GKE nodes should have automatic node upgrades enabled
Checks that 'Automatic node upgrade' is enabled for Kubernetes Clusters. Kubernetes nodes must have auto upgrades set to true. Automatic updates keep nodes updated with the latest cluster master version.
Automatic updates keep nodes updated with the latest cluster master version.
What this control checks
Node 'auto_upgrade' must be enabled (true) for Kubernetes Clusters node pools
Common pitfalls
Auto upgrades must be set to true on Kubernetes nodes
Kubernetes nodes must have auto upgrades set to true, which means Node auto_upgrade should be enabled for Kubernetes Clusters.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.enable_auto_upgrade.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_10; KICS query "Node Auto Upgrade Disabled" (b139213e-7d24-49c2-8025-c18faa21ecaa); Trivy check GCP-0058.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to PR.IR-03 (Mechanisms are implemented to achieve resilience requirements in normal and adverse situations.), PR.IR-04 (Adequate resource capacity to ensure availability is maintained.) and PR.PS-02 (Software is maintained, replaced, and removed commensurate with risk.).
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- PR.IR-03
- PR.IR-04
- PR.PS-02
- Develop configuration standards for all system components
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
enable_auto_upgrade - Checkov Check:
CKV_GCP_10 - Powerpipe Control:
gcp_compliance.control.enable_auto_upgrade - KICS Query:
b139213e-7d24-49c2-8025-c18faa21ecaa - Trivy Check:
GCP-0058
Last reviewed: 2026-10-09