如需使用 Google Cloud CLI 在 Cloud Audit Logs 中查看过去一周的违反政策事件，请运行以下命令：
gcloudloggingread--order="desc"--freshness=7d\'resource.type="k8s_cluster" logName:"cloudaudit.googleapis.com%2Factivity" (protoPayload.methodName="io.k8s.core.v1.pods.create" OR protoPayload.methodName="io.k8s.core.v1.pods.update") protoPayload.response.status="Failure" (protoPayload.response.reason="VIOLATES_POLICY" OR protoPayload.response.reason="Forbidden")'
gcloudloggingread--order="desc"--freshness=7d\'resource.type="k8s_cluster" AND logName:"cloudaudit.googleapis.com%2Factivity" AND (protoPayload.methodName="io.k8s.core.v1.pods.create" OR protoPayload.methodName="io.k8s.core.v1.pods.update") AND "image-policy.k8s.io/break-glass"'
gcloudloggingread--order="desc"--freshness=7d\'resource.type="k8s_cluster" logName:"cloudaudit.googleapis.com%2Factivity" (protoPayload.methodName="io.k8s.core.v1.pods.create" OR protoPayload.methodName="io.k8s.core.v1.pods.update") ("image-policy.k8s.io/failed-open" OR "imagepolicywebhook.image-policy.k8s.io/failed-open" OR "failed-open.validating.webhook.admission.k8s.io")'
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-04-21。"],[[["\u003cp\u003eThis guide demonstrates how to access and interpret deployment status and policy enforcement information within Google Cloud Audit Logs, focusing on events related to Binary Authorization in Google Kubernetes Engine (GKE).\u003c/p\u003e\n"],["\u003cp\u003eYou can view audit log entries in the Google Cloud console's Logs Explorer or using the \u003ccode\u003egcloud logging read\u003c/code\u003e command, filtering for specific enforcement status messages like blocked deployments, breakglass events, fail open, and dry run mode.\u003c/p\u003e\n"],["\u003cp\u003eBlocked deployment events, indicating Binary Authorization policy violations, can be identified in Cloud Audit Logs through specific queries that look for \u003ccode\u003eVIOLATES_POLICY\u003c/code\u003e or \u003ccode\u003eForbidden\u003c/code\u003e reasons.\u003c/p\u003e\n"],["\u003cp\u003eThe guide explains how to search for breakglass events, fail open events (when the Binary Authorization system is unavailable), and dry run events (when images are allowed despite policy violations) within Cloud Audit Logs, detailing the specific queries for each.\u003c/p\u003e\n"],["\u003cp\u003eThis information is useful for assessing application security, as the logs detail various enforcement conditions when deploying container images to GKE, enabling you to quickly see if a policy is being violated, and in what circumstances.\u003c/p\u003e\n"]]],[],null,["This page shows you how to view information about deployment status and policy\nenforcement in [Cloud Audit Logs](/logging/docs/audit).\n\nTo learn more about Cloud Audit Logs user interface terminology used in\nthis page, see [Viewing logs](/logging/docs/view/basic-queries).\n\nYou can assess your application security posture, including Binary Authorization\npolicy enforcement across interdependent Google Cloud products in a single\ndashboard. To learn more, see\n[Security monitoring](/anthos/docs/concepts/security-monitoring).\n\nOverview\n\nWhen you use Binary Authorization to deploy a container image to Google Kubernetes Engine\n(GKE), GKE writes details about\nthe deployment to the audit logs in Google Cloud Observability. These audit log\nentries include **enforcement status messages** . You can view these log entries\nin the Google Cloud console or at the command line using the\n[`gcloud logging read`](/sdk/gcloud/reference/logging/read) command.\n\nFor the searches later in this guide, you access Cloud Audit Logs and select the\nproject with the events you want to view.\n\nFor *general access* to Cloud Audit Logs, do the following:\n\n1. Go to the **Google Cloud Observability Logging \\\u003e Logs** (Logs Explorer) page in the\n Google Cloud console:\n\n [Go to Logs Explorer](https://console.cloud.google.com/logs/query)\n2. Choose the Google Cloud project for which you want to view Cloud Audit Logs.\n\nEnforcement status messages\n\nGKE writes messages to the audit log for the following\nenforcement conditions:\n\n- **Blocked deployment**: Deployment was blocked due to Binary Authorization policy.\n- **Breakglass event** : Deployment bypassed policy check using breakglass mechanism. For more information, see [Using breakglass](/binary-authorization/docs/using-breakglass).\n- **Fail open**: Deployment was allowed because Binary Authorization backend was unavailable.\n- **Dry run**: Deployment allowed with policy violations because dry run mode was set in the Binary Authorization policy.\n\nBlocked deployment events in Cloud Audit Logs\n\nWhen a container image is blocked because it violates a Binary Authorization\npolicy, you can find the blocked-deployment events in Cloud Audit Logs.\n\nQuery Cloud Audit Logs for blocked deployment events\n\nThis section describes how to query Cloud Audit Logs for blocked deployment\nevents. \n\nLogs Explorer\n\nTo view blocked deployment events in the Cloud Audit Logs Logs Explorer, do\nthe following:\n\n1. Go to the [Logs Explorer page](https://console.cloud.google.com/logs/query).\n\n2. Enter the following query in the *search-query* box:\n\n resource.type=\"k8s_cluster\"\n logName:\"cloudaudit.googleapis.com%2Factivity\"\n (protoPayload.methodName=\"io.k8s.core.v1.pods.create\" OR\n protoPayload.methodName=\"io.k8s.core.v1.pods.update\")\n protoPayload.response.status=\"Failure\"\n (protoPayload.response.reason=\"VIOLATES_POLICY\" OR\n protoPayload.response.reason=\"Forbidden\")\n\n \u003cbr /\u003e\n\n3. Select the time range in the *time-range selector*.\n\ngcloud\n\nTo view policy violation events from the past week in Cloud Audit Logs using\nthe Google Cloud CLI, run the following command: \n\n gcloud logging read --order=\"desc\" --freshness=7d \\\n 'resource.type=\"k8s_cluster\"\n logName:\"cloudaudit.googleapis.com%2Factivity\"\n (protoPayload.methodName=\"io.k8s.core.v1.pods.create\" OR\n protoPayload.methodName=\"io.k8s.core.v1.pods.update\")\n protoPayload.response.status=\"Failure\"\n (protoPayload.response.reason=\"VIOLATES_POLICY\" OR\n protoPayload.response.reason=\"Forbidden\")'\n\n| **Note:** For Kubernetes master versions 1.18.15 and later, 1.19.7 and later, and 1.20.2 and later, `protoPayload.response.reason` is set to `VIOLATES_POLICY`.\n\nBreakglass events in Cloud Audit Logs\n\nBinary Authorization enables you to override the policy using a\n[*breakglass*](/binary-authorization/docs/deploying-containers#override_a_policy)\nlabel in the Pod specification. When images are deployed with breakglass,\nBinary Authorization logs breakglass events in Cloud Audit Logs. The\nfollowing section describes how you can query for these events.\n\nQuery Cloud Audit Logs for pods with breakglass specified \n\nLogs Explorer\n\nTo view breakglass events in the Cloud Audit Logs Logs Explorer, do the\nfollowing:\n\n1. Go to the [Logs Explorer page](https://console.cloud.google.com/logs/query).\n\n2. Enter the following in the *search-query* box:\n\n resource.type=\"k8s_cluster\"\n logName:\"cloudaudit.googleapis.com%2Factivity\"\n (protoPayload.methodName=\"io.k8s.core.v1.pods.create\" OR\n protoPayload.methodName=\"io.k8s.core.v1.pods.update\")\n \"image-policy.k8s.io/break-glass\"\n\n3. Select the time range in the *time-range selector*.\n\ngcloud\n\nTo view breakglass events from the past week in Cloud Audit Logs using the\nthe gcloud CLI, run the following command: \n\n gcloud logging read --order=\"desc\" --freshness=7d \\\n 'resource.type=\"k8s_cluster\" AND\n logName:\"cloudaudit.googleapis.com%2Factivity\" AND\n (protoPayload.methodName=\"io.k8s.core.v1.pods.create\" OR\n protoPayload.methodName=\"io.k8s.core.v1.pods.update\") AND\n \"image-policy.k8s.io/break-glass\"'\n\nFail open events in Cloud Audit Logs\n\nFail open occurs when a container image deployment is attempted,\nBinary Authorization enforcement is unavailable or times out, and the container\nimage is allowed to deploy.\n\nIn this case, the verification result is unknown and a log entry is recorded.\n\nQuery Cloud Audit Logs fail open events \n\nLogs Explorer\n\nTo view fail open events in the Cloud Audit Logs Logs Explorer, do the\nfollowing:\n\n1. Go to the [Logs Explorer page](https://console.cloud.google.com/logs/query).\n\n2. Enter the following in the *search-query* box:\n\n resource.type=\"k8s_cluster\"\n logName:\"cloudaudit.googleapis.com%2Factivity\"\n (protoPayload.methodName=\"io.k8s.core.v1.pods.create\" OR\n protoPayload.methodName=\"io.k8s.core.v1.pods.update\")\n (\"image-policy.k8s.io/failed-open\" OR\n \"imagepolicywebhook.image-policy.k8s.io/failed-open\" OR\n \"failed-open.validating.webhook.admission.k8s.io\")\n\n3. Select the time range in the *time-range selector*.\n\ngcloud\n\nTo view fail open events from the past week in Cloud Audit Logs using\nthe gcloud CLI, run the following command: \n\n gcloud logging read --order=\"desc\" --freshness=7d \\\n 'resource.type=\"k8s_cluster\"\n logName:\"cloudaudit.googleapis.com%2Factivity\"\n (protoPayload.methodName=\"io.k8s.core.v1.pods.create\" OR\n protoPayload.methodName=\"io.k8s.core.v1.pods.update\")\n (\"image-policy.k8s.io/failed-open\" OR\n \"imagepolicywebhook.image-policy.k8s.io/failed-open\" OR\n \"failed-open.validating.webhook.admission.k8s.io\")'\n\nDry run events in Cloud Audit Logs\n\n[Dry run mode](/binary-authorization/docs/key-concepts#enforcement_modes) is an enforcement mode in a policy\nthat enables non-conformant images to be deployed, but writes details about the\ndeployment to the audit log. Dry run mode allows you to test a policy in your\nproduction environment before it goes into effect.\n\nWhen a container image fails to pass the required checks in a policy, but is\npermitted to be deployed by dry run mode, Cloud Audit Logs contains\n`imagepolicywebhook.image-policy.k8s.io/dry-run: \"true\"`.\n\nQuery Cloud Audit Logs for dry run events \n\nLogs Explorer\n\nTo view dry run events in the Cloud Audit Logs Logs Explorer, do the\nfollowing:\n\n1. Go to the [Logs Explorer page](https://console.cloud.google.com/logs/query).\n\n2. Enter the following in the *search-query* box:\n\n resource.type=\"k8s_cluster\"\n logName:\"cloudaudit.googleapis.com%2Factivity\"\n (protoPayload.methodName=\"io.k8s.core.v1.pods.create\" OR\n protoPayload.methodName=\"io.k8s.core.v1.pods.update\")\n labels.\"imagepolicywebhook.image-policy.k8s.io/dry-run\"=\"true\"\n\n3. Select the time range in the *time-range selector*.\n\ngcloud\n\nTo view dry run deployment events from the past week in Cloud Audit Logs using\nthe gcloud CLI, run the following command: \n\n gcloud logging read --order=\"desc\" --freshness=7d \\\n 'labels.\"imagepolicywebhook.image-policy.k8s.io/dry-run\"=\"true\"'"]]
