---
title: Integrity Monitoring for Shielded GKE Nodes should be enabled
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Integrity Monitoring for Shielded GKE
  Nodes should be enabled
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Integrity Monitoring for Shielded GKE Nodes should be enabled
 
## Description{% #description %}

GKE node pools should have Integrity Monitoring enabled for Shielded GKE Nodes so administrators are notified of inconsistencies during the node boot sequence and can prevent compromised nodes from joining the cluster. Integrity Monitoring cannot be enabled on an existing node pool; create a new node pool with the control enabled and migrate workloads.

## Remediation{% #remediation %}

Integrity Monitoring cannot be enabled on an existing node pool. Create a replacement node pool with Integrity Monitoring enabled (via the Shielded options in the console, or `gcloud container node-pools create`), migrate workloads, then delete the non-conforming pool. See [Using Shielded GKE Nodes](https://cloud.google.com/kubernetes-engine/docs/how-to/shielded-gke-nodes) for the full procedure.

## References{% #references %}

- [Using Shielded GKE Nodes](https://cloud.google.com/kubernetes-engine/docs/how-to/shielded-gke-nodes)
- [CIS Google Kubernetes Engine (GKE) Benchmark](https://www.cisecurity.org/benchmark/kubernetes)