库存管理

工作负载位置

仅限 root 用户的工作负载
审核日志源

Kubernetes 审核日志
接受审核的操作

数据更改（CRUD 操作）

数据更改（CRUD 操作）

包含审核信息的日志条目中的字段
审核元数据 审核字段名称 值
用户或服务身份 user

例如，

"user": {
  "username": "kubernetes-admin",
  "groups":["system:masters","system:authenticated"]
}

目标

（调用 API 的字段和值）

 requestURI "requestURI": "/apis/system.private.gdc.goog/v1alpha1/namespaces/gpc-system/spareparts"

操作

（包含所执行操作的字段）

 verb "verb":"create"
活动时间戳 requestReceivedTimestamp

例如，

"requestReceivedTimestamp":"2022-12-22T00:28:24.763163Z"
操作来源 sourceIPs

例如，

"sourceIPs":["10.200.0.2"]
结果 responseStatus

例如，

"responseStatus":{"code":201,"metadata":{}}
其他字段 不适用 不适用

日志示例

{
   "verb":"create",
   "user":{
      "username":"kubernetes-admin",
      "groups":[
         "system:masters",
         "system:authenticated"
      ]
   },
   "sourceIPs":[
      "10.200.0.2"
   ],
   "annotations":{
      "authorization.k8s.io/decision":"allow",
      "mutation.webhook.admission.k8s.io/round_0_index_2":"{\"configuration\":\"gatekeeper-mutating-webhook-configuration\",\"webhook\":\"mutation.gatekeeper.sh\",\"mutated\":false}",
      "authorization.k8s.io/reason":""
   },
   "requestReceivedTimestamp":"2022-12-22T00:28:24.763163Z",
   "_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-swcss",
   "responseStatus":{
      "code": 201,
      "metadata":{}
   },
   "objectRef":{
      "namespace":"gpc-system",
      "apiGroup":"system.private.gdc.goog",
      "resource":"spareparts",
      "name":"p06186-001-1234569087a",
      "apiVersion":"v1alpha1"
   },
   "apiVersion":"audit.k8s.io/v1",
   "_gdch_cluster":"root-admin",
   "level":"Metadata",
   "requestURI":"/apis/system.private.gdc.goog/v1alpha1/namespaces/gpc-system/spareparts?fieldManager=kubectl-client-side-apply",
   "auditID":"d9aa524b-0654-4e57-813f-b176a24244f1",
   "stageTimestamp":"2022-12-22T00:28:24.779255Z",
   "stage":"ResponseComplete",
   "userAgent":"kubectl/v1.22.9 (darwin/amd64) kubernetes/2b63bf7",
   "kind":"Event",
   "_gdch_service_name":"apiserver",
   "_gdch_tenant_id":"infra-obs"
}