GKE monitoring and logging in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding GKE Monitoring Components

Which component in Google Kubernetes Engine (GKE) is primarily responsible for collecting cluster metrics and sending them to Cloud Monitoring?

A Cloud Trace Collector

B Cloud Logging Agent

C Kubelet Metrics Server

D Stackdriver Kubernetes Monitoring Agent

💡 Hint

Think about the agent that collects metrics specifically for monitoring purposes.

The Stackdriver Kubernetes Monitoring Agent collects cluster and node metrics and sends them to Cloud Monitoring. The Cloud Logging Agent handles logs, Kubelet Metrics Server provides metrics but is not the main agent for Cloud Monitoring, and Cloud Trace Collector is for tracing.

💻 Command Output

intermediate

Output of kubectl command for logs

What is the output of the following command when run on a GKE cluster?

kubectl logs -n kube-system -l k8s-app=kube-dns --tail=2

A Shows the last 2 log lines from all pods labeled k8s-app=kube-dns in kube-system namespace

B Shows logs only from the first pod found with label k8s-app=kube-dns

C Returns an error because --tail cannot be used with label selector

D Shows logs from all namespaces for pods labeled k8s-app=kube-dns

💡 Hint

Consider how kubectl logs works with label selectors and the --tail option.

The command fetches logs from all pods matching the label in the specified namespace and shows the last 2 lines of each pod's logs. It does not return an error and does not limit to only one pod.

❓ Configuration

advanced

Configuring Fluentd for Custom Log Routing

You want to configure Fluentd on GKE to route logs from a specific namespace to a custom Cloud Logging log bucket. Which configuration snippet correctly sets the match directive for logs from namespace custom-ns?

A

<match kubernetes.**>
  @type google_cloud
  <buffer>
    @type memory
  </buffer>
  <filter>
    @type grep
    <regexp>
      key $.kubernetes.namespace_name
      pattern ^custom-ns$
    </regexp>
  </filter>
</match>

B

<match kubernetes.var.log.containers.*custom-ns*.log>
  @type google_cloud
</match>

C

<match kubernetes.**>
  @type google_cloud
  <filter kubernetes.namespace_name>
    @type grep
    <regexp>
      key $.kubernetes.namespace_name
      pattern ^custom-ns$
    </regexp>
  </filter>
</match>

D

<match kubernetes.**>
  @type google_cloud
  <filter kubernetes.namespace_name custom-ns>
  </filter>
</match>

💡 Hint

Focus on the match directive pattern that filters logs by namespace in Fluentd.

Option B correctly matches log files from containers in the custom-ns namespace by using the log file path pattern. Other options misuse filter inside match or have invalid syntax.

❓ Troubleshoot

advanced

Troubleshooting Missing Metrics in Cloud Monitoring

You notice that your GKE cluster metrics are not appearing in Cloud Monitoring. Which of the following is the most likely cause?

A Cloud Logging API is disabled in the GCP project

B The cluster nodes do not have sufficient CPU resources

C The Stackdriver Kubernetes Monitoring Agent DaemonSet is not running on the nodes

D The Kubernetes API server is down

💡 Hint

Think about the component responsible for sending metrics to Cloud Monitoring.

If the Stackdriver Kubernetes Monitoring Agent DaemonSet is not running, metrics won't be collected or sent to Cloud Monitoring. CPU resources or Cloud Logging API do not directly affect metrics collection, and the API server being down would cause broader issues.

✅ Best Practice

expert

Best Practice for Secure Logging in GKE

Which practice is best to ensure logs collected from GKE workloads are securely transmitted and stored in Cloud Logging?

A Enable TLS encryption for Fluentd agents and use IAM roles with least privilege for log writing

B Store logs locally on nodes and periodically upload them to Cloud Storage without encryption

C Disable Cloud Logging API and use third-party logging tools without encryption

D Use plaintext HTTP to send logs to Cloud Logging for faster transmission

💡 Hint

Consider encryption and access control best practices for cloud logging.

Enabling TLS encryption ensures logs are securely transmitted. Using IAM roles with least privilege limits access to logs. Storing logs unencrypted or disabling Cloud Logging API reduces security. Sending logs over plaintext HTTP is insecure.