Workload location |
Root only workloads |
Audit log source | |
Audited operations |
Data changes (CRUD operations) |
Data changes (CRUD operations)
Fields in the log entry that contain audit information | ||
---|---|---|
Audit metadata | Audit field name | Value |
User or service identity | user |
For example, "user": { "username": "kubernetes-admin", "groups":["system:masters","system:authenticated"] } |
Target (Fields and values that call the API) |
requestURI |
"requestURI": "/apis/system.private.gdc.goog/v1alpha1/namespaces/gpc-system/spareparts" |
Action (Fields containing the performed operation) |
verb |
"verb":"create" |
Event timestamp | requestReceivedTimestamp |
For example,
|
Source of action | sourceIPs |
For example,
|
Outcome | responseStatus |
For example,
|
Other fields | Not applicable | Not applicable |
Example log
{
"verb":"create",
"user":{
"username":"kubernetes-admin",
"groups":[
"system:masters",
"system:authenticated"
]
},
"sourceIPs":[
"10.200.0.2"
],
"annotations":{
"authorization.k8s.io/decision":"allow",
"mutation.webhook.admission.k8s.io/round_0_index_2":"{\"configuration\":\"gatekeeper-mutating-webhook-configuration\",\"webhook\":\"mutation.gatekeeper.sh\",\"mutated\":false}",
"authorization.k8s.io/reason":""
},
"requestReceivedTimestamp":"2022-12-22T00:28:24.763163Z",
"_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-swcss",
"responseStatus":{
"code": 201,
"metadata":{}
},
"objectRef":{
"namespace":"gpc-system",
"apiGroup":"system.private.gdc.goog",
"resource":"spareparts",
"name":"p06186-001-1234569087a",
"apiVersion":"v1alpha1"
},
"apiVersion":"audit.k8s.io/v1",
"_gdch_cluster":"root-admin",
"level":"Metadata",
"requestURI":"/apis/system.private.gdc.goog/v1alpha1/namespaces/gpc-system/spareparts?fieldManager=kubectl-client-side-apply",
"auditID":"d9aa524b-0654-4e57-813f-b176a24244f1",
"stageTimestamp":"2022-12-22T00:28:24.779255Z",
"stage":"ResponseComplete",
"userAgent":"kubectl/v1.22.9 (darwin/amd64) kubernetes/2b63bf7",
"kind":"Event",
"_gdch_service_name":"apiserver",
"_gdch_tenant_id":"infra-obs"
}