, networking, and permissions in the new cluster.

  6. After migration and validation, decommission the alpha cluster to prevent future production use:

    gcloud container clusters delete "$CLUSTER_NAME" \
      --location "$LOCATION" \
      --project "$PROJECT_ID"

    Finally, re-run the evidence command for all remaining production clusters to ensure .enableKubernetesAlpha is false everywhere.

Using kubectl

kubectl cannot change whether a GKE cluster was created with --enable-kubernetes-alpha; this setting is part of the managed control-plane configuration in GCP. To address this finding, review and remediate the cluster configuration using the cloud provider console/CLI/IaC as described in the Manual Steps section.

Automation
#!/usr/bin/env bash
#
# Report GKE clusters that have Kubernetes alpha features enabled.
# Requires:
#   - gcloud CLI authenticated
#   - jq installed
#
# Scope:
#   - All projects visible via `gcloud projects list`
#   - All GKE clusters (zonal and regional) in each project
#
# Run on:
#   - Any machine with gcloud, jq, and permissions to list/describe GKE clusters.

set -euo pipefail

echo "Scanning all accessible GCP projects for GKE alpha clusters..." >&2
echo

# Header
printf "%-30s %-20s %-20s %-8s %-6s\n" \
  "PROJECT_ID" "CLUSTER_NAME" "LOCATION" "ALPHA" "RISK"
printf "%-30s %-20s %-20s %-8s %-6s\n" \
  "----------" "-----------" "--------" "-----" "----"

gcloud projects list --format="value(projectId)" | while read -r PROJECT_ID; do
  # List all clusters (both regional and zonal) in the project
  gcloud container clusters list \
    --project "${PROJECT_ID}" \
    --format="value(name,location)" 2>/dev/null | while read -r CLUSTER_NAME LOCATION; do

    # Fetch enableKubernetesAlpha flag
    ALPHA_ENABLED="$(gcloud container clusters describe "${CLUSTER_NAME}" \
      --location "${LOCATION}" \
      --project "${PROJECT_ID}" \
      --format="json" 2>/dev/null | jq -r '.enableKubernetesAlpha')"

    # Normalize UNKNOWN/empty to "null"
    if [[ -z "${ALPHA_ENABLED}" || "${ALPHA_ENABLED}" == "null" ]]; then
      ALPHA_ENABLED="false"
    fi

    if [[ "${ALPHA_ENABLED}" == "true" ]]; then
      RISK="HIGH"
    else
      RISK="ok"
    fi

    printf "%-30s %-20s %-20s %-8s %-6s\n" \
      "${PROJECT_ID}" "${CLUSTER_NAME}" "${LOCATION}" "${ALPHA_ENABLED}" "${RISK}"
  done
done

How to interpret the output

  • Each line is a GKE cluster with:
    • PROJECT_ID – GCP project
    • CLUSTER_NAME – cluster name
    • LOCATION – region/zone
    • ALPHA – value of .enableKubernetesAlpha (true or false)
    • RISK – simple classification

Problem indication

  • Any cluster with:
    • ALPHA = true
    • RISK = HIGH

Those clusters are using Kubernetes alpha features and must not be used for production workloads. They should be flagged for manual review and migration to non‑alpha clusters.

Additional Reading:​