Back to Checks
alibabacloud

Kubernetes cluster has CloudMonitor enabled

cs_kubernetes_cloudmonitor_enabled
Service: csSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:ALIYUN::CS::ManagedKubernetesCluster

CloudMonitor agent provides visibility into system metrics for Kubernetes Engine clusters, including CPU, disk, network, and IO. Without it, operators lack observability into node and pod health. Enabling CloudMonitor creates a controller that collects metrics from each node's Pods and containers for analysis and alerting.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Without CloudMonitor, there is no automated collection of system metrics (CPU, memory, disk, network). This delays detection of resource exhaustion, node failures, and abnormal workloads, increasing risk of undetected availability issues. It also impairs identification of denial-of-service or cryptojacking on cluster nodes.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks cs_kubernetes_cloudmonitor_enabled

Recommendation

Enable the CloudMonitor agent during cluster creation by setting CloudMonitor Agent to Enabled. For existing clusters, verify that cms_enabled is set to true for all node pools.

Remediation

CLI

aliyun cs GET /clusters/<cluster_id>/nodepools --header 'Content-Type=application/json' | jq '.nodepools[].kubernetes_config.cms_enabled'

Other

1Log on to the **ACK Console**.
2Select the target cluster and click its name to open the cluster detail page.
3Select **Nodes** on the left column and click the **Monitor** link on the Actions column of the selected node.
4Verify that OS Metrics data exists in the CloudMonitor page.
5To enable: Click **Create Kubernetes Cluster** and set `CloudMonitor Agent` to **Enabled** under creation options.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.cs.cs_client import cs_client


class cs_kubernetes_cloudmonitor_enabled(Check):
    """Check if CloudMonitor is enabled on Kubernetes Engine Clusters."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        for cluster in cs_client.clusters:
            report = CheckReportAlibabaCloud(metadata=self.metadata(), resource=cluster)
            report.region = cluster.region
            report.resource_id = cluster.id
            report.resource_arn = f"acs:cs:{cluster.region}:{cs_client.audited_account}:cluster/{cluster.id}"

            if cluster.cloudmonitor_enabled:
                report.status = "PASS"
                report.status_extended = f"Kubernetes cluster {cluster.name} has CloudMonitor Agent enabled on all node pools."
            else:
                report.status = "FAIL"
                report.status_extended = f"Kubernetes cluster {cluster.name} does not have CloudMonitor Agent enabled on all node pools."

            findings.append(report)

        return findings

References