GKE Node Pools Without Auto-Repair Enabled

ID: gcloud-gke-auto-repair-disabled

Severity: medium

Author: princechaddha

Tags: cloud,devops,gcp,gcloud,gke,kubernetes,reliability,maintenance,gcp-cloud-config

Description

Ensure that the Auto-Repair feature is enabled for all your GKE cluster nodes to help maintain node health. Google Kubernetes Engine (GKE) triggers a repair action if a node reports consecutive unhealthy status reports for a given time threshold, such as when a node broadcasts a “NotReady” status, fails to broadcast any status, or runs out of disk space.

YAML Source

id: gcloud-gke-auto-repair-disabled

info:
  name: GKE Node Pools Without Auto-Repair Enabled
  author: princechaddha
  severity: medium
  description: |
    Ensure that the Auto-Repair feature is enabled for all your GKE cluster nodes to help maintain node health. Google Kubernetes Engine (GKE) triggers a repair action if a node reports consecutive unhealthy status reports for a given time threshold, such as when a node broadcasts a "NotReady" status, fails to broadcast any status, or runs out of disk space.
  impact: |
    Without auto-repair enabled, unhealthy nodes may remain in a degraded state indefinitely, potentially affecting the availability and reliability of your workloads running on those nodes.
  remediation: |
    Enable auto-repair for your GKE cluster node pools using:
    gcloud container node-pools update POOL_NAME --cluster=CLUSTER_NAME --region=REGION --enable-autorepair
  reference:
    - https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-repair
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/GKE/enable-auto-repair.html
  tags: cloud,devops,gcp,gcloud,gke,kubernetes,reliability,maintenance,gcp-cloud-config

flow: |
  code(1)
  for(let projectId of iterate(template.projectIds)){
    set("projectId", projectId)
    code(2)
    for(let cluster of iterate(template.clusters)){
      cluster = JSON.parse(cluster)
      set("clusterName", cluster.name)
      set("location", cluster.location)
      code(3)
      for(let nodePool of iterate(template.nodePools)){
        nodePool = JSON.parse(nodePool)
        set("nodePoolName", nodePool.name)
        code(4)
      }
    }
  }

self-contained: true

code:
  - engine:
      - sh
      - bash
    source: |
      gcloud projects list --format="json(projectId)"

    extractors:
      - type: json
        name: projectIds
        internal: true
        json:
          - '.[].projectId'

  - engine:
      - sh
      - bash
    source: |
      gcloud container clusters list --project $projectId --format="json(name,location)"

    extractors:
      - type: json
        name: clusters
        internal: true
        json:
          - '.[]'

  - engine:
      - sh
      - bash
    source: |
      gcloud container node-pools list --cluster $clusterName --location $location --project $projectId --format="json(name)"

    extractors:
      - type: json
        name: nodePools
        internal: true
        json:
          - '.[]'

  - engine:
      - sh
      - bash
    source: |
      gcloud container node-pools describe $nodePoolName --cluster $clusterName --location $location --project $projectId --format="yaml(management.autoRepair)"

    matchers:
      - type: word
        words:
          - "management: {}"
          - "null"
        condition: or

    extractors:
      - type: dsl
        dsl:
          - '"Node pool " + nodePoolName + " in GKE cluster " + clusterName + " (" + location + ") of project " + projectId + " does not have auto-repair enabled"'
# digest: 4a0a004730450220650dfbe4698de5fd0774f8caaada58ef598cf8c58b89fb2bbbc4ac82e9f6c0c902210096aaf12a7d2fdab29352f5ef9d832c8fb67a20a2b9308c668307b5d13e6130bb:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "cloud/gcp/gke/gcloud-gke-auto-repair-disabled.yaml"

View on Github