Enable Diagnostic Platform Logs and Metrics

Trung bìnhCấp 1Xem xét thủ côngaks

Mô tả

With Azure Kubernetes Service (AKS), control plane components such as the Kubernetes API server and Kubernetes controller manager are provided as part of a managed service. You create and manage the worker nodes that run the kubelet and container runtime, and you deploy your applications through the managed Kubernetes API. The benchmark marks this recommendation Manual.

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

AKS audit logs are not fully enabled by default when you create a cluster. What is on by default is the Azure Activity Log for Azure resource operations and AKS platform metrics. But the Kubernetes control plane/resource logs such as kube-audit, kube-audit-admin, kube-apiserver, kube-controller-manager, and similar logs are not collected or stored until you create a diagnostic setting and route them to a destination such as Log Analytics.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

To enable log collection for the Kubernetes master components in your AKS cluster, open the Azure portal in a web browser and complete the following steps: 1. Create or identify a Log Analytics workspace in the same subscription as the AKS cluster. 2. In the Azure portal, open your AKS cluster. 3. In the left menu, go to Monitoring, then select Diagnostic settings. 4. Select + Add diagnostic setting. 5. Enter a name such as Collect Control Plane Logs. 6. Under destination, choose Send to Log Analytics workspace and select the workspace you want to use. 7. Select the AKS log categories you want to collect.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: akscontrol-planelogging
Tham chiếu: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 2.1.1 Enable Diagnostic Platform Logs and Metrics