GCP Terraform Misconfiguration: GKE Cluster Node Auto-Repair Disabled

A Terraform configuration disables node auto-repair for a GKE node pool.

Every cloud service security feature is designed to prevent or mitigate a known threat. When disabled by intent or negligence, it offers no protection.

By default, if a GKE node repeatedly reports an unhealthy status over a given period, GKE initiates a repair process for that node. Disabling node auto-repair prevents timely and automated replacements of unhealthy nodes on which mission-critical workloads might run.

Example 1: The following Terraform configuration disables node auto-repair of a node pool by setting auto_repair to false in the management block.

resource "google_container_node_pool" "node-pool-demo" {
...
  management {
    auto_repair = false
    ...
  }
...
}