gke/BP/2026_001

GKE maintenance policy is valid and sufficient.

Product: Google Kubernetes Engine
Rule class: BP - Best practice, opinionated recommendation

Description

Check that the maintenance window is configured, not expired, and has a reasonable duration.

Remediation

To configure a maintenance window for a GKE cluster, use the Google Cloud Console or the gcloud CLI.

Using the Google Cloud Console

  1. Go to the Google Kubernetes Engine page in the Google Cloud console.
  2. Click the name of the cluster to modify.
  3. In the Automation section, locate the Maintenance window field and click the edit icon (or Edit maintenance policy).
  4. Select Enable Maintenance Window and configure the preferred recurring time window or simple daily window.
  5. Click Save Changes.

Using the gcloud CLI

To configure a recurring weekly maintenance window (e.g., every Monday and Friday starting at 02:00 UTC with a duration of 30 hours):

gcloud container clusters update CLUSTER_NAME \
    --region=COMPUTE_LOCATION \
    --maintenance-window-start 2026-01-01T02:00:00Z \
    --maintenance-window-duration 30H \
    --maintenance-window-recurrence 'FREQ=WEEKLY;BYDAY=MO,FR'

Alternatively, to configure a simple daily 4-hour maintenance window:

gcloud container clusters update CLUSTER_NAME \
    --region=COMPUTE_LOCATION \
    --maintenance-window=02:00

Note:

  • Time Zones: The Google Cloud Console displays and configures maintenance windows in the local time zone, whereas the gcloud CLI expects start times in UTC (using RFC3339 format, e.g. 2026-01-01T02:00:00Z).
  • Duration Requirements:
    • Ensure that the maintenance window has a total duration of at least 48 hours in any 32-day rolling period.
    • Individual windows should ideally be at least 4 hours long.
  • Expiration: Ensure that the recurrence rule (--maintenance-window-recurrence) does not have an expired UNTIL time. If it has expired, update or remove the UNTIL constraint from the recurrence rule.

Further information