🛡️ Google GKE Cluster Node Pool Auto-Repair is disabled🟢

• Contextual name: 🛡️ Cluster Node Pool Auto-Repair is disabled🟢
• ID: /ce/ca/google/gke/node-pool-auto-repair
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: RELIABILITY

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Google GKE Cluster Node Pool
  • 🔌 Google GKE Cluster Node Pool - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

This policy verifies that the Auto-Repair feature is enabled for GKE Cluster Node Pools.

Rationale

The node auto-repair feature ensures that cluster nodes remain in a healthy, operational state. When enabled, GKE continuously monitors the health of each node. If a node fails consecutive health checks over a defined period, GKE automatically initiates a repair process for that node, reducing downtime and improving workload reliability.

Impact

If multiple nodes require repair simultaneously, GKE may perform repairs in parallel. The number of concurrent repairs is limited based on cluster size and the total number of failed nodes. Larger clusters allow for more concurrent repairs, while limits are reduced when many nodes are in a failed state.

Node auto-repair is not supported on alpha clusters.

Audit

This policy marks a Google GKE Cluster Node Pool as INCOMPLIANT if Node Management: Auto-Repair is not set to Enabled.

Default Value

Node auto-repair is enabled by default.

References

... see more

Remediation

Open File

Remediation

To maintain the health and availability of GKE cluster nodes, automatic node repair should be enabled for node pools.

Enable Auto-Repair on an Existing Node Pool

From gcloud CLI

```sh
gcloud container node-pools update {{node-pool-name}} \
    --cluster {{cluster-name}} \
    --location {{location}} \
    --enable-autorepair
```

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS GKE v1.8.0 → 💼 5.5.2 Ensure Node Auto-Repair is Enabled for GKE Nodes (Automated)			1		no data
💼 Cloudaware Framework → 💼 System Configuration			45		no data
💼 PCI DSS v3.2.1 → 💼 2.2 Develop configuration standards for all system components. Assure that these standards address all known security vulnerabilities and are consistent with industry-accepted system hardening standards.	5	3	32		no data
💼 PCI DSS v4.0.1 → 💼 2.2.1 Configuration standards are developed, implemented, and maintained.			13		no data
💼 PCI DSS v4.0 → 💼 2.2.1 Configuration standards are developed, implemented, and maintained.			13		no data