Dynamic Host Configuration Protocol (DHCP)

Workload location

Root only workloads
Audit log source Kubernetes audit logs
Audited operations CRUD operations to the DHCP config

CRUD operations to the DHCP config

The CRUD operations include data changes to the DHCP config logged in the audit log server.

Fields in the log entry that contain audit information
Audit metadata Audit field name Value
User or service identity userAgent, user_name

For example,

"userAgent": "kubectl/v1.23.5 (linux/amd64) kubernetes/c285e78",
"user": {
  "username": "kubernetes-admin"
}

Target

(Fields and values that call the API)

 requestURI

For example,

"requestURI": "/api/v1/namespaces/gpc-system/configmaps/gpc-dhcp-conf?fieldManager=kubectl-edit"

Action

(Fields containing the performed operation)

 verb

For example,

"verb": "patch"

Event timestamp requestReceivedTimestamp

For example,

"requestReceivedTimestamp": "2022-12-13T06:59:55.681994Z"

Source of action _gdch_service_name

For example,

 "_gdch_service_name": "apiserver"

Outcome code

For example,

"responseStatus": {
    "code": 200,
  }

Example log

{
  "_gdch_cluster": "root-admin",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-2z87b",
  "_gdch_service_name": "apiserver",
  "annotations": {
    "authorization_k8s_io_decision": "allow",
    "authorization_k8s_io_reason": ""
  },
  "apiGroup": "UNKNOWN",
  "apiVersion": "audit.k8s.io/v1",
  "auditID": "8841cec6-1557-4278-8ba2-1f89b7953a81",
  "cluster": "root-admin",
  "auditID": "069120c2-c182-4e8f-b863-9c640885bf2b",
  "fluentbit_pod": "anthos-audit-logs-forwarder-2z87b",
  "kind": "Event",
  "level": "Metadata",
  "objectRef": {
    "apiGroup": "UNKNOWN",
    "apiVersion": "v1",
    "name": "gpc-dhcp-conf",
    "namespace": "gpc-system",
    "resource": "configmaps"
  },
  "requestReceivedTimestamp": "2022-12-13T06:59:55.681994Z",
  "requestURI": "/api/v1/namespaces/gpc-system/configmaps/gpc-dhcp-conf?fieldManager=kubectl-edit",
  "responseStatus": {
    "code": 200
  },
  "service_name": "apiserver",
  "stage": "ResponseComplete",
  "stageTimestamp": "2022-12-13T06:59:55.699551Z",
  "userAgent": "kubectl/v1.23.5 (linux/amd64) kubernetes/c285e78",
  "user": {
    "username": "kubernetes-admin"
  },
  "verb": "patch",
  "Detected": "fields",
  "Time": "1670915285440",
  "tsNs": "1670915285440328017"
}