Automate GKE Version Management Using Release Channels

More Info:

Enroll new clusters in a Release Channel (stable or regular) so GKE manages version upgrades and security patches on a predictable cadence. This keeps the cluster on supported, patched versions.

Risk Level

Low

Address

Security

Compliance Standards

• CIS GKE

Triage and Remediation

Remediation

Remediation

Manual Steps

1. Identify clusters and their release channel status
   Run on any machine with gcloud configured:

   gcloud container clusters list --project PROJECT_ID \
     --format="table(name,location,releaseChannel.channel,currentMasterVersion,currentNodeVersion)"

   Note any clusters where releaseChannel.channel is - (unset).

2. Inspect current configuration for a specific cluster
   For each cluster with no release channel, run:

   gcloud container clusters describe CLUSTER_NAME \
     --location LOCATION \
     --project PROJECT_ID \
     --format=json | jq '.name, .location, .releaseChannel, .currentMasterVersion, .currentNodeVersion'

   Save this output as part of your review record.

3. Decide whether the cluster should be managed via a release channel

   • Confirm the cluster is production or long‑lived (not a short‑term test cluster).
   • Confirm organizational policy on release channels (e.g., stable for production, regular for non‑prod).
   • Assess workload sensitivity to version changes and maintenance‑window requirements.

4. Plan migration / recreation strategy
   Since the benchmark remediation applies to new clusters, decide:

   • Whether to recreate the cluster in a release channel (preferred for strict compliance).
   • Or to accept risk/exception for existing clusters that are impractical to recreate.
     Document this decision and planned timing.

5. Create replacement cluster with a release channel (if chosen)
   On any machine with gcloud, create the new cluster:

   gcloud container clusters create NEW_CLUSTER_NAME \
     --location LOCATION \
     --release-channel stable \
     --project PROJECT_ID

   Replace stable with regular if required.
   Migrate workloads (e.g., via backup/restore, IaC redeploy, or workload migration tools) and decommission the old cluster when ready.

6. Verify that new clusters comply with the control
   After creation, confirm the release channel:

   gcloud container clusters describe NEW_CLUSTER_NAME \
     --location LOCATION \
     --project PROJECT_ID \
     --format="value(releaseChannel.channel)"

   Ensure the output is STABLE or REGULAR, and record it as evidence.

Using kubectl

kubectl cannot configure or change GKE Release Channels, because this setting is part of the managed control plane and cluster creation parameters in GCP, not a Kubernetes API object. To remediate this finding, use the Google Cloud Console, gcloud CLI, or your IaC workflows as described in the Manual Steps section.

Automation

#!/usr/bin/env bash
# Report GKE Release Channel usage for all clusters in all projects.

set -euo pipefail

# Optional: restrict to specific projects by setting PROJECTS env var as a
# space‑separated list, e.g.:
#   PROJECTS="proj-a proj-b" ./gke-release-channel-audit.sh
if [[ -n "${PROJECTS:-}" ]]; then
  projects=$PROJECTS
else
  projects=$(gcloud projects list --format="value(projectId)")
fi

printf 'project,location,cluster,releaseChannel,issue\n'

for project in $projects; do
  # Both zonal and regional
  clusters=$(gcloud container clusters list \
    --project="$project" \
    --format="csv[no-heading](name,location)")

  if [[ -z "$clusters" ]]; then
    continue
  fi

  while IFS=',' read -r cluster location; do
    # Describe cluster and get releaseChannel.channel (may be null)
    channel=$(gcloud container clusters describe "$cluster" \
      --location="$location" \
      --project="$project" \
      --format="value(releaseChannel.channel)")

    issue=""

    if [[ -z "$channel" ]]; then
      issue="NO_RELEASE_CHANNEL_CONFIGURED"
    elif [[ "$channel" != "STABLE" && "$channel" != "REGULAR" ]]; then
      # E.g. RAPID or unexpected values
      issue="NON_COMPLIANT_CHANNEL"
    fi

    printf '%s,%s,%s,%s,%s\n' \
      "$project" "$location" "$cluster" "${channel:-NONE}" "$issue"
  done <<< "$clusters"
done

Run from: any machine with gcloud access to the relevant projects.

Interpretation:

• Compliant: rows where issue is empty and releaseChannel is STABLE or REGULAR.
• Problematic for this control:
  • issue=NO_RELEASE_CHANNEL_CONFIGURED (cluster not enrolled in any release channel).
  • issue=NON_COMPLIANT_CHANNEL (e.g. releaseChannel is RAPID or another value not allowed by your policy).