Back to Checks
alibabacloud

Kubernetes cluster health check has been triggered within the configured period

cs_kubernetes_cluster_check_recent
Service: csSeverity: medium
OfficialBuilt-inVerified
Categories:cluster-security
Resource Type:ALIYUN::CS::ManagedKubernetesCluster

Alibaba Cloud Kubernetes Engine provides a cluster health check that validates node health and cluster configuration, including kubelet, docker daemon, kernel, and iptables settings. Running checks regularly ensures VPC/VSwitch, SLB, and ECS nodes function correctly. Consecutive failures generate diagnostic reports for corrective action.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Without regular cluster health checks, node failures, misconfigured network rules, or degraded components may go undetected, increasing the risk of cluster instability, service outages, and exploitable security vulnerabilities. Delayed detection of unhealthy nodes can impact the integrity and availability of workloads running on the cluster.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks cs_kubernetes_cluster_check_recent

Recommendation

Trigger a cluster health check regularly within the configured period to ensure all nodes and system components are healthy. Use the Global Check feature in the ACK Console or the aliyun cs CLI to verify and trigger checks.

Remediation

CLI

aliyun cs GET /clusters/<cluster_id>/checks --header 'Content-Type=application/json'

Other

1Log on to the **ACK Console**.
2Select the target cluster and open the **More** pop-menu for advanced options.
3Select **Global Check** and click the **Start** button to trigger the checking.
4Verify the checking time and details in Global Check.
5It is recommended to trigger cluster checks at least once within the configured period.

Check Code

from datetime import datetime, timedelta, timezone

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.cs.cs_client import cs_client


class cs_kubernetes_cluster_check_recent(Check):
    """Check if Cluster Check is triggered within the configured number of days."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        # Get configurable max days from audit config (default: 7 days)
        max_cluster_check_days = cs_client.audit_config.get("max_cluster_check_days", 7)

        # Calculate the threshold date
        threshold_date = datetime.now(timezone.utc) - timedelta(
            days=max_cluster_check_days
        )

        for cluster in cs_client.clusters:
            report = CheckReportAlibabaCloud(metadata=self.metadata(), resource=cluster)
            report.region = cluster.region
            report.resource_id = cluster.id
            report.resource_arn = f"acs:cs:{cluster.region}:{cs_client.audited_account}:cluster/{cluster.id}"

            if cluster.last_check_time:
                # Ensure last_check_time is timezone-aware
                last_check = cluster.last_check_time
                if last_check.tzinfo is None:
                    # If naive datetime, assume UTC
                    last_check = last_check.replace(tzinfo=timezone.utc)

                # Calculate days since last check
                days_since_check = (datetime.now(timezone.utc) - last_check).days

                if last_check >= threshold_date:
                    report.status = "PASS"
                    report.status_extended = (
                        f"Kubernetes cluster {cluster.name} has had a successful cluster check "
                        f"within the last {max_cluster_check_days} days "
                        f"(last check: {cluster.last_check_time.strftime('%Y-%m-%d %H:%M:%S UTC')}, "
                        f"{days_since_check} days ago)."
                    )
                else:
                    report.status = "FAIL"
                    report.status_extended = (
                        f"Kubernetes cluster {cluster.name} has not had a successful cluster check "
                        f"within the last {max_cluster_check_days} days "
                        f"(last check: {cluster.last_check_time.strftime('%Y-%m-%d %H:%M:%S UTC')}, "
                        f"{days_since_check} days ago)."
                    )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Kubernetes cluster {cluster.name} has no successful cluster check history. "
                    f"Cluster checks should be triggered at least once every {max_cluster_check_days} days."
                )

            findings.append(report)

        return findings

References