Kubernetes clusters should have an upgrade channel configured
Evaluates AKS clusters to check whether an automatic upgrade channel is set. A cluster passes the check when its upgrade channel has a value other than `none`, so that the cluster receives Kubernetes version updates automatically.
Without automatic upgrades, AKS clusters can remain on unsupported or vulnerable Kubernetes versions. Delayed patching increases exposure to known CVEs, control plane/node defects, and exploit chains that can affect workload confidentiality, integrity, and availability.
What this control checks
AKS cluster upgrade channel must be set to a value other than none.
Common pitfalls
Automatic upgrade channels can change cluster versions
Automatic upgrade channels can change cluster versions during Azure-managed upgrade windows.
Avoid none unless a documented exception exists
Avoid none unless a documented exception and manual patching process exists.
Audit evidence
Evidence that deployed resources meet this control: Prowler check aks_cluster_auto_upgrade_enabled (prowler azure --checks aks_cluster_auto_upgrade_enabled); PowerPipe control azure_compliance.control.kubernetes_cluster_upgrade_channel.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_171.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kubernetes_cluster_upgrade_channel - Checkov Check:
CKV_AZURE_171 - Powerpipe Control:
azure_compliance.control.kubernetes_cluster_upgrade_channel - Prowler Check:
aks_cluster_auto_upgrade_enabled
Last reviewed: 2026-10-13