GCP Kubernetes Engine Clusters have Cloud Monitoring disabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_GCP_8
Category - Subcategory	Kubernetes - Logging And Monitoring
Provider	GCP
Severity	LOW
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	d1bad16c-40ed-485f-8638-27cfa5983ed8

Impact

Stackdriver is the default logging solution for clusters deployed on GKE. Stackdriver logging is deployed to a new cluster by default, explicitly set to opt-out. Stackdriver logging collects only the container's standard output and standard error streams. To ingest logs, Stackdriver logging agent must be deployed to each node in the cluster. Stackdriver provides a single-pane-of-glass view of metrics, logs, and traces through Kubernetes Engine clusters and workloads. We recommend you use Stackdriver logging as a unified data logging solution for GKE workloads unless additional observability tooling is already in place.

How to Fix

[source,go]

resource "google_container_cluster" "primary" { name = "my-gke-cluster" location = "us-central1" remove_default_node_pool = true initial_node_count = 1 monitoring_service = "monitoring.googleapis.com/kubernetes" }