AKS clusters running without the Container Insights addon
What does ZopNight detect here?
Container Insights left disabled on an AKS cluster means node health, pod performance, and container logs are invisible during incidents. ZopNight's rule RC-1352 reads the omsagent addon state the discoverer stamps as logging_enabled and fires only on an explicit "false", abstaining whenever the flag is missing.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-1352 |
| Category | compliance |
| Severity | medium |
| Metric | none — pure configuration read |
| Source | aks_monitoring.go |
Where it applies
A cluster you cannot see into
An AKS cluster without Container Insights reports almost nothing about itself. Node memory
pressure, pod restarts, evictions, and container stdout all happen unobserved; the first sign
of a capacity problem is usually an application error, and by then the pod that caused it may
already be gone along with its logs. Kubernetes’ own kubectl top and event stream cover the
last few minutes at best. The addon is what gives the cluster a history.
The omsagent flag behind the finding
The Azure discoverer reads each cluster’s addon profile through Azure Resource Graph (a
read covered by the built-in Reader role) and derives logging_enabled from whether the
Container Insights agent (addonProfiles.omsagent.enabled) is on. Rule RC-1352 fires only on
an explicit "false". A previous incarnation read a monitoring tag that no producer ever
emitted, so it was dead on real data; the rewritten rule takes provider evidence only and
abstains whenever the addon state was not surfaced.
List clusters missing Container Insights
az aks list \ --query "[].{name:name, rg:resourceGroup, insights: addonProfiles.omsagent.enabled}" \ -o tableRows showing a null or false insights column are the clusters this rule will flag.
The cost side of turning it on
Enabling the addon is one command, but ingestion is not free: Container Insights writes to a Log Analytics workspace, billed per GB, and a chatty cluster can produce a surprising volume. Cost controls exist for that: collection intervals, namespace filtering, and basic-tier tables. The practical move is to enable it with a scoped configuration rather than leaving it off entirely. A medium-severity visibility gap is cheaper to close than to explain after an outage.
Where this rule ends and RC-1355 begins
Container Insights covers what runs on the nodes. Control-plane logs (the API server and audit trail) travel through a separate diagnostic-settings resource, checked independently by rule RC-1355. Enabling one does not satisfy the other; a fully observable cluster needs both, and the two findings can legitimately appear together on the same cluster.