Les clusters Anthos sur solution Bare Metal version 1.11 s'exécutent sur Kubernetes 1.22. Kubernetes 1.22 a marqué l'abandon de certaines API. Une liste de ces API obsolètes est disponible dans la section API obsolètes de Kubernetes 1.22.
Dans la version 1.11 des clusters Anthos sur solution Bare Metal. Les journaux d'audit sont activés pour tous les clusters et diffusés dans la suite Google Cloud Operations. Pour déterminer si les comptes de service (SA) Kubernetes que vous utilisez appellent des API obsolètes, accédez à l'explorateur de journaux Cloud Operations et exécutez la requête ci-dessous. Le résultat de cette requête indique si l'un de vos comptes de service Kubernetes appelle des API obsolètes :
resource.labels.cluster_name = "<cluster_name>" AND
logName = "projects/<project>/logs/externalaudit.googleapis.com%2Factivity" AND
protoPayload.authenticationInfo.principalEmail:("system:serviceaccount" OR "@") AND
protoPayload.authenticationInfo.principalEmail!~("system:serviceaccount:kube-system:") AND
protoPayload.authenticationInfo.principalEmail!~("system:serviceaccount:cert-manager:") AND
protoPayload.authenticationInfo.principalEmail!~("system:serviceaccount:capi-kubeadm-bootstrap-system:") AND
protoPayload.authenticationInfo.principalEmail!~("system:serviceaccount:capi-kubeadm-bootstrap-system-webhook:") AND
protoPayload.authenticationInfo.principalEmail!~("system:serviceaccount:capi-system:") AND
protoPayload.authenticationInfo.principalEmail!~("system:serviceaccount:capi-system-webhook:") AND
(protoPayload.methodName:"io.k8s.apiextensions.v1beta1.CustomResourceDefinition" OR
protoPayload.methodName:"io.k8s.admissionregistration.v1beta1.MutatingWebhookConfiguration" OR
protoPayload.methodName:"io.k8s.admissionregistration.v1beta1.ValidatingWebhookConfiguration" OR
protoPayload.methodName:"io.k8s.apiregistration.v1beta1.APIService" OR
protoPayload.methodName:"io.k8s.authentication.v1beta1.TokenReview" OR
protoPayload.methodName:"io.k8s.authentication.v1beta1.LocalSubjectAccessReview" OR
protoPayload.methodName:"io.k8s.authentication.v1beta1.SelfSubjectAccessReview" OR
protoPayload.methodName:"io.k8s.authentication.v1beta1.SubjectAccessReview" OR
protoPayload.methodName:"io.k8s.certificates.v1beta1.CertificateSigningRequest" OR
protoPayload.methodName:"io.k8s.coordination.v1beta1.Lease" OR
protoPayload.methodName:"io.k8s.networking.v1beta1.Ingress" OR
protoPayload.methodName:"io.k8s.networking.v1beta1.IngressClass" OR
protoPayload.methodName:"io.k8s.authorization.rbac.v1beta1.ClusterRole" OR
protoPayload.methodName:"io.k8s.authorization.rbac.v1beta1.ClusterRoleBinding" OR
protoPayload.methodName:"io.k8s.authorization.rbac.v1beta1.Role" OR
protoPayload.methodName:"io.k8s.authorization.rbac.v1beta1.RoleBinding" OR
protoPayload.methodName:"io.k8s.scheduling.v1beta1.PriorityClass" OR
protoPayload.methodName:"io.k8s.storage.v1beta1.CSIDriver" OR
protoPayload.methodName:"io.k8s.storage.v1beta1.CSINode" OR
protoPayload.methodName:"io.k8s.storage.v1beta1.StorageClass" OR
protoPayload.methodName:"io.k8s.storage.v1beta1.VolumeAttachment"
)