Inventory Management

Workload location

Root only workloads
Audit log source

Kubernetes audit logs
Audited operations

Data changes (CRUD operations)

Data changes (CRUD operations)

Fields in the log entry that contain audit information
Audit metadata Audit field name Value
User or service identity user

For example,

"user": {
  "username": "kubernetes-admin",
  "groups":["system:masters","system:authenticated"]
}

Target

(Fields and values that call the API)

 requestURI "requestURI": "/apis/system.private.gdc.goog/v1alpha1/namespaces/gpc-system/spareparts"

Action

(Fields containing the performed operation)

 verb "verb":"create"
Event timestamp requestReceivedTimestamp

For example,

"requestReceivedTimestamp":"2022-12-22T00:28:24.763163Z"
Source of action sourceIPs

For example,

"sourceIPs":["10.200.0.2"]
Outcome responseStatus

For example,

"responseStatus":{"code":201,"metadata":{}}
Other fields Not applicable Not applicable

Example log

{
   "verb":"create",
   "user":{
      "username":"kubernetes-admin",
      "groups":[
         "system:masters",
         "system:authenticated"
      ]
   },
   "sourceIPs":[
      "10.200.0.2"
   ],
   "annotations":{
      "authorization.k8s.io/decision":"allow",
      "mutation.webhook.admission.k8s.io/round_0_index_2":"{\"configuration\":\"gatekeeper-mutating-webhook-configuration\",\"webhook\":\"mutation.gatekeeper.sh\",\"mutated\":false}",
      "authorization.k8s.io/reason":""
   },
   "requestReceivedTimestamp":"2022-12-22T00:28:24.763163Z",
   "_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-swcss",
   "responseStatus":{
      "code": 201,
      "metadata":{}
   },
   "objectRef":{
      "namespace":"gpc-system",
      "apiGroup":"system.private.gdc.goog",
      "resource":"spareparts",
      "name":"p06186-001-1234569087a",
      "apiVersion":"v1alpha1"
   },
   "apiVersion":"audit.k8s.io/v1",
   "_gdch_cluster":"root-admin",
   "level":"Metadata",
   "requestURI":"/apis/system.private.gdc.goog/v1alpha1/namespaces/gpc-system/spareparts?fieldManager=kubectl-client-side-apply",
   "auditID":"d9aa524b-0654-4e57-813f-b176a24244f1",
   "stageTimestamp":"2022-12-22T00:28:24.779255Z",
   "stage":"ResponseComplete",
   "userAgent":"kubectl/v1.22.9 (darwin/amd64) kubernetes/2b63bf7",
   "kind":"Event",
   "_gdch_service_name":"apiserver",
   "_gdch_tenant_id":"infra-obs"
}