Logging and monitoring

This section describes how logging and monitoring work in the enterprise application blueprint for both the developer platform and the applications. Google Cloud Observability for GKE provides Cloud Logging and Cloud Monitoring services for blueprint applications.

By default, the base source code in the application templates sends logs to stdout. Using stdout is a best practice for containerized applications because stdout lets the platform handle the application logs. The application code is instrumented with Prometheus client libraries to export application-specific metrics. GKE automatically provides metrics for each application, including Kube State metrics, resource utilization, SRE golden metrics, and database instance metrics. For the developer platform team, the platform provides infrastructure, usage, and cross-application traffic metrics.

Logging storage

Cloud Operations for GKE also lets you collect system and application logs into central log buckets. The blueprint also includes a project in each environment folder that's used for storing logs. The enterprise foundation blueprint has a separate logging project where the aggregate Cloud Audit Logs logs from across the entire Google Cloud organization are exported. The log types most needed by tenants are also separated by tenant. For example, an application developer who works on the frontend application might be granted access to only frontend container logs and pod logs, and only in the development and non-production environments.

The following table lists log types, locations, and access control granularity.

Access control granularity	Log types	Log storage location
Developer platform	Multi-tenant infrastructure logs	Project: eab-infra-cicd
	Application factory logs	Project: eab-app-factory
By environment	Node Cluster control plane Non-tenant containers or pods	Project: eab-gke-{env} Bucket: _Default
	Compute Engine resources that are used by GKE Cloud Service Mesh traffic	Project: eab-gke-{env}
By environment and tenant	Tenant containers or pods	Project: eab-gke-{env} Bucket: per-tenant (scope)
	Alloy DB sessions Other tenant-owned resources	Project: eab-app-{appname}-{env}
By tenant	Application builds Application deploys	Project: eab-app-cicd-{appname}

Application monitoring

Google Cloud Observability for GKE provides predefined monitoring dashboards for GKE. The blueprint also enables Google Cloud Managed Service for Prometheus, which collects metrics from Prometheus exporters and lets you query the data globally using PromQL. PromQL means that you can use familiar tools like Grafana dashboards and PromQL-based alerts. Cloud Service Mesh is enabled to provide you with dashboards in the Google Cloud console to observe and troubleshoot interactions between services and across tenants. The blueprint also includes a project for a multi-project monitoring metrics scope.

Threat and vulnerability monitoring

Security Command Center provides insight into the overall security posture of the blueprint. Security Command Center Premium tier provides Container Threat Detection for active container-based workloads in GKE. Web Security Scanner is used to detect vulnerabilities in your internet-facing services. Web Security Scanner detects vulnerabilities by crawling an HTTP service and following all links, starting at the base URL. Web Security Scanner then exercises as many user inputs and event handlers as possible.

What's next

• Read about operations for both the developer platform and applications (next document in this series).