This page explains how to enable network policy logging in a GKE on-prem user cluster and how to export logs. See Using network policy logging to learn how to configure which events are logged and how logs are formatted.
Network polices are Pod-level firewalls; they specify network traffic that Pods are allowed to send and receive. Network policy logs record network policy events. You can log all events or you can configure logging selectively based on the following criteria:
- Allowed connections.
- Denied connections.
- Connections allowed by specific policies.
- Denied connections to Pods in specific namespaces.
Before you begin
Network policy logging is supported in user clusters that use
Dataplane V2. You can enable
Dataplane V2 when creating a new user cluster by using the
field in the user cluster configuration file.
Network policy logging is not enabled by default. For information on enabling logging and selecting which events to log, see Configuring network policy logging.
The network policy logs generated on each cluster node are available locally on
the cluster nodes at
/var/log/network/policy_actiontimestamp.log. A new
timestamped log file is created when the current log file reaches 10 MB. Up to
five previous log files are stored.