Google CloudOverview
Container-Optimized OS is an operating system image for your Compute Engine VMs that is optimized for running Docker containers. With Container-Optimized OS, you can bring up your Docker containers on Google Cloud Platform quickly, efficiently, and securely.
Rationale
The Container-Optimized OS node image is based on a recent version of the Linux kernel and is optimized to enhance node security. It is backed by a team at Google that can quickly patch it for security and iterate on features. The Container-Optimized OS image provides better support, security, and stability than previous images. Container-Optimized OS requires Kubernetes version 1.4.0 or higher.
Enabling Container-Optimized OS provides the following benefits:
- Run Containers Out of the Box: Container-Optimized OS instances come pre- installed with the Docker runtime and cloud-init. With a Container-Optimized OS instance, you can bring up your Docker container at the same time you create your VM, with no on-host setup required.
- Smaller attack surface: Container-Optimized OS has a smaller footprint, reducing your instance's potential attack surface.
- Locked-down by default: Container-Optimized OS instances include a locked-down firewall and other security settings by default.
- Automatic Updates: Container-Optimized OS instances are configured to automatically download weekly updates in the background; only a reboot is necessary to use the latest updates.
Remediation guidance
Using Console
- Go to Kubernetes GCP Console by visiting https://console.cloud.google.com/kubernetes/list?
- Select Kubernetes clusters for which Container-Optimized OS (cos) is not used
- Click on EDIT button and Set Node image to Container-Optimized OS under Node Pools section
Using Command Line
To enable Automatic node upgrades for an existing cluster's node pool, run the following command:
gcloud container clusters upgrade --image-type cos \[CLUSTER_NAME\] --zone \[COMPUTE_ZONE\] --node-pool \[POOL_NAME\]
Impact
Upgrade operation is long-running and will block other operations on the cluster (including delete) until it has run to completion.
Default Value
Container-Optimized OS is the default option for a cluster node image.
References
- https://cloud.google.com/kubernetes-engine/docs/concepts/node-images 2. https://cloud.google.com/container-optimized-os/docs/
Notes
Container-Optimized OS is still under active development, and some of the features and limitations below are subject to change by Google, and functionality should improve in future versions.
Multiple Remediation Paths
Google Cloud
SERVICE-WIDE (RECOMMENDED when many resources are affected): Enforce Organization Policies at org/folder level so new resources inherit secure defaults.
gcloud org-policies set-policy policy.yaml
ASSET-LEVEL: Use the product-specific remediation steps above for only the impacted project/resources.
PREVENTIVE: Use org policy constraints/custom constraints and enforce checks in deployment pipelines.
References for Service-Wide Patterns
- GCP Organization Policy overview: https://cloud.google.com/resource-manager/docs/organization-policy/overview
- GCP Organization policy constraints catalog: https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints
- gcloud org-policies: https://cloud.google.com/sdk/gcloud/reference/org-policies
Operational Rollout Workflow
Use this sequence to reduce risk and avoid repeated drift.
1. Contain at Service-Wide Scope First (Recommended)
- Google Cloud: apply organization policy constraints at org/folder scope.
gcloud org-policies set-policy policy.yaml
2. Remediate Existing Affected Assets
- Execute the control-specific Console/CLI steps documented above for each flagged resource.
- Prioritize internet-exposed and production assets first.
3. Validate and Prevent Recurrence
- Re-scan after each remediation batch.
- Track exceptions with owner and expiry date.
- Add preventive checks in IaC/CI pipelines.
Query logic
These are the stored checks tied to this control.
Container-Optimized OS (cos) is used for Kubernetes Engine Clusters Node image
Connectors
Covered asset types
Expected check: eq []
{gkeClusters(where: {nodePools_SOME: {nodeConfig_NOT: { imageType_MATCHES: "(?i).*cos.*" }}}) {...AssetFragment}}
