Ensure Stackdriver Kubernetes Logging And Monitoring Is Enabled
More Info:
Send logs and metrics to a remote aggregator to mitigate the risk of local tampering in the event of a breach.Risk Level
LowAddress
Security, Reliability, Operational Excellence, Performance EfficiencyCompliance Standards
CISGKETriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “Ensure Stackdriver Kubernetes Logging And Monitoring Is Enabled” for GCP using GCP console, follow the below steps:
- Login to the GCP console with valid credentials.
- Navigate to the Google Kubernetes Engine (GKE) cluster for which you want to enable Stackdriver Kubernetes Logging and Monitoring.
- Click on the “Edit” button at the top of the page.
- Scroll down to the “Stackdriver” section and click on it.
- Under the “Stackdriver Logging” section, toggle the switch to “Enabled”.
- Under the “Stackdriver Monitoring” section, toggle the switch to “Enabled”.
- Click on the “Save” button at the bottom of the page.
Using CLI
Using CLI
To remediate the misconfiguration of Stackdriver Kubernetes Logging and Monitoring not being enabled on GCP using GCP CLI, follow the below steps:
- Install and configure the Google Cloud SDK (CLI) on your local machine.
- Open the terminal or command prompt and authenticate to your GCP account using the following command:
- Set the default project for the CLI to the project where the Kubernetes cluster is deployed using the following command:
- Enable the Stackdriver Kubernetes Logging and Monitoring API for the project using the following command:
- Verify that the Stackdriver Kubernetes Logging and Monitoring API is enabled by running the following command:
- If the API is enabled, you should see the following services listed:
- Once the API is enabled, you can configure the Kubernetes cluster to send logs and metrics to Stackdriver by following the official GCP documentation:
Using Python
Using Python
To remediate the misconfiguration “Ensure Stackdriver Kubernetes Logging And Monitoring Is Enabled” for GCP using Python, you can follow these steps:Note: Replace
- Install the
google-cloud-monitoringandgoogle-cloud-loggingPython libraries usingpip.
- Create a service account with the necessary permissions to enable Stackdriver Kubernetes logging and monitoring.
-
Set the
GOOGLE_APPLICATION_CREDENTIALSenvironment variable to the path of the service account key file.
- Use the
google-cloud-monitoringandgoogle-cloud-logginglibraries to enable Stackdriver Kubernetes logging and monitoring.
project_id with your GCP project ID.- Verify that Stackdriver Kubernetes logging and monitoring is enabled by checking the Stackdriver Metrics Explorer and Logs Viewer in the GCP Console.