COS node image not used

Ce produit n'est pas pris en charge par le site Datadog que vous avez sélectionné. ().
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

Id: ansible-gcp-cos-node-image-not-used

Provider: GCP

Platform: Ansible

Severity: Low

Category: Insecure Configurations

Learn More

Description

GKE node pools should use Container-Optimized OS (COS) images. COS is a Google-managed, hardened OS with automatic security updates and tighter integration with GKE, reducing exposure to unpatched vulnerabilities and kernel-level attack surface.

In Ansible, check tasks using the google.cloud.gcp_container_node_pool or gcp_container_node_pool modules and ensure the config.image_type property is defined and starts with COS (case-insensitive). Tasks missing config.image_type or with values that do not start with COS are flagged.

Secure configuration example:

- name: Create GKE node pool with COS image
  google.cloud.gcp_container_node_pool:
    name: my-node-pool
    initial_node_count: 3
    config:
      machine_type: e2-medium
      image_type: COS_CONTAINERD

Compliant Code Examples

- name: create a node pool
  google.cloud.gcp_container_node_pool:
    name: my-pool
    initial_node_count: 4
    cluster: '{{ cluster }}'
    location: us-central1-a
    project: test_project
    auth_kind: serviceaccount
    service_account_file: /tmp/auth.pem
    state: present
    config:
      image_type: COS

- name: create a node pool
  google.cloud.gcp_container_node_pool:
    name: my-pool
    initial_node_count: 4
    cluster: "{{ cluster }}"
    location: us-central1-a
    project: test_project
    auth_kind: serviceaccount
    service_account_file: /tmp/auth.pem
    state: present
    config:
      image_type: COS_CONTAINERD

Non-Compliant Code Examples

---
- name: create a node pool
  google.cloud.gcp_container_node_pool:
    name: my-pool
    initial_node_count: 4
    cluster: "{{ cluster }}"
    location: us-central1-a
    project: test_project
    auth_kind: serviceaccount
    service_account_file: "/tmp/auth.pem"
    state: present
    config:
      image_type: WINDOWS_LTSC