Enable Container-Optimized OS on all Kubernetes cluster nodes.
Risk Level: Medium
Description
This plugin ensures that all Kubernetes cluster nodes have Container-Optimized OS enabled. Container-Optimized OS is an operating system image that lets you efficiently and securely run Docker containers on the Google Cloud Platform.
About the Service
Google Cloud Kubernetes Engine:
The Google Cloud Kubernetes Engine is a Kubernetes-based service that includes a control plane, nodes that house pods, and Google Cloud services. It aids in the modernization of your programs by offering a platform for deploying, managing, and scaling containerized applications. The Google Cloud Console or kubectl can be used to interact with this Google Cloud Kubernetes Engine. To know more, read here.
Impact
If your cluster nodes do not have the Container-Optimized OS enabled for node images, then all the security fixes will not be updated automatically. Since Container-Optimized OS increases node security, disabling this option will reduce the security and stability of your node images. Container-Optimized OS also aids in the speedy, efficient, and safe deployment of Docker containers on GCP.
Steps to Reproduce
Using GCP Console-
- Log In to your GCP Console.
- From the top navigation bar, select the GCP project you want to investigate.
- From the navigation panel on the left side of the console, go to Kubernetes Engine and select Clusters. You can use this link here to navigate directly if you’re already logged in.
- Select the cluster you want to investigate from the list of clusters displayed and go to the NODES tab of the selected cluster.
- Under the Node pools section, select the node pool you want to verify from the list of node pools displayed in the table.
- In the Nodes section, check the configuration of Image type. If it says anything other than the configuration shown below then the COS image is disabled for this particular node pool of the selected cluster.
- Repeat steps 5 and 6 for all the node pools present in the selected cluster.
- Repeat steps 4 to 7 for all the clusters you want to investigate in the selected project.
- If you have multiple projects that you want to investigate, repeat steps 2-8 for each project in your GCP console.
Steps for Remediation
Determine whether or not you truly require the COS image option to be disabled. If not, make the necessary changes to enable it using the steps given below.
Using GCP Console-
- Log In to your GCP Console.
- From the top navigation bar, select the GCP project you want to investigate.
- From the navigation panel on the left side of the console, go to Kubernetes Engine and select Clusters. You can use this link here to navigate directly if you’re already logged in.
- Select the cluster you want to reconfigure from the list of clusters displayed and go to the NODES tab of the selected cluster. (In case you aren’t sure which node pool needs to be configured, follow the steps to reproduce listed above to determine which to choose.)
- Under the Node pools section, select the node pool you want to verify from the list of node pools displayed in the table.
- Click the EDIT button on the top navigation bar to reconfigure the settings.
- In the Nodes section, click on the CHANGE button under Image type and select Container-Optimised OS with Containerd (cos_containerd). Click Change to confirm the changes.
- Click save to save the changes to the node pool.
- Repeat steps 5 to 7 for all the node pools that you want to reconfigure in the selected cluster.
- Repeat steps 4 to 9 for all the clusters you want to reconfigure in the selected project.
- If you have multiple projects, repeat steps 2 to 10 for each project in your GCP console.