# Ensure Maintenance Window Has Been Enabled For Kubernetes Cluster

- Source: https://support.icompaas.com/support/solutions/articles/ensure-maintenance-window-has-been-enabled-for-kubernetes-cluster
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [DigitalOcean Cloud](https://support.icompaas.com/support/solutions/c_do_cloud) › [DigitalOcean Rules](https://support.icompaas.com/support/solutions/folders/digitalocean-rules)
- Last updated: 2026-08-13
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## Description

This rule checks that a maintenance window is configured for the DOKS cluster, defining a predictable day and time at which upgrades and other disruptive maintenance run. It inspects the cluster's maintenance\_policy for a defined day and start time.

On DigitalOcean, the maintenance policy carries a start time (HH:MM UTC) and an optional day of week; auto-upgrades and platform maintenance are scheduled into that window. A well-chosen window pushes node churn into off-peak hours instead of an arbitrary moment during business hours.

-   Clusters relying only on the backend-assigned default window rather than a deliberate off-peak time.
    
-   Windows set during the workload's peak-traffic hours.
    
-   Windows misaligned with the team's on-call coverage.
    

## Rationale

Upgrades and maintenance cause nodes to be drained and replaced, which is briefly disruptive. If the timing is left to chance, that churn can land in the middle of peak business hours and amplify user impact. Pinning the maintenance window to a known low-traffic period makes the disruption predictable and lets teams anticipate it.

A defined window also makes auto-upgrade safe to enable: operators know when changes happen, can watch for issues, and can align on-call coverage with the scheduled churn.

-   Predictable timing lets teams staff and monitor upgrades.
    
-   Keeps disruptive node churn out of peak business hours.
    

## Impact

Pros:

-   Maintenance disruption is confined to a known, low-impact period.
    
-   Operational teams can anticipate and monitor node churn.
    
-   Makes auto-upgrade predictable and safer to rely on.
    

Cons:

-   Choosing a truly off-peak slot requires knowing your traffic pattern.
    
-   A single UTC window may be imperfect for globally distributed traffic.
    
-   Urgent security patches may still land outside the preferred window.
    

## Default Value

New clusters receive a default upgrade window chosen by the DigitalOcean Kubernetes backend to balance load across all windows; you can customize the day and start time.

## Pre-Requisite

-   Control Panel access to the cluster's Settings, or an API token / authenticated doctl.
    
-   Knowledge of the workload's low-traffic hours (in UTC).
    
-   Agreement with operational/on-call teams on the chosen window.
    

## Remediation

### Test Plan

Using the DigitalOcean Control Panel:

1.  Sign in to cloud.digitalocean.com and open Kubernetes.
    
2.  Select the cluster and open the Settings tab.
    
3.  Find the 'Upgrade window' section and review the configured day and time.
    
4.  Pass: a maintenance/upgrade window is set to a deliberate low-traffic day and time.
    
5.  Fail: no deliberate window is set (only the backend default) or the window falls in peak hours.
    

Using doctl or the API:

Read the maintenance\_policy from the cluster object. (doctl's --format has no MaintenancePolicy column, so read the full JSON with -o json.)

doctl kubernetes cluster get <cluster-id> -o json | jq '.\[0\].maintenance\_policy'

curl -s -H "Authorization: Bearer $DIGITALOCEAN\_TOKEN" "https://api.digitalocean.com/v2/kubernetes/clusters/$CLUSTER\_ID" | jq '.kubernetes\_cluster.maintenance\_policy'

Pass if maintenance\_policy has a day and start\_time set to a deliberate off-peak period. Fail if it is absent or clearly falls within the workload's peak hours.

### Implementation Steps

Using the DigitalOcean Control Panel:

1.  Open the cluster's Settings tab in the Control Panel.
    
2.  In the 'Upgrade window' section, click Edit.
    
3.  Choose a preferred time of day and, optionally, a day of week during a low-traffic period.
    
4.  Save, and communicate the scheduled window to relevant operational teams.
    

Using doctl or the API:

Set the maintenance window with doctl or by updating the cluster.

doctl kubernetes cluster update <cluster-id> --maintenance-window sunday=05:00

curl -s -X PUT -H "Authorization: Bearer $DIGITALOCEAN\_TOKEN" -H 'Content-Type: application/json' -d '{"maintenance\_policy":{"day":"sunday","start\_time":"05:00"}}' "https://api.digitalocean.com/v2/kubernetes/clusters/$CLUSTER\_ID"

### Backout Plan:

1.  Open the 'Upgrade window' editor (or run the update command again).
    
2.  Set a different day/time, or use 'any' as the day to let DigitalOcean pick.
    
3.  Save.
    

## References:

1.  [DOKS - Upgrade a cluster (maintenance window)](https://docs.digitalocean.com/products/kubernetes/how-to/upgrade-cluster/)
    
2.  [doctl kubernetes cluster update reference](https://docs.digitalocean.com/reference/doctl/reference/kubernetes/cluster/update/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.