Skip to main content

More Info:

Enable Cloud Logging and Cloud Monitoring for the cluster so system and workload logs and metrics are collected for troubleshooting and security analysis. Missing telemetry hinders detection and response.

Risk Level

Medium

Address

Security

Compliance Standards

  • CIS GKE

Triage and Remediation

Remediation

Manual Steps

  1. Gather current logging/monitoring configuration
    • Run on any machine with gcloud access:
  2. Assess whether cluster-level services are enabled
    • From the output, check loggingService and monitoringService.
    • If either is none, or not a Cloud Logging/Cloud Monitoring service, logging/monitoring is effectively disabled at the cluster level and should be corrected.
  3. Assess which components are sending logs and metrics
    • In the same JSON, review loggingConfig.componentConfig.enableComponents and monitoringConfig.componentConfig.enableComponents.
    • Confirm that at least control-plane and system components you rely on for security/troubleshooting (e.g., SYSTEM_COMPONENTS, WORKLOADS, APISERVER, etc.) are enabled per your logging/monitoring policy.
  4. Decide desired telemetry coverage with stakeholders
    • Based on your organization’s requirements (compliance, incident response, cost constraints), decide:
      • Which logging components to enable (e.g., SYSTEM_COMPONENTS,WORKLOADS,APISERVER)
      • Which monitoring components to enable (e.g., SYSTEM_COMPONENTS,WORKLOADS)
    • Document this as the target configuration for this cluster.
  5. Apply the chosen configuration
    • Run on any machine with gcloud access, replacing the comma‑separated lists with your chosen components:
    • Coordinate with operations: this changes control-plane telemetry but does not restart workloads.
  6. Verify the change and basic data flow
    • Re-run the audit command:
    • Confirm loggingService/monitoringService and the enabled components match your decision, then spot-check in the Cloud Logging and Cloud Monitoring consoles that new logs and metrics are appearing for the cluster.
kubectl cannot enable or configure Cloud Logging or Cloud Monitoring because these settings are managed at the GKE control-plane level via the Google Cloud console, gcloud CLI, or IaC. To remediate this finding, make the changes in the cluster configuration using those tools as described in the Manual Steps section.
Run from: any machine with gcloud, jq, and access to the GCP project.Problem indicators to look for in the output:
  • loggingService is logging.googleapis.com/none or empty.
  • monitoringService is monitoring.googleapis.com/none or empty.
  • For newer clusters using loggingConfig / monitoringConfig, required components (e.g. SYSTEM_COMPONENTS, WORKLOADS, APISERVER, etc.) are missing from the respective *Config fields.
These conditions indicate that Cloud Logging and/or Cloud Monitoring is not fully enabled and need manual review and a decision on which components to enable, followed by the gcloud container clusters update ... --logging=... --monitoring=... commands as appropriate.