Enable Cloud Logging and Cloud Monitoring for GKE clusters

Cara pemeriksaan

Metode audit: Perintah shell

out=$(gcloud container clusters describe "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(loggingService,monitoringService,loggingConfig.componentConfig.enableComponents.list(),monitoringConfig.componentConfig.enableComponents.list())') || exit 1
set -- $(printf '%s' "$out" | tr '\t' '|' | awk -F '|' '{for(i=1;i<=4;i++) printf "%s ", ($i=="" ? "-" : $i)}')
ok=1
case "$1" in none|-) ok=0;; esac
case "$2" in none|-) ok=0;; esac
case ",$3," in *SYSTEM_COMPONENTS*) ;; *) ok=0;; esac
case ",$3," in *WORKLOADS*) ;; *) ok=0;; esac
case ",$4," in *SYSTEM_COMPONENTS*) ;; *) ok=0;; esac
if [ "$ok" -eq 1 ]; then echo compliant; else echo "noncompliant: $out"; fi

Output yang diharapkan

compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Enable Cloud Logging and Cloud Monitoring for the required GKE components. At minimum, enable system logging and system monitoring so cluster operations, troubleshooting, and security investigations have centralized telemetry. Enable workload logging when application logs should be collected in Cloud Logging. gcloud container clusters update $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --logging=SYSTEM,WORKLOAD \ --monitoring=SYSTEM • Note: If additional observability is required, enable the appropriate monitoring components such as API server, scheduler, controller manager, kube state, cAdvisor, kubelet, storage, or GPU metrics based on the cluster’s operational requirements.

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

tmaegis scan --target gke