Description

Ensure the security update policy of every Managed Kubernetes cluster is set to Maximum security or Minimum unavailability, and not to Do not update, so that patch-level security updates are applied to the cluster.

Rationale

With Do not update, security patches are not applied to the cluster's Kubernetes components and nodes, leaving known vulnerabilities open. Maximum security, which OVHcloud recommends, applies patches automatically so the cluster stays protected.

Impact

  • Security patches are applied automatically

  • Nodes may restart during rolling updates

  • Workloads should tolerate node restarts

Default Value

By default, the security update policy is Maximum security.

Pre-Requisites

  • Permission to manage the Kubernetes cluster

Test Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the left-hand menu, select Managed Kubernetes Service, then click the cluster name to open it.

  4. In the Management section, check the current security policy.

  5. If it is Do not update, follow the implementation steps.

Implementation Steps

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the left-hand menu, select Managed Kubernetes Service, then click the cluster name to open it.

  4. In the Management section, click Change security policy.

  5. Select Maximum security (or Minimum unavailability) and save.

Backout Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the left-hand menu, select Managed Kubernetes Service, then click the cluster name to open it.

  4. In the Management section, click Change security policy, select the previous option, and save.

Reference