이 페이지에서는 Cloud 감사 로그에서 배포 상태 및 정책 시행에 대한 정보를 확인하는 방법을 보여줍니다.
이 페이지에 사용된 Cloud 감사 로그 사용자 인터페이스 용어에 대해 자세히 알아보려면 로그 보기를 참조하세요.
단일 대시보드에서 상호 의존적인 Google Cloud 제품 간의 Binary Authorization 정책 적용을 포함해서 애플리케이션 보안 상태를 평가할 수 있습니다. 자세한 내용은 보안 모니터링을 참조하세요.
개요
Binary Authorization을 사용하여 Google Kubernetes Engine(GKE)에 컨테이너 이미지를 배포할 때 GKE는 배포에 대한 세부정보를 Google Cloud Observability의 감사 로그에 작성합니다. 이러한 감사 로그 항목에는 시행 상태 메시지가 포함되어 있습니다. Google Cloud 콘솔 또는 명령줄에서 gcloud logging read 명령어를 사용하여 이러한 로그 항목을 볼 수 있습니다.
이 가이드의 뒷 부분에서 검색을 위해서는 Cloud 감사 로그에 액세스하고 확인하려는 이벤트가 있는 프로젝트를 선택합니다.
Cloud 감사 로그에 대한 일반 액세스는 다음을 수행합니다.
Google Cloud 콘솔의 Google Cloud Observability 로깅 > 로그(로그 탐색기) 페이지로 이동합니다.
Google Cloud CLI를 사용하여 Cloud 감사 로그에서 지난 주의 정책 위반 이벤트를 보려면 다음 명령어를 실행합니다.
gcloudloggingread--order="desc"--freshness=7d\'resource.type="k8s_cluster" logName:"cloudaudit.googleapis.com%2Factivity" (protoPayload.methodName="io.k8s.core.v1.pods.create" OR protoPayload.methodName="io.k8s.core.v1.pods.update") protoPayload.response.status="Failure" (protoPayload.response.reason="VIOLATES_POLICY" OR protoPayload.response.reason="Forbidden")'
Cloud 감사 로그의 breakglass 이벤트
Binary Authorization을 사용하면 포드 사양에서 breakglass 라벨을 사용하여 정책을 재정의할 수 있습니다. 이미지가 breakglass와 함께 배포된 경우 Binary Authorization이 breakglass 이벤트를 Cloud 감사 로그에 로깅합니다. 다음 섹션에서는 이러한 이벤트에 쿼리를 수행하는 방법을 설명합니다.
Cloud 감사 로그에서 gcloud CLI를 사용하여 이전 주의 breakglass 이벤트를 보려면 다음 명령어를 실행합니다.
gcloudloggingread--order="desc"--freshness=7d\'resource.type="k8s_cluster" AND logName:"cloudaudit.googleapis.com%2Factivity" AND (protoPayload.methodName="io.k8s.core.v1.pods.create" OR protoPayload.methodName="io.k8s.core.v1.pods.update") AND "image-policy.k8s.io/break-glass"'
Cloud 감사 로그의 Fail Open 이벤트
컨테이너 이미지 배포를 시도하고, Binary Authorization 시행자를 사용할 수 없거나 타임아웃되고, 컨테이너 이미지를 배포하도록 허용되면 Fail Open이 발생합니다.
gcloud CLI를 사용하여 Cloud 감사 로그에서 이전 주의 Fail Open 이벤트를 보려면 다음 명령어를 실행합니다.
gcloudloggingread--order="desc"--freshness=7d\'resource.type="k8s_cluster" logName:"cloudaudit.googleapis.com%2Factivity" (protoPayload.methodName="io.k8s.core.v1.pods.create" OR protoPayload.methodName="io.k8s.core.v1.pods.update") ("image-policy.k8s.io/failed-open" OR "imagepolicywebhook.image-policy.k8s.io/failed-open" OR "failed-open.validating.webhook.admission.k8s.io")'
Cloud 감사 로그의 테스트 실행 이벤트
테스트 실행 모드는 비준수 이미지 배포를 허용하지만 배포 세부정보를 감사 로그에 기록하는 정책의 시행 모드입니다. 테스트 실행 모드를 사용하면 프로덕션 환경에서 정책이 적용되기 전에 테스트할 수 있습니다.
컨테이너 이미지가 정책에서 필요한 검사를 통과하지 못하지만 테스트 실행 모드로 배포가 허용되는 경우 Cloud 감사 로그에 imagepolicywebhook.image-policy.k8s.io/dry-run: "true"가 포함됩니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-04-21(UTC)"],[[["\u003cp\u003eThis guide demonstrates how to access and interpret deployment status and policy enforcement information within Google Cloud Audit Logs, focusing on events related to Binary Authorization in Google Kubernetes Engine (GKE).\u003c/p\u003e\n"],["\u003cp\u003eYou can view audit log entries in the Google Cloud console's Logs Explorer or using the \u003ccode\u003egcloud logging read\u003c/code\u003e command, filtering for specific enforcement status messages like blocked deployments, breakglass events, fail open, and dry run mode.\u003c/p\u003e\n"],["\u003cp\u003eBlocked deployment events, indicating Binary Authorization policy violations, can be identified in Cloud Audit Logs through specific queries that look for \u003ccode\u003eVIOLATES_POLICY\u003c/code\u003e or \u003ccode\u003eForbidden\u003c/code\u003e reasons.\u003c/p\u003e\n"],["\u003cp\u003eThe guide explains how to search for breakglass events, fail open events (when the Binary Authorization system is unavailable), and dry run events (when images are allowed despite policy violations) within Cloud Audit Logs, detailing the specific queries for each.\u003c/p\u003e\n"],["\u003cp\u003eThis information is useful for assessing application security, as the logs detail various enforcement conditions when deploying container images to GKE, enabling you to quickly see if a policy is being violated, and in what circumstances.\u003c/p\u003e\n"]]],[],null,["This page shows you how to view information about deployment status and policy\nenforcement in [Cloud Audit Logs](/logging/docs/audit).\n\nTo learn more about Cloud Audit Logs user interface terminology used in\nthis page, see [Viewing logs](/logging/docs/view/basic-queries).\n\nYou can assess your application security posture, including Binary Authorization\npolicy enforcement across interdependent Google Cloud products in a single\ndashboard. To learn more, see\n[Security monitoring](/anthos/docs/concepts/security-monitoring).\n\nOverview\n\nWhen you use Binary Authorization to deploy a container image to Google Kubernetes Engine\n(GKE), GKE writes details about\nthe deployment to the audit logs in Google Cloud Observability. These audit log\nentries include **enforcement status messages** . You can view these log entries\nin the Google Cloud console or at the command line using the\n[`gcloud logging read`](/sdk/gcloud/reference/logging/read) command.\n\nFor the searches later in this guide, you access Cloud Audit Logs and select the\nproject with the events you want to view.\n\nFor *general access* to Cloud Audit Logs, do the following:\n\n1. Go to the **Google Cloud Observability Logging \\\u003e Logs** (Logs Explorer) page in the\n Google Cloud console:\n\n [Go to Logs Explorer](https://console.cloud.google.com/logs/query)\n2. Choose the Google Cloud project for which you want to view Cloud Audit Logs.\n\nEnforcement status messages\n\nGKE writes messages to the audit log for the following\nenforcement conditions:\n\n- **Blocked deployment**: Deployment was blocked due to Binary Authorization policy.\n- **Breakglass event** : Deployment bypassed policy check using breakglass mechanism. For more information, see [Using breakglass](/binary-authorization/docs/using-breakglass).\n- **Fail open**: Deployment was allowed because Binary Authorization backend was unavailable.\n- **Dry run**: Deployment allowed with policy violations because dry run mode was set in the Binary Authorization policy.\n\nBlocked deployment events in Cloud Audit Logs\n\nWhen a container image is blocked because it violates a Binary Authorization\npolicy, you can find the blocked-deployment events in Cloud Audit Logs.\n\nQuery Cloud Audit Logs for blocked deployment events\n\nThis section describes how to query Cloud Audit Logs for blocked deployment\nevents. \n\nLogs Explorer\n\nTo view blocked deployment events in the Cloud Audit Logs Logs Explorer, do\nthe following:\n\n1. Go to the [Logs Explorer page](https://console.cloud.google.com/logs/query).\n\n2. Enter the following query in the *search-query* box:\n\n resource.type=\"k8s_cluster\"\n logName:\"cloudaudit.googleapis.com%2Factivity\"\n (protoPayload.methodName=\"io.k8s.core.v1.pods.create\" OR\n protoPayload.methodName=\"io.k8s.core.v1.pods.update\")\n protoPayload.response.status=\"Failure\"\n (protoPayload.response.reason=\"VIOLATES_POLICY\" OR\n protoPayload.response.reason=\"Forbidden\")\n\n \u003cbr /\u003e\n\n3. Select the time range in the *time-range selector*.\n\ngcloud\n\nTo view policy violation events from the past week in Cloud Audit Logs using\nthe Google Cloud CLI, run the following command: \n\n gcloud logging read --order=\"desc\" --freshness=7d \\\n 'resource.type=\"k8s_cluster\"\n logName:\"cloudaudit.googleapis.com%2Factivity\"\n (protoPayload.methodName=\"io.k8s.core.v1.pods.create\" OR\n protoPayload.methodName=\"io.k8s.core.v1.pods.update\")\n protoPayload.response.status=\"Failure\"\n (protoPayload.response.reason=\"VIOLATES_POLICY\" OR\n protoPayload.response.reason=\"Forbidden\")'\n\n| **Note:** For Kubernetes master versions 1.18.15 and later, 1.19.7 and later, and 1.20.2 and later, `protoPayload.response.reason` is set to `VIOLATES_POLICY`.\n\nBreakglass events in Cloud Audit Logs\n\nBinary Authorization enables you to override the policy using a\n[*breakglass*](/binary-authorization/docs/deploying-containers#override_a_policy)\nlabel in the Pod specification. When images are deployed with breakglass,\nBinary Authorization logs breakglass events in Cloud Audit Logs. The\nfollowing section describes how you can query for these events.\n\nQuery Cloud Audit Logs for pods with breakglass specified \n\nLogs Explorer\n\nTo view breakglass events in the Cloud Audit Logs Logs Explorer, do the\nfollowing:\n\n1. Go to the [Logs Explorer page](https://console.cloud.google.com/logs/query).\n\n2. Enter the following in the *search-query* box:\n\n resource.type=\"k8s_cluster\"\n logName:\"cloudaudit.googleapis.com%2Factivity\"\n (protoPayload.methodName=\"io.k8s.core.v1.pods.create\" OR\n protoPayload.methodName=\"io.k8s.core.v1.pods.update\")\n \"image-policy.k8s.io/break-glass\"\n\n3. Select the time range in the *time-range selector*.\n\ngcloud\n\nTo view breakglass events from the past week in Cloud Audit Logs using the\nthe gcloud CLI, run the following command: \n\n gcloud logging read --order=\"desc\" --freshness=7d \\\n 'resource.type=\"k8s_cluster\" AND\n logName:\"cloudaudit.googleapis.com%2Factivity\" AND\n (protoPayload.methodName=\"io.k8s.core.v1.pods.create\" OR\n protoPayload.methodName=\"io.k8s.core.v1.pods.update\") AND\n \"image-policy.k8s.io/break-glass\"'\n\nFail open events in Cloud Audit Logs\n\nFail open occurs when a container image deployment is attempted,\nBinary Authorization enforcement is unavailable or times out, and the container\nimage is allowed to deploy.\n\nIn this case, the verification result is unknown and a log entry is recorded.\n\nQuery Cloud Audit Logs fail open events \n\nLogs Explorer\n\nTo view fail open events in the Cloud Audit Logs Logs Explorer, do the\nfollowing:\n\n1. Go to the [Logs Explorer page](https://console.cloud.google.com/logs/query).\n\n2. Enter the following in the *search-query* box:\n\n resource.type=\"k8s_cluster\"\n logName:\"cloudaudit.googleapis.com%2Factivity\"\n (protoPayload.methodName=\"io.k8s.core.v1.pods.create\" OR\n protoPayload.methodName=\"io.k8s.core.v1.pods.update\")\n (\"image-policy.k8s.io/failed-open\" OR\n \"imagepolicywebhook.image-policy.k8s.io/failed-open\" OR\n \"failed-open.validating.webhook.admission.k8s.io\")\n\n3. Select the time range in the *time-range selector*.\n\ngcloud\n\nTo view fail open events from the past week in Cloud Audit Logs using\nthe gcloud CLI, run the following command: \n\n gcloud logging read --order=\"desc\" --freshness=7d \\\n 'resource.type=\"k8s_cluster\"\n logName:\"cloudaudit.googleapis.com%2Factivity\"\n (protoPayload.methodName=\"io.k8s.core.v1.pods.create\" OR\n protoPayload.methodName=\"io.k8s.core.v1.pods.update\")\n (\"image-policy.k8s.io/failed-open\" OR\n \"imagepolicywebhook.image-policy.k8s.io/failed-open\" OR\n \"failed-open.validating.webhook.admission.k8s.io\")'\n\nDry run events in Cloud Audit Logs\n\n[Dry run mode](/binary-authorization/docs/key-concepts#enforcement_modes) is an enforcement mode in a policy\nthat enables non-conformant images to be deployed, but writes details about the\ndeployment to the audit log. Dry run mode allows you to test a policy in your\nproduction environment before it goes into effect.\n\nWhen a container image fails to pass the required checks in a policy, but is\npermitted to be deployed by dry run mode, Cloud Audit Logs contains\n`imagepolicywebhook.image-policy.k8s.io/dry-run: \"true\"`.\n\nQuery Cloud Audit Logs for dry run events \n\nLogs Explorer\n\nTo view dry run events in the Cloud Audit Logs Logs Explorer, do the\nfollowing:\n\n1. Go to the [Logs Explorer page](https://console.cloud.google.com/logs/query).\n\n2. Enter the following in the *search-query* box:\n\n resource.type=\"k8s_cluster\"\n logName:\"cloudaudit.googleapis.com%2Factivity\"\n (protoPayload.methodName=\"io.k8s.core.v1.pods.create\" OR\n protoPayload.methodName=\"io.k8s.core.v1.pods.update\")\n labels.\"imagepolicywebhook.image-policy.k8s.io/dry-run\"=\"true\"\n\n3. Select the time range in the *time-range selector*.\n\ngcloud\n\nTo view dry run deployment events from the past week in Cloud Audit Logs using\nthe gcloud CLI, run the following command: \n\n gcloud logging read --order=\"desc\" --freshness=7d \\\n 'labels.\"imagepolicywebhook.image-policy.k8s.io/dry-run\"=\"true\"'"]]
