Google Cloud Compliance ControlsGoogle Kubernetes Engine
GKE clusters should use Container-Optimized OS (COS)
The powerpipe check gke_container_optimized_os is titled "Ensure Container-Optimized OS (cos) is used for Kubernetes engine clusters". It runs the query kubernetes_cluster_node_config_image_cos_containerd. Its severity is high.
What this control checks
GKE cluster nodes must run Container-Optimized OS (COS) as their node image
Framework mappings
The clauses this control is mapped to in each framework.
- 10.4.1 Critical systems have the correct and consistent time
- 10.4.3 Time settings are received from industry-accepted time sources
- Develop configuration standards for all system components
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
gke_container_optimized_os - Powerpipe Control:
gcp_compliance.control.gke_container_optimized_os
Last reviewed: 2026-10-09