Description
This rule verifies that automatic minor-patch upgrades are enabled on the DOKS cluster, so it stays current with releases that address security fixes and bugs without requiring a manual upgrade for every patch. It inspects the cluster's auto_upgrade setting.
On DigitalOcean, auto-upgrade applies minor patch versions during the cluster's maintenance window. Clusters left on manual management commonly fall behind, accumulating known, unpatched vulnerabilities as upgrades get deprioritized against other work.
Clusters with auto_upgrade disabled.
Clusters running a patch version well behind the latest available.
Clusters with auto-upgrade on but no maintenance window, so timing is unpredictable.
Rationale
Kubernetes patch releases regularly fix security vulnerabilities in the control plane and kubelet. When upgrades are manual, they compete with feature work and are frequently postponed, leaving the cluster exposed to publicly known CVEs for extended periods. Enabling auto-upgrade closes that gap automatically.
Automatic patching also reduces the operational risk of large, infrequent jumps between versions. Small, regular, scheduled upgrades are far less disruptive than deferring for months and then upgrading across several versions at once.
Keeps the cluster patched against known CVEs without human follow-through.
Favors small, frequent upgrades over risky big-bang catch-ups.
Impact
Pros:
Security and bug-fix patches are applied promptly and predictably.
Removes the toil and lag of manual patch tracking.
Runs inside the maintenance window, limiting business-hours impact.
Cons:
Upgrades cause brief node churn that workloads must tolerate.
A patch could surface an application incompatibility with little advance notice.
Auto-upgrade covers minor patch versions, not minor-version jumps, which still need planning.
Default Value
Auto-upgrade is disabled by default on DigitalOcean Kubernetes; you must enable it explicitly.
Pre-Requisite
Control Panel access to the cluster's Settings, or an API token / authenticated doctl.
A configured maintenance window so upgrades run at a low-impact time (see the related maintenance-window rule).
PodDisruptionBudgets on critical workloads so the upgrade drains gracefully.
Remediation
Test Plan
Using the DigitalOcean Control Panel:
Sign in to cloud.digitalocean.com and open Kubernetes.
Select the cluster and open the Settings tab.
Find the 'Automatically upgrade minor version patches' section and check whether the box is ticked.
Pass: automatic patch upgrades are enabled.
Fail: automatic patch upgrades are disabled.
Using doctl or the API:
Read the auto_upgrade flag from the cluster object.
doctl kubernetes cluster get <cluster-id> --format Name,AutoUpgrade
curl -s -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" "https://api.digitalocean.com/v2/kubernetes/clusters/$CLUSTER_ID" | jq '.kubernetes_cluster.auto_upgrade'
Pass if auto_upgrade = true. Fail if auto_upgrade = false.
Implementation Steps
Using the DigitalOcean Control Panel:
Open the cluster's Settings tab in the Control Panel.
In 'Automatically upgrade minor version patches', tick the checkbox to enable automatic installs.
Confirm or set an appropriate maintenance window in the 'Upgrade window' section.
Save the change.
Using doctl or the API:
Enable auto-upgrade with doctl or by updating the cluster.
doctl kubernetes cluster update <cluster-id> --auto-upgrade=true
curl -s -X PUT -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" -H 'Content-Type: application/json' -d '{"auto_upgrade":true}' "https://api.digitalocean.com/v2/kubernetes/clusters/$CLUSTER_ID"
Backout Plan:
Open the cluster Settings (or run the update command again).
Disable auto-upgrade: doctl kubernetes cluster update <cluster-id> --auto-upgrade=false.
Save. You then own tracking and applying patches manually.