GCP Kubernetes Engine Clusters not using Container-Optimized OS for Node image misconfiguration dete

Rule Details

Cortex AppSec Rule ID	APPSEC_GCP_22
Category - Subcategory	Kubernetes - Resource Management
Provider	GCP
Severity	LOW
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	84aedafc-aec4-4e7d-a604-a0a0ea1fd3ca

Impact

GKE enables users to select the operating system image that runs on each node. You can also upgrade an existing cluster to use a different node image type. GKE supports several OS images using the main container runtime directly integrated with Kubernetes, including cos_containerd and ubuntu_containerd. We recommend you use cos_containerd and ubuntu_containerd to enhance node security. Containerd is an industry-standard container runtime component that regularly updates security fixes and patches, providing better support, security, and stability than other images.

How to Fix

Add the image_type argument into the node_config bloc to your google_container_cluster or google_container_node_pool resource:

---

hcl node_config { image_type = "COS" }

It should force the cluster to recreate a node following the new configuration. For further information please follow this link: https://www.terraform.io/docs/providers/google/r/container_cluster.html#image_type