# Ensure Kubernetes Security Patch Policy Is Not Disabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1791826030629818-ensure-kubernetes-security-patch-policy-is-not-disabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [OVH Cloud](https://support.icompaas.com/support/solutions/c_1791819364512367) › [checks](https://support.icompaas.com/support/solutions/folders/f_1791819376721251)
- Last updated: 2026-10-12
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure the security update policy of every Managed Kubernetes cluster is set to Maximum security or Minimum unavailability, and not to Do not update, so that patch-level security updates are applied to the cluster.

**Rationale**

With Do not update, security patches are not applied to the cluster's Kubernetes components and nodes, leaving known vulnerabilities open. Maximum security, which OVHcloud recommends, applies patches automatically so the cluster stays protected.

**Impact**

-   Security patches are applied automatically
    
-   Nodes may restart during rolling updates
    
-   Workloads should tolerate node restarts
    

**Default Value**

By default, the security update policy is Maximum security.

**Pre-Requisites**

-   Permission to manage the Kubernetes cluster
    

**Test Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Public Cloud and choose your project.
    
3.  In the left-hand menu, select Managed Kubernetes Service, then click the cluster name to open it.
    
4.  In the Management section, check the current security policy.
    
5.  If it is Do not update, follow the implementation steps.
    

**Implementation Steps**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Public Cloud and choose your project.
    
3.  In the left-hand menu, select Managed Kubernetes Service, then click the cluster name to open it.
    
4.  In the Management section, click Change security policy.
    
5.  Select Maximum security (or Minimum unavailability) and save.
    

**Backout Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Public Cloud and choose your project.
    
3.  In the left-hand menu, select Managed Kubernetes Service, then click the cluster name to open it.
    
4.  In the Management section, click Change security policy, select the previous option, and save.
    

**Reference**

-   [https://help.ovhcloud.com/csm/en-public-cloud-kubernetes-change-security-update?id=kb\_article\_view&sysparm\_article=KB0049649](https://help.ovhcloud.com/csm/en-public-cloud-kubernetes-change-security-update?id=kb_article_view&sysparm_article=KB0049649)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.