# Cis Gke V170 5.5.2

> Ensure Node Auto-Repair is enabled for GKE nodes (Automated)

- Skill: `cyberstrikeus/cis-gke-v170-5-5-2` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-gke-v170-5-5-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-gke-v170-5-5-2/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-gke-v170-5-5-2

---


# 5.5.2 Ensure Node Auto-Repair is enabled for GKE nodes (Automated)

## Profile Applicability

- Level 2

## Description

Nodes in a degraded state are an unknown quantity and so may pose a security risk.

## Rationale

Kubernetes Engine's node auto-repair feature helps you keep the nodes in the cluster in a healthy, running state. When enabled, Kubernetes Engine makes periodic checks on the health state of each node in the cluster. If a node fails consecutive health checks over an extended time period, Kubernetes Engine initiates a repair process for that node.

## Impact

If multiple nodes require repair, Kubernetes Engine might repair them in parallel. Kubernetes Engine limits number of repairs depending on the size of the cluster (bigger clusters have a higher limit) and the number of broken nodes in the cluster (limit decreases if many nodes are broken).

Node auto-repair is not available on Alpha Clusters.

## Audit

**Using Google Cloud Console:**

1. Go to Kubernetes Engine by visiting: https://console.cloud.google.com/kubernetes/list
2. From the list of clusters, select the desired cluster. For each Node pool, view the Node pool Details pane and ensure that under the 'Management' heading, 'Auto-repair' is set to 'Enabled'.

**Using Command Line:**

To check the existence of node auto-repair for an existing cluster's node pool, run:

```bash
gcloud container node-pools describe <node_pool_name> --cluster <cluster_name> --zone <compute_zone> --format json | jq '.management'
```

Ensure the output of the above command has JSON key attribute `autoRepair` set to `true`:

```json
{
  "autoRepair": true
}
```

## Remediation

**Using Google Cloud Console:**

1. Go to Kubernetes Engine by visiting: https://console.cloud.google.com/kubernetes/list
2. Select the Kubernetes cluster containing the node pool for which auto-repair is disabled.
3. Select the Node pool by clicking on the name of the pool.
4. Navigate to the Node pool details pane and click `EDIT`.
5. Under the `Management` heading, check the `Enable auto-repair` box.
6. Click `SAVE`.
7. Repeat steps 2-6 for every cluster and node pool with auto-upgrade disabled.

**Using Command Line:**

To enable node auto-repair for an existing cluster's Node pool:

```bash
gcloud container node-pools update <node_pool_name> --cluster <cluster_name> --zone <compute_zone> --enable-autorepair
```

## Default Value

Node auto-repair is enabled by default.

## References

1. https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-repair

## CIS Controls

| Controls Version | Control                                                                           | IG 1 | IG 2 | IG 3 |
| ---------------- | --------------------------------------------------------------------------------- | ---- | ---- | ---- |
| v8               | 7.6 Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets |      | x    | x    |
| v7               | 3.1 Run Automated Vulnerability Scanning Tools                                    |      | x    | x    |