GKE node pools should all have automatic node repair enabled
Checks that GKE node pools have automatic node repair enabled. Automatic repair will monitor nodes and attempt repair when a node fails multiple subsequent health checks. The Terraform check inspects `google_container_node_pool`.
Automatic repair will monitor nodes and attempt repair when a node fails multiple subsequent health checks.
What this control checks
GKE node pools must have auto_repair enabled in management
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.enable_auto_repair.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_9; Trivy check GCP-0063.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to PR.IR-03 (Mechanisms are implemented to achieve resilience requirements in normal and adverse situations.), PR.IR-04 (Adequate resource capacity to ensure availability is maintained.) and PR.PS-02 (Software is maintained, replaced, and removed commensurate with risk.).
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- PR.IR-03
- PR.IR-04
- PR.PS-02
- Develop configuration standards for all system components
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
enable_auto_repair - Checkov Check:
CKV_GCP_9 - Powerpipe Control:
gcp_compliance.control.enable_auto_repair - Trivy Check:
GCP-0063
Last reviewed: 2026-10-09