GKE clusters should use Container-Optimized OS (COS)
The powerpipe check gke_container_optimized_os is titled "Ensure Container-Optimized OS (cos) is used for Kubernetes engine clusters". It runs the query kubernetes_cluster_node_config_image_cos_containerd. Its severity is high.
What this control checks
GKE cluster nodes must run Container-Optimized OS (COS) as their node image
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.gke_container_optimized_os.
Framework-specific interpretation
PCI DSS v3.2.1: Mapped to 10.4.1 (Critical systems have the correct and consistent time), 10.4.3 (Time settings are received from industry-accepted time sources) and 2.2 (Develop configuration standards for all system components. Assure that these standards address all known security...).
Framework mappings
The clauses this control is mapped to in each framework.
- 10.4.1 Critical systems have the correct and consistent time
- 10.4.3 Time settings are received from industry-accepted time sources
- Develop configuration standards for all system components
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
gke_container_optimized_os - Powerpipe Control:
gcp_compliance.control.gke_container_optimized_os
Last reviewed: 2026-10-09