More Info:
Enable Cloud Logging and Cloud Monitoring for the cluster so system and workload logs and metrics are collected for troubleshooting and security analysis. Missing telemetry hinders detection and response.Risk Level
MediumAddress
SecurityCompliance Standards
- CIS GKE
Triage and Remediation
- Remediation
Remediation
Manual Steps
Manual Steps
-
Gather current logging/monitoring configuration
- Run on any machine with gcloud access:
- Run on any machine with gcloud access:
-
Assess whether cluster-level services are enabled
- From the output, check
loggingServiceandmonitoringService. - If either is
none, or not a Cloud Logging/Cloud Monitoring service, logging/monitoring is effectively disabled at the cluster level and should be corrected.
- From the output, check
-
Assess which components are sending logs and metrics
- In the same JSON, review
loggingConfig.componentConfig.enableComponentsandmonitoringConfig.componentConfig.enableComponents. - Confirm that at least control-plane and system components you rely on for security/troubleshooting (e.g.,
SYSTEM_COMPONENTS,WORKLOADS,APISERVER, etc.) are enabled per your logging/monitoring policy.
- In the same JSON, review
-
Decide desired telemetry coverage with stakeholders
- Based on your organization’s requirements (compliance, incident response, cost constraints), decide:
- Which logging components to enable (e.g.,
SYSTEM_COMPONENTS,WORKLOADS,APISERVER) - Which monitoring components to enable (e.g.,
SYSTEM_COMPONENTS,WORKLOADS)
- Which logging components to enable (e.g.,
- Document this as the target configuration for this cluster.
- Based on your organization’s requirements (compliance, incident response, cost constraints), decide:
-
Apply the chosen configuration
- Run on any machine with gcloud access, replacing the comma‑separated lists with your chosen components:
- Coordinate with operations: this changes control-plane telemetry but does not restart workloads.
- Run on any machine with gcloud access, replacing the comma‑separated lists with your chosen components:
-
Verify the change and basic data flow
- Re-run the audit command:
- Confirm
loggingService/monitoringServiceand the enabled components match your decision, then spot-check in the Cloud Logging and Cloud Monitoring consoles that new logs and metrics are appearing for the cluster.
- Re-run the audit command:
Using kubectl
Using kubectl
kubectl cannot enable or configure Cloud Logging or Cloud Monitoring because these settings are managed at the GKE control-plane level via the Google Cloud console, gcloud CLI, or IaC. To remediate this finding, make the changes in the cluster configuration using those tools as described in the Manual Steps section.
Automation
Automation
gcloud, jq, and access to the GCP project.Problem indicators to look for in the output:loggingServiceislogging.googleapis.com/noneor empty.monitoringServiceismonitoring.googleapis.com/noneor empty.- For newer clusters using
loggingConfig/monitoringConfig, required components (e.g.SYSTEM_COMPONENTS,WORKLOADS,APISERVER, etc.) are missing from the respective*Configfields.
gcloud container clusters update ... --logging=... --monitoring=... commands as appropriate.
