[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-01。"],[],[],null,["# Posture management deprecations\n\n[Autopilot](/kubernetes-engine/docs/concepts/autopilot-overview) [Standard](/kubernetes-engine/docs/concepts/choose-cluster-mode)\n\n*** ** * ** ***\n\nThis page describes deprecations and removals for various security posture\nmanagement and compliance posture management features in\nGoogle Kubernetes Engine (GKE) and GKE Enterprise. This information\napplies to you if you use any of the following features in the Google Cloud console:\n\n- [GKE security posture dashboard](/kubernetes-engine/docs/concepts/about-security-posture-dashboard)\n- GKE Compliance dashboard (Preview)\n\nAbout the posture management dashboards\n---------------------------------------\n\nGKE provides dashboards in the Google Cloud console to\nmonitor the security posture of your GKE clusters and any\ncompliance violations in your fleet. These dashboards support the following\ncapabilities:\n\n- GKE security posture dashboard: monitor the security\n posture of GKE clusters and workloads. Supports the following\n features:\n\n - Kubernetes security posture - standard tier:\n\n - Workload configuration auditing\n - Actionable security bulletin surfacing (Preview)\n - Kubernetes security posture - advanced tier:\n\n - GKE threat detection (Preview) (GKE Enterprise only)\n - Workload vulnerability scanning - standard tier\n\n - Workload vulnerability scanning - Advanced Vulnerability Insights\n\n - Supply chain concerns - Binary Authorization (Preview)\n\n- GKE Compliance dashboard (Preview) (GKE Enterprise only):\n monitor the compliance status of your workloads against industry standards\n like the CIS Benchmarks for GKE.\n\nDeprecated features\n-------------------\n\nStarting on January 28, 2025, specific posture management\ncapabilities are deprecated. The following table lists the deprecated\ncapabilities with deprecation dates, estimated removal dates, and links to learn\nmore.\n| **Note:** There is no expected disruption to running clusters and workloads because of these deprecations. If you take no actions by the removal dates in the following table, you won't see new or existing findings for that scanning type in the Google Cloud console.\n\nWhat happens when a capability is removed?\n------------------------------------------\n\nAfter the removal date of a capability, the following changes occur:\n\n- The Google Cloud console no longer generates new results for the capability. For example, GKE doesn't generate new GKE threat detection results after March 31, 2025.\n- You can't view existing results in the corresponding posture management dashboard. For example, you can't view existing container OS vulnerability scan results for GKE standard edition clusters after July 31, 2025.\n- Security Command Center findings for the capability get the `Inactive` state. Findings are deleted after the [Security Command Center data retention period](/security-command-center/docs/concepts-data-security-overview#data_retention).\n\nThe logs for your findings remain in the `_Default` log bucket in\nCloud Logging for the\n[log retention period](/logging/quotas#logs_retention_periods).\n\nWhat you should do\n------------------\n\nThis section describes any available alternatives that you can use to get\nsimilar monitoring capabilities for your clusters and workloads.\n\n### Workload vulnerability scanning\n\nBoth tiers of workload vulnerability scanning are deprecated. For more\ninformation, see\n[Workload vulnerability scanning removal in GKE](/kubernetes-engine/docs/deprecations/vulnerability-scanning-gkee).\n\n### GKE threat detection\n\n|\n| **Preview\n| --- GKE threat detection**\n|\n|\n| This feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\nGKE threat detection evaluated your audit logs against a set of\nrules for cluster and workload threats. Active threats were displayed in the\nGoogle Cloud console with information about how to remediate the threat.\n\nGKE threat detection was powered by Security Command Center Event Threat Detection. To\ncontinue getting information from Security Command Center about active threats after\nMarch 31, 2025, see\n[Integration with Security Command Center](/kubernetes-engine/docs/concepts/about-security-posture-dashboard#scc-integration).\n\n### Supply chain concerns - Binary Authorization\n\n|\n| **Preview\n| --- supply chain concerns - Binary Authorization**\n|\n|\n| This feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\nIf you enabled the Binary Authorization API in a project, the GKE\nsecurity posture dashboard displayed results for running container images\nthat met any of the following criteria:\n\n- Images that used the `latest` tag implicitly or explicitly.\n- Images by digest that were uploaded to Artifact Registry or Container Registry (Deprecated) more than 30 days ago.\n\nTo continue monitoring your running containers for these issues after\nMarch 31, 2025, do the following:\n\n1. [Set up Binary Authorization in your cluster](/binary-authorization/docs/setting-up).\n2. [Enable the continuous validation image freshness check](/binary-authorization/docs/cv-freshness-check) (Preview).\n\nSetting up Binary Authorization in a cluster prevents you from deploying Pods that\ndon't specify a container image digest for every container. This ensures that\nworkloads don't use the `:latest` tag or omit a tag.\n\n### GKE Compliance dashboard\n\n|\n| **Preview\n| --- GKE Compliance dashboard**\n|\n|\n| This feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\nThe GKE Compliance dashboard is a GKE Enterprise feature that\nlets you scan your clusters against predefined industry standards like the\nCIS Benchmarks for GKE.\n\nStarting on June 30, 2025, the GKE Compliance dashboard no longer\ndisplays results for compliance violations in eligible clusters. You can't\nenable compliance auditing for new or existing clusters.\n\nTo get similar results for compliance violations, do the following:\n\n1. [Activate either the Premium or the Enterprise tier of Security Command Center](/security-command-center/docs/activate-scc-overview)\n2. [Assess and report compliance with security standards](/security-command-center/docs/compliance-management)"]]
