Google CloudOverview
Container-Optimized OS is an operating system image for your Compute Engine VMs that is optimized for running Docker containers. With Container-Optimized OS, you can bring up your Docker containers on Google Cloud Platform quickly, efficiently, and securely.
Rationale
The Container-Optimized OS node image is based on a recent version of the Linux kernel and is optimized to enhance node security. It is backed by a team at Google that can quickly patch it for security and iterate on features. The Container-Optimized OS image provides better support, security, and stability than previous images. Container-Optimized OS requires Kubernetes version 1.4.0 or higher.
Enabling Container-Optimized OS provides the following benefits:
- Run Containers Out of the Box: Container-Optimized OS instances come pre- installed with the Docker runtime and cloud-init. With a Container-Optimized OS instance, you can bring up your Docker container at the same time you create your VM, with no on-host setup required.
- Smaller attack surface: Container-Optimized OS has a smaller footprint, reducing your instance's potential attack surface.
- Locked-down by default: Container-Optimized OS instances include a locked-down firewall and other security settings by default.
- Automatic Updates: Container-Optimized OS instances are configured to automatically download weekly updates in the background; only a reboot is necessary to use the latest updates.
Remediation guidance
Using Console
- Go to Kubernetes GCP Console by visiting https://console.cloud.google.com/kubernetes/list?
- Select Kubernetes clusters for which Container-Optimized OS (cos) is not used
- Click on EDIT button and Set Node image to Container-Optimized OS under Node Pools section
Using Command Line
To enable Automatic node upgrades for an existing cluster's node pool, run the following command:
gcloud container clusters upgrade --image-type cos \[CLUSTER_NAME\] --zone \[COMPUTE_ZONE\] --node-pool \[POOL_NAME\]
Impact
Upgrade operation is long-running and will block other operations on the cluster (including delete) until it has run to completion.
Default Value
Container-Optimized OS is the default option for a cluster node image.
References
- https://cloud.google.com/kubernetes-engine/docs/concepts/node-images 2. https://cloud.google.com/container-optimized-os/docs/
Notes
Container-Optimized OS is still under active development, and some of the features and limitations below are subject to change by Google, and functionality should improve in future versions.
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
Google Cloud
Use organization or folder policies where available, shared project templates, logs and alerting baselines, and IaC modules so new resources inherit the secure setting.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
Container-Optimized OS (cos) is used for Kubernetes Engine Clusters Node image
Connectors
Covered asset types
Expected check: eq []
{gkeClusters(where: {nodePools_SOME: {nodeConfig_NOT: { imageType_MATCHES: "(?i).*cos.*" }}}) {...AssetFragment}}
