gke/ERR/2026_002

GKE cluster credentials and certificate authority are fully rotated and valid.

Product: Google Kubernetes Engine
Rule class: ERR - Something that is very likely to be wrong

Description

GKE clusters require periodic credential rotation to ensure the Certificate Authority (CA) certificates are rotated before they expire. Running clusters with old certificates (approaching expiration within 30 days) or incomplete rotations increases security risks and could lead to cluster unrecoverability if they expire.

GKE delivers guidance and automated warnings if a cluster’s credentials expire in the next 180 days. Seven days prior to expiration, the cluster enters a DEGRADED state. Proactively rotate credentials well in advance during planned maintenance windows to prevent workload disruption.

Remediation

Perform a complete credential rotation using the gcloud CLI. A rotation requires initiating the operation, recreating nodes to consume new credentials, and formally completing the rotation to revoke old credentials.

Start the rotation:

gcloud container clusters update CLUSTER_NAME \
    --region=COMPUTE_REGION \
    --start-credential-rotation

Recreate nodes: Depending on the configuration, GKE may automatically recreate nodes over time, or manual node pool upgrades can be triggered to expedite adoption.
Complete the rotation: Once all nodes have been recreated and verified, finalize the operation to revoke old CA certificates.
```
gcloud container clusters update CLUSTER_NAME \
    --region=COMPUTE_REGION \
    --complete-credential-rotation
```

Further information

Rotate cluster credentials