| 工作负载位置 |
仅限 root 用户的工作负载 |
| 审核日志源 | |
| 接受审核的操作 |
数据更改（CRUD 操作） |
数据更改（CRUD 操作）
| 包含审核信息的日志条目中的字段 | ||
|---|---|---|
| 审核元数据 | 审核字段名称 | 值 |
| 用户或服务身份 | user |
例如， "user": { "username": "kubernetes-admin", "groups":["system:masters","system:authenticated"] } |
|
目标 （调用 API 的字段和值） |
requestURI |
"requestURI": "/apis/system.private.gdc.goog/v1alpha1/namespaces/gpc-system/spareparts" |
|
操作 （包含所执行操作的字段） |
verb |
"verb":"create" |
| 活动时间戳 | requestReceivedTimestamp |
例如，
|
| 操作来源 | sourceIPs |
例如，
|
| 结果 | responseStatus |
例如，
|
| 其他字段 | 不适用 | 不适用 |
日志示例
{
"verb":"create",
"user":{
"username":"kubernetes-admin",
"groups":[
"system:masters",
"system:authenticated"
]
},
"sourceIPs":[
"10.200.0.2"
],
"annotations":{
"authorization.k8s.io/decision":"allow",
"mutation.webhook.admission.k8s.io/round_0_index_2":"{\"configuration\":\"gatekeeper-mutating-webhook-configuration\",\"webhook\":\"mutation.gatekeeper.sh\",\"mutated\":false}",
"authorization.k8s.io/reason":""
},
"requestReceivedTimestamp":"2022-12-22T00:28:24.763163Z",
"_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-swcss",
"responseStatus":{
"code": 201,
"metadata":{}
},
"objectRef":{
"namespace":"gpc-system",
"apiGroup":"system.private.gdc.goog",
"resource":"spareparts",
"name":"p06186-001-1234569087a",
"apiVersion":"v1alpha1"
},
"apiVersion":"audit.k8s.io/v1",
"_gdch_cluster":"root-admin",
"level":"Metadata",
"requestURI":"/apis/system.private.gdc.goog/v1alpha1/namespaces/gpc-system/spareparts?fieldManager=kubectl-client-side-apply",
"auditID":"d9aa524b-0654-4e57-813f-b176a24244f1",
"stageTimestamp":"2022-12-22T00:28:24.779255Z",
"stage":"ResponseComplete",
"userAgent":"kubectl/v1.22.9 (darwin/amd64) kubernetes/2b63bf7",
"kind":"Event",
"_gdch_service_name":"apiserver",
"_gdch_tenant_id":"infra-obs"
}