# Ensure Kubernetes Cluster Auto-Upgrade Is Enabled

- Source: https://support.icompaas.com/support/solutions/articles/ensure-kubernetes-cluster-auto-upgrade-is-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [DigitalOcean Cloud](https://support.icompaas.com/support/solutions/c_do_cloud) › [DigitalOcean Rules](https://support.icompaas.com/support/solutions/folders/digitalocean-rules)
- Last updated: 2026-08-13
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## Description

This rule verifies that automatic minor-patch upgrades are enabled on the DOKS cluster, so it stays current with releases that address security fixes and bugs without requiring a manual upgrade for every patch. It inspects the cluster's auto\_upgrade setting.

On DigitalOcean, auto-upgrade applies minor patch versions during the cluster's maintenance window. Clusters left on manual management commonly fall behind, accumulating known, unpatched vulnerabilities as upgrades get deprioritized against other work.

-   Clusters with auto\_upgrade disabled.
    
-   Clusters running a patch version well behind the latest available.
    
-   Clusters with auto-upgrade on but no maintenance window, so timing is unpredictable.
    

## Rationale

Kubernetes patch releases regularly fix security vulnerabilities in the control plane and kubelet. When upgrades are manual, they compete with feature work and are frequently postponed, leaving the cluster exposed to publicly known CVEs for extended periods. Enabling auto-upgrade closes that gap automatically.

Automatic patching also reduces the operational risk of large, infrequent jumps between versions. Small, regular, scheduled upgrades are far less disruptive than deferring for months and then upgrading across several versions at once.

-   Keeps the cluster patched against known CVEs without human follow-through.
    
-   Favors small, frequent upgrades over risky big-bang catch-ups.
    

## Impact

Pros:

-   Security and bug-fix patches are applied promptly and predictably.
    
-   Removes the toil and lag of manual patch tracking.
    
-   Runs inside the maintenance window, limiting business-hours impact.
    

Cons:

-   Upgrades cause brief node churn that workloads must tolerate.
    
-   A patch could surface an application incompatibility with little advance notice.
    
-   Auto-upgrade covers minor patch versions, not minor-version jumps, which still need planning.
    

## Default Value

Auto-upgrade is disabled by default on DigitalOcean Kubernetes; you must enable it explicitly.

## Pre-Requisite

-   Control Panel access to the cluster's Settings, or an API token / authenticated doctl.
    
-   A configured maintenance window so upgrades run at a low-impact time (see the related maintenance-window rule).
    
-   PodDisruptionBudgets on critical workloads so the upgrade drains gracefully.
    

## Remediation

### Test Plan

Using the DigitalOcean Control Panel:

1.  Sign in to cloud.digitalocean.com and open Kubernetes.
    
2.  Select the cluster and open the Settings tab.
    
3.  Find the 'Automatically upgrade minor version patches' section and check whether the box is ticked.
    
4.  Pass: automatic patch upgrades are enabled.
    
5.  Fail: automatic patch upgrades are disabled.
    

Using doctl or the API:

Read the auto\_upgrade flag from the cluster object.

doctl kubernetes cluster get <cluster-id> --format Name,AutoUpgrade

curl -s -H "Authorization: Bearer $DIGITALOCEAN\_TOKEN" "https://api.digitalocean.com/v2/kubernetes/clusters/$CLUSTER\_ID" | jq '.kubernetes\_cluster.auto\_upgrade'

Pass if auto\_upgrade = true. Fail if auto\_upgrade = false.

### Implementation Steps

Using the DigitalOcean Control Panel:

1.  Open the cluster's Settings tab in the Control Panel.
    
2.  In 'Automatically upgrade minor version patches', tick the checkbox to enable automatic installs.
    
3.  Confirm or set an appropriate maintenance window in the 'Upgrade window' section.
    
4.  Save the change.
    

Using doctl or the API:

Enable auto-upgrade with doctl or by updating the cluster.

doctl kubernetes cluster update <cluster-id> --auto-upgrade=true

curl -s -X PUT -H "Authorization: Bearer $DIGITALOCEAN\_TOKEN" -H 'Content-Type: application/json' -d '{"auto\_upgrade":true}' "https://api.digitalocean.com/v2/kubernetes/clusters/$CLUSTER\_ID"

### Backout Plan:

1.  Open the cluster Settings (or run the update command again).
    
2.  Disable auto-upgrade: doctl kubernetes cluster update <cluster-id> --auto-upgrade=false.
    
3.  Save. You then own tracking and applying patches manually.
    

## References:

1.  [DOKS - Upgrade a cluster (auto-upgrade)](https://docs.digitalocean.com/products/kubernetes/how-to/upgrade-cluster/)
    
2.  [DOKS - Features](https://docs.digitalocean.com/products/kubernetes/details/features/)
    
3.  [doctl kubernetes cluster update reference](https://docs.digitalocean.com/reference/doctl/reference/kubernetes/cluster/update/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.