> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Node Auto-Upgrade Is Enabled For GKE Nodes

### More Info:

Enable node auto-upgrade so nodes stay current with the control plane version and receive security patches automatically. Outdated nodes may run vulnerable Kubernetes and OS versions.

### Risk Level

Low

### Address

Security

### Compliance Standards

* CIS GKE

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. **List all node pools and identify which require review**
           * Run on: any machine with `gcloud` access.
           ```bash theme={null}
           gcloud container node-pools list \
             --cluster CLUSTER_NAME \
             --location LOCATION \
             --project PROJECT_ID
           ```
           * Decide which node pools should have auto-upgrade based on workload sensitivity, maintenance windows, and existing patching processes.

        2. **Gather auto-upgrade configuration for each node pool**
           * For each node pool name from step 1, run:
           ```bash theme={null}
           gcloud container node-pools describe NODE_POOL_NAME \
             --cluster CLUSTER_NAME \
             --location LOCATION \
             --project PROJECT_ID \
             --format json | jq '.management'
           ```
           * Capture `.management.autoUpgrade` and `.management.autoRepair` for documentation.

        3. **Assess whether auto-upgrade should be enabled**
           * For each node pool, review:
             * Change-management and maintenance window requirements.
             * Need for predictable vs. rapid security updates.
             * Workload disruption tolerance and PodDisruptionBudget coverage.
           * Decide per node pool: enable auto-upgrade, or keep it disabled with a documented manual upgrade process and schedule.

        4. **Enable auto-upgrade where appropriate**
           * For node pools where you’ve decided to enable it, run:
           ```bash theme={null}
           gcloud container node-pools update NODE_POOL_NAME \
             --cluster CLUSTER_NAME \
             --location LOCATION \
             --project PROJECT_ID \
             --enable-autoupgrade
           ```
           * Note: this changes future upgrade behavior; it does not immediately upgrade nodes but may schedule automatic upgrades according to Google’s policy.

        5. **Document exceptions where auto-upgrade remains disabled**
           * For any node pool where you choose not to enable auto-upgrade:
             * Record the business/technical justification.
             * Define and document an alternative, regular manual upgrade process (commands, cadence, responsible owner).

        6. **Verify configuration after changes**
           * Re-run the audit command for all node pools:
           ```bash theme={null}
           gcloud container node-pools describe NODE_POOL_NAME \
             --cluster CLUSTER_NAME \
             --location LOCATION \
             --project PROJECT_ID \
             --format json | jq '.management'
           ```
           * Confirm `autoUpgrade` is `true` for node pools where it should be enabled, and that any `false` values are intentional and documented.
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot enable node auto-upgrade because this setting is managed on the GKE control-plane side (Google Cloud Console / gcloud / IaC), not via Kubernetes API objects. To remediate this finding, follow the guidance in the Manual Steps section using the Google Cloud Console, gcloud CLI, or your IaC tooling.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        # Report GKE node auto-upgrade status for all node pools in all clusters in a project.
        # Runs with: any machine that has gcloud, jq, and appropriate IAM permissions.

        set -euo pipefail

        PROJECT_ID="YOUR_PROJECT_ID_HERE"

        if [[ "$PROJECT_ID" == "YOUR_PROJECT_ID_HERE" ]]; then
          echo "ERROR: Set PROJECT_ID at the top of this script."
          exit 1
        fi

        echo "Project: $PROJECT_ID"
        echo

        # List all clusters (regional and zonal)
        gcloud container clusters list \
          --project "$PROJECT_ID" \
          --format='value(name,location)' |
        while read -r CLUSTER LOCATION; do
          if [[ -z "$CLUSTER" ]]; then
            continue
          fi

          echo "Cluster: $CLUSTER  (location: $LOCATION)"

          # List all node pools for this cluster
          gcloud container node-pools list \
            --cluster "$CLUSTER" \
            --location "$LOCATION" \
            --project "$PROJECT_ID" \
            --format='value(name)' |
          while read -r POOL; do
            if [[ -z "$POOL" ]]; then
              continue
            fi

            # Describe management settings and extract autoUpgrade flag
            MGMT_JSON=$(gcloud container node-pools describe "$POOL" \
              --cluster "$CLUSTER" \
              --location "$LOCATION" \
              --project "$PROJECT_ID" \
              --format=json | jq -r '.management')

            AUTO_UPGRADE=$(printf '%s\n' "$MGMT_JSON" | jq -r '.autoUpgrade')

            # Normalize missing field to "false"
            if [[ "$AUTO_UPGRADE" != "true" ]]; then
              AUTO_UPGRADE="false"
            fi

            # Mark non-compliant pools clearly
            if [[ "$AUTO_UPGRADE" == "true" ]]; then
              STATUS="OK"
            else
              STATUS="NON_COMPLIANT"
            fi

            echo "  Node pool: $POOL"
            echo "    management: $MGMT_JSON"
            echo "    autoUpgrade: $AUTO_UPGRADE  <-- $STATUS"
          done

          echo
        done
        ```

        **How to interpret the output**

        * Each node pool shows:
          * `management: {...}` – raw management block from the API.
          * `autoUpgrade: true  <-- OK` – compliant with the benchmark.
          * `autoUpgrade: false  <-- NON_COMPLIANT` – needs review and likely remediation.

        All node pools in a cluster should report `autoUpgrade: true` to align with CIS GKE 5.5.3.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>