AKS clusters with no diagnostic setting exporting control-plane logs

Control-plane logs nobody is collecting

In AKS, Microsoft operates the control plane, so kube-apiserver, kube-audit and kube-controller-manager output exists only while a diagnostic setting exports it. There is no node to SSH into afterwards. Without one, the cluster keeps no record of which identity read a secret, deleted a namespace, or created a privileged pod. During an incident that gap is unrecoverable: the logs were never written anywhere, so no amount of forensics gets them back.

Two signals, two rules

AKS has two separate observability surfaces that are easy to conflate. Container Insights is the omsagent addon collecting node and workload telemetry, which is rule RC-1352’s subject. Diagnostic settings are a distinct ARM resource under microsoft.insights/diagnosticsettings that exports the control-plane log categories. A cluster can have either without the other, which is why RC-1355 is keyed to its own signal rather than reusing the addon flag.

How ZopNight proves the gap

Azure Resource Graph does not surface diagnostic settings on the cluster row itself, so the discoverer runs a secondary lookup over microsoft.insights/diagnosticsettings scoped to managed clusters, checking for at least one enabled control-plane category (kube-apiserver, kube-audit, kube-audit-admin, or kube-controller-manager) and stamps diagnostic_logging_enabled accordingly. The read is covered by the built-in Reader role. The rule fires only on an explicit "false"; when the lookup produced nothing, it abstains rather than firing on missing data, and the legacy customer-editable tag is ignored entirely.

Turning on kube-audit without drowning in it

The full kube-audit category logs every request, including reads, and on a busy cluster the Log Analytics bill will show it. The kube-audit-admin category records only write operations, which is the usual compromise for compliance evidence at tolerable cost. Send either to a Log Analytics workspace when you need to query, or to a storage account when you only need retention.

Verify diagnostic settings from the CLI

az monitor diagnostic-settings list \
  --resource $(az aks show -n <cluster> -g <rg> --query id -o tsv) \
  --query "[].{name:name, enabled:logs[?enabled].category}" -o table

Empty output, or settings whose enabled categories include none of the four control-plane logs, is the state this finding describes.