Skip to main content

Stackdriver Kubernetes Logging And Monitoring Is Enabled

More Info:​

Send Logs And Metrics To A Remote Aggregator To Mitigate The Risk Of Local Tampering In The Event Of A Breach.

Risk Level​

Low

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CIS GKE
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Manual Steps

  1. From any machine with gcloud and project access, list clusters and identify the affected one and its location (zone or region):

    gcloud config set project PROJECT_ID
    gcloud container clusters list --format="table(name,location,loggingService,monitoringService)"

  2. For the specific cluster, gather detailed logging/monitoring configuration:

    gcloud container clusters describe CLUSTER_NAME \
      --zone ZONE \
      --format="yaml(name,location,loggingService,monitoringService,monitoringConfig,loggingConfig)"

    Review whether:

    • monitoringConfig.managedPrometheus.enabled and other Stackdriver Kubernetes Engine Monitoring fields indicate it is enabled, or
    • loggingService is logging.googleapis.com and monitoringService is monitoring.googleapis.com (legacy mode).

  3. Decision point:

    • If you require Stackdriver Kubernetes Engine Monitoring (recommended), and it is not enabled, proceed to step 4A.
    • If you must stay on legacy logging/monitoring (e.g., due to constraints) and either loggingService or monitoringService is not correctly set, proceed to step 4B.
    • If one of these configurations already matches your policy, go to step 5 to verify runtime behavior only.

  4. Remediation (choose one path):

    4A. Enable Stackdriver Kubernetes Engine Monitoring (preferred) for the cluster:

    gcloud container clusters update CLUSTER_NAME \
      --zone ZONE \
      --enable-stackdriver-kubernetes

    4B. Enable legacy Stackdriver logging and monitoring:

    gcloud container clusters update CLUSTER_NAME \
      --zone ZONE \
      --logging-service logging.googleapis.com

    gcloud container clusters update CLUSTER_NAME \
      --zone ZONE \
      --monitoring-service monitoring.googleapis.com

  5. Verify configuration after the change:

    gcloud container clusters describe CLUSTER_NAME \
      --zone ZONE \
      --format="yaml(name,loggingService,monitoringService,monitoringConfig,loggingConfig)"

    Confirm that:

    • For preferred mode: Stackdriver Kubernetes Engine Monitoring fields are present/enabled, and/or
    • For legacy mode: loggingService: logging.googleapis.com and monitoringService: monitoring.googleapis.com.

  6. Optionally, validate data flow in Google Cloud Console:

    • In Cloud Logging, check “Logs Explorer” for recent logs from the cluster’s workloads and system components.
    • In Cloud Monitoring, check “Metrics Explorer” and GKE dashboards for recent metrics from the cluster.
Using kubectl

kubectl cannot enable or configure Stackdriver Kubernetes logging and monitoring because this setting is managed at the GKE control-plane / cluster configuration level via the Google Cloud Console, gcloud CLI, or IaC. To remediate this finding, follow the guidance in the Manual Steps section for updating the cluster’s logging and monitoring configuration.

Automation
#!/usr/bin/env bash
# Check Stackdriver / Cloud Monitoring & Logging status for all GKE clusters in a project.
# Requires: gcloud, jq

set -euo pipefail

PROJECT_ID="YOUR_PROJECT_ID_HERE"

if [[ "$PROJECT_ID" == "YOUR_PROJECT_ID_HERE" ]]; then
  echo "Set PROJECT_ID before running this script."
  exit 1
fi

echo "Listing clusters and their logging/monitoring config in project: ${PROJECT_ID}"
echo

gcloud container clusters list \
  --project "${PROJECT_ID}" \
  --format='table(
    name,
    location,
    loggingService,
    monitoringService,
    monitoringConfig.componentConfig.enableComponents.list():label=MonitoringComponents,
    loggingConfig.componentConfig.enableComponents.list():label=LoggingComponents
  )'

echo
echo "Raw JSON for automated analysis (optional):"
gcloud container clusters list \
  --project "${PROJECT_ID}" \
  --format=json > /tmp/gke_clusters_stackdriver.json

echo "Saved detailed cluster info to /tmp/gke_clusters_stackdriver.json"
echo
echo "To highlight clusters that may be non-compliant, run:"
cat <<'EOF'
jq -r '
  .[] |
  {
    name,
    location,
    loggingService,
    monitoringService,
    loggingComponents: (.loggingConfig.componentConfig.enableComponents // []),
    monitoringComponents: (.monitoringConfig.componentConfig.enableComponents // [])
  } |
  select(
    # Potential issues:
    # 1) Neither new-style components nor legacy services configured
    (
      ((.loggingComponents | length) == 0)
      and
      ((.monitoringComponents | length) == 0)
      and
      (.loggingService == "" or .loggingService == "none")
      and
      (.monitoringService == "" or .monitoringService == "none")
    )
    or
    # 2) Only logging OR only monitoring enabled (legacy style)
    (
      (.loggingService != "" and .loggingService != "none")
      and
      (.monitoringService == "" or .monitoringService == "none")
    )
    or
    (
      (.monitoringService != "" and .monitoringService != "none")
      and
      (.loggingService == "" or .loggingService == "none")
    )
  )
' /tmp/gke_clusters_stackdriver.json
EOF

Explanation of results to review:

  • Preferred (compliant modern) state:

    • MonitoringComponents and/or LoggingComponents columns show enabled components such as SYSTEM, WORKLOAD, APISERVER, etc.
    • These indicate Stackdriver Kubernetes Engine Monitoring/Logging is enabled via --enable-stackdriver-kubernetes / per-component config.

  • Legacy but acceptable (if you still use legacy Stackdriver):

    • loggingService is set to logging.googleapis.com (or another non-none logging endpoint)
    • monitoringService is set to monitoring.googleapis.com (or another non-none monitoring endpoint)

  • Problem indicators (clusters to investigate/remediate):

    • loggingService is empty or none AND monitoringService is empty or none, AND LoggingComponents / MonitoringComponents are empty:
      → No logging or monitoring configured.
    • Only logging OR only monitoring configured (legacy style):
      → One of loggingService / monitoringService is none or empty while the other is set.

Use this script from any machine with gcloud access to the project; it does not change configuration, only reports state for manual review and follow‑up using gcloud container clusters update ... as per the benchmark remediation.

Additional Reading:​