Anthos-Cluster auf Bare-Metal Version 1.11 wird auf Kubernetes 1.22 ausgeführt. Kubernetes 1.22 hat bestimmte APIs verworfen. Eine Liste dieser verworfenen APIs finden Sie unter verworfene Kubernetes 1.22 APIs.
In Version 1.11 von Anthos-Clustern auf Bare-Metal ist das Cluster-Audit-Logging für alle Cluster aktiviert, und Audit-Logs werden an die Google Cloud-Operations Suite gestreamt. Wechseln Sie zu Cloud Operation Log Explorer und führen Sie die folgende Abfrage aus, um festzustellen, ob Sie die Kubernetes-Dienstkonten (SA) verwenden, die Sie an verworfene APIs aufrufen. Die Ausgabe dieser Abfrage zeigt, ob eine Ihrer Kubernetes-SAs verworfene API-Aufrufe durchführt:
resource.labels.cluster_name = "<cluster_name>" AND
logName = "projects/<project>/logs/externalaudit.googleapis.com%2Factivity" AND
protoPayload.authenticationInfo.principalEmail:("system:serviceaccount" OR "@") AND
protoPayload.authenticationInfo.principalEmail!~("system:serviceaccount:kube-system:") AND
protoPayload.authenticationInfo.principalEmail!~("system:serviceaccount:cert-manager:") AND
protoPayload.authenticationInfo.principalEmail!~("system:serviceaccount:capi-kubeadm-bootstrap-system:") AND
protoPayload.authenticationInfo.principalEmail!~("system:serviceaccount:capi-kubeadm-bootstrap-system-webhook:") AND
protoPayload.authenticationInfo.principalEmail!~("system:serviceaccount:capi-system:") AND
protoPayload.authenticationInfo.principalEmail!~("system:serviceaccount:capi-system-webhook:") AND
(protoPayload.methodName:"io.k8s.apiextensions.v1beta1.CustomResourceDefinition" OR
protoPayload.methodName:"io.k8s.admissionregistration.v1beta1.MutatingWebhookConfiguration" OR
protoPayload.methodName:"io.k8s.admissionregistration.v1beta1.ValidatingWebhookConfiguration" OR
protoPayload.methodName:"io.k8s.apiregistration.v1beta1.APIService" OR
protoPayload.methodName:"io.k8s.authentication.v1beta1.TokenReview" OR
protoPayload.methodName:"io.k8s.authentication.v1beta1.LocalSubjectAccessReview" OR
protoPayload.methodName:"io.k8s.authentication.v1beta1.SelfSubjectAccessReview" OR
protoPayload.methodName:"io.k8s.authentication.v1beta1.SubjectAccessReview" OR
protoPayload.methodName:"io.k8s.certificates.v1beta1.CertificateSigningRequest" OR
protoPayload.methodName:"io.k8s.coordination.v1beta1.Lease" OR
protoPayload.methodName:"io.k8s.networking.v1beta1.Ingress" OR
protoPayload.methodName:"io.k8s.networking.v1beta1.IngressClass" OR
protoPayload.methodName:"io.k8s.authorization.rbac.v1beta1.ClusterRole" OR
protoPayload.methodName:"io.k8s.authorization.rbac.v1beta1.ClusterRoleBinding" OR
protoPayload.methodName:"io.k8s.authorization.rbac.v1beta1.Role" OR
protoPayload.methodName:"io.k8s.authorization.rbac.v1beta1.RoleBinding" OR
protoPayload.methodName:"io.k8s.scheduling.v1beta1.PriorityClass" OR
protoPayload.methodName:"io.k8s.storage.v1beta1.CSIDriver" OR
protoPayload.methodName:"io.k8s.storage.v1beta1.CSINode" OR
protoPayload.methodName:"io.k8s.storage.v1beta1.StorageClass" OR
protoPayload.methodName:"io.k8s.storage.v1beta1.VolumeAttachment"
)