gke/BP/2026_002

GKE control plane logging and monitoring enabled.

Product: Google Kubernetes Engine
Rule class: BP - Best practice, opinionated recommendation

Description

Control plane logging and monitoring (API_SERVER, SCHEDULER, and CONTROLLER_MANAGER) are essential for troubleshooting cluster-level issues and monitoring the health of the GKE control plane.

Remediation

Using the Google Cloud Console

To enable GKE control plane logging and monitoring:

  1. Go to the Kubernetes Engine > Clusters page in the Google Cloud Console.
  2. Click the name of the cluster to modify.
  3. Under the Details tab, locate the Features section.
  4. Click the edit icon (pencil) next to Logging or Monitoring configuration.
  5. Enable the control plane components to collect logs/metrics for:
    • API server
    • Scheduler
    • Controller manager
  6. Click Save.

Using gcloud CLI

To enable control plane logging and monitoring for API_SERVER, SCHEDULER, and CONTROLLER_MANAGER, run the following commands:

Enable Control Plane Logging:

gcloud container clusters update CLUSTER_NAME \
    --location=LOCATION \
    --logging=SYSTEM,WORKLOAD,API_SERVER,SCHEDULER,CONTROLLER_MANAGER

Note: The --logging flag configures the list of components that write logs. Omitted components will have their logs disabled, so be sure to include SYSTEM and WORKLOAD if they were previously enabled and need to be retained.

Enable Control Plane Monitoring:

gcloud container clusters update CLUSTER_NAME \
    --location=LOCATION \
    --monitoring=SYSTEM,API_SERVER,SCHEDULER,CONTROLLER_MANAGER

Note: GKE control plane metrics collection requires system metrics (SYSTEM) to be enabled.

Further information