Logo of Trend Micro
Use the Conformity Knowledge Base AI to help improve your Cloud Posture

Check for Alpha Clusters in Production

Trend Cloud One™ – Conformity is a continuous assurance tool that provides peace of mind for your cloud infrastructure, delivering over 1000 automated best practice checks.

Risk Level: Medium (should be achieved)
Rule ID: GKE-012

Given their experimental nature, limited lifespan, lack of Service Level Agreement (SLA) coverage, and inability to upgrade, Alpha GKE clusters should not be used for production workloads. Instead, they are suitable only for development, testing, or evaluation purposes.

This rule resolution is part of the Conformity solution.

Security

Kubernetes features progress through four stages: early development, alpha, beta, and stable. Standard GKE clusters prioritize stability and production readiness by only enabling beta or stable features. Alpha features are excluded because they are not production-ready, upgradeable, and could compromise cluster reliability during automatic control plane upgrades due to potential breaking changes. Furthermore, Alpha clusters themselves are unsuitable for production workloads due to three critical limitations: 1) they lack an SLA, offering no uptime or support guarantees, 2) they are automatically deleted after 30 days, risking data loss, and 3) upgrades are disabled, preventing essential security patching and feature updates. These factors render Alpha clusters inherently unstable and unreliable for production use.

Audit

To determine if your Google Kubernetes Engine (GKE) clusters are using alpha features in production, perform the following operations:

Using GCP Console

01 Sign in to the Google Cloud Management Console.

02 Select the Google Cloud Platform (GCP) project that you want to examine from the console top navigation bar.

03 Navigate to Kubernetes Engine console available at https://console.cloud.google.com/kubernetes.

04 In the left navigation panel, under Resource Management, choose Clusters and select the OVERVIEW tab to access the list of GKE clusters provisioned for the selected GCP project.

05 Click on the name (link) of the GKE cluster which runs production workloads and which you want to examine.

06 Select the DETAILS tab to view the configuration information available for the selected cluster.

07 In the Features section, check the Kubernetes alpha features attribute value to determine if your cluster is using alpha features instead of production-ready features. If Kubernetes alpha features is set to Enabled, the selected Google Kubernetes Engine (GKE) cluster is using alpha features in production.

08 Repeat steps no. 5 – 7 for each GKE cluster provisioned within the selected GCP project.

09 Repeat steps no. 2 – 8 for each GCP project deployed in your Google Cloud account.

Using GCP CLI

01 Run projects list command (Windows/macOS/Linux) with custom output filters to list the ID of each GCP project available in your Google Cloud account: 

gcloud projects list
	--format="table(projectId)"

02 The command output should return the requested GCP project IDS: 

PROJECT_ID
cc-web-project-123123
cc-dev-project-112233

03 Run container clusters list command (Windows/macOS/Linux) with the ID of the GCP project that you want to examine as the identifier parameter and custom output filters to describe the name and the region of each GKE cluster provisioned for the selected project: 

gcloud container clusters list
	--project cc-web-project-123123
	--format="table(NAME,ZONE)"

04 The command output should return the requested cluster names and their regions: 

NAME: cc-gke-backend-cluster
ZONE: us-central1

NAME: cc-gke-frontend-cluster
ZONE: us-central1

05 Run container clusters describe command (Windows/macOS/Linux) with the name of the GKE cluster that you want to examine as the identifier parameter and custom output filters to determine if the selected cluster is using alpha features instead of production-ready features: 

gcloud container clusters describe cc-gke-backend-cluster
	--region=us-central1
	--format="value(enableKubernetesAlpha)"

06 The command output should return **True** if alpha features are in use: 

True

If the container clusters describe command output returns True, as shown in the example above, the selected Google Kubernetes Engine (GKE) cluster is using alpha features in production.

07 Repeat steps no. 5 and 6 for each GKE cluster provisioned for the selected GCP project.

08 Repeat steps no. 3 – 7 for each GCP project deployed in your Google Cloud account.

Remediation / Resolution

To ensure that Alpha GKE clusters are not used for production workloads, you must re-create your clusters without Kubernetes alpha features by performing the following operations:

Using GCP Console

01 Sign in to the Google Cloud Management Console.

02 Select the Google Cloud Platform (GCP) project that you want to access from the console top navigation bar.

03 Navigate to Kubernetes Engine console available at https://console.cloud.google.com/kubernetes.

04 In the left navigation panel, under Resource Management, choose Clusters and select the OVERVIEW tab to access the list of GKE clusters deployed for the selected GCP project.

05 Click on the name (link) of the GKE cluster which runs production workloads and which you want to re-create.

06 Select DUPLICATE from the console top menu to initiate the setup process using the same configuration settings as the source cluster and perform the following changes:

  1. For Cluster basics, perform the following actions:
    1. Provide a unique name for the new GKE cluster in the Name box.
    2. For Release channel, select a release channel from the Target release channel dropdown list. This enables Google Kubernetes Engine (GKE) to pick versions for your cluster with your chosen balance between feature availability and stability. We recommend Regular or Stable.
  2. For Features, in the Other section, ensure that the Enable Kubernetes alpha features in this cluster setting checkbox is unchecked, to prevent enabling the alpha features provided by GKE for the new cluster.
  3. Choose CREATE from the console bottom menu to create your new Google Kubernetes Engine (GKE) cluster.

07 (Optional) Once the new GKE cluster is operating successfully, you can remove the source cluster in order to stop adding charges to your Google Cloud bill:

  1. Navigate back to the Clusters page and select the OVERVIEW tab to list the GKE clusters deployed for the selected GCP project.
  2. Select the cluster that you want to delete (i.e., source cluster), and choose DELETE from the console top menu.
  3. In the confirmation box, confirm deletion by typing the cluster name in the required text box, and choose DELETE to remove the selected GKE cluster.

08 Repeat steps no. 5 – 7 for each GKE cluster that you want to re-create, created for the selected GCP project.

09 Repeat steps no. 2 – 8 for each GCP project available in your Google Cloud account.

Using GCP CLI

01 Run container clusters describe command (Windows/macOS/Linux) with the name of the GKE cluster that you want to re-create as the identifier parameter, to describe the configuration information available for the selected cluster: 

gcloud container clusters describe cc-gke-backend-cluster
	--region=us-central1
	--format="json"

02 The command output should return the requested configuration information: 

{
	"addonsConfig": {
		"gcePersistentDiskCsiDriverConfig": {
			"enabled": true
		},
		"kubernetesDashboard": {
			"disabled": true
		},
		"networkPolicyConfig": {
			"disabled": true
		}
	},
	"autoscaling": {
		"autoscalingProfile": "BALANCED"
	},
	"enableKubernetesAlpha": true,

	...

	"securityPostureConfig": {
		"mode": "DISABLED",
		"vulnerabilityMode": "VULNERABILITY_MODE_UNSPECIFIED"
	},
	"selfLink": "https://container.googleapis.com/v1/projects/cc-web-project-123123/locations/us-central1/clusters/cc-gke-backend-cluster",
	"shieldedNodes": {
		"enabled": false
	},
	"status": "RUNNING",
	"subnetwork": "default",
	"zone": "us-central1"
}

03 Run container clusters create command (Windows/macOS/Linux) with the information returned at the previous step as the configuration data for the command parameters, to create a new Google Kubernetes Engine (GKE) cluster. Skip adding the --enable-kubernetes-alpha parameter to the comand request to prevent enabling the alpha features for the new GKE cluster: 

gcloud container clusters create cc-new-gke-backend-cluster
	--project=cc-web-project-123123
	--region=us-central1
	--disk-size=150
	--machine-type=e2-micro
	--num-nodes=3
	--release-channel=regular
	--boot-disk-kms-key=projects/cc-web-project-123123/locations/us-central1/keyRings/cc-gke-key-ring/cryptoKeys/cc-gke-disk-cmk

04 The command output should return the full URL of the new GKE cluster: 

Created [https://container.googleapis.com/v1/projects/cc-web-project-123123/zones/us-central1/clusters/cc-new-gke-backend-cluster]

05 (Optional) Once the new GKE cluster is operating successfully, you can run container clusters delete command (Windows/macOS/Linux) to remove the source cluster in order to stop adding charges to your Google Cloud bill: 

gcloud container clusters delete cc-gke-backend-cluster
	--region=us-central1

06 Type Y (Yes) to confirm the removal: 

The following clusters will be deleted.
- [cc-gke-backend-cluster] in [us-central1]

Do you want to continue (Y/n)?  Y

07 The command output should return the URL of the deleted GKE cluster: 

Deleted [https://container.googleapis.com/v1/projects/cc-web-project-123123/zones/us-central1/clusters/cc-gke-backend-cluster]

08 Repeat steps no. 1 - 4 for each GKE cluster that you want to re-create, available within the selected GCP project.

09 Repeat steps no. 1 – 8 for each GCP project deployed in your Google Cloud account.

References

Publication date Jan 6, 2025

Related GKE rules