Cluster do Kubernetes (KUB)

Local da carga de trabalho

Cargas de trabalho somente de raiz
Origem do registro de auditoria

Registros de auditoria do Kubernetes
Operações auditadas

Mudanças nos dados do NodePoolClaim (operações CRUD)

Campos na entrada de registro que contêm informações de auditoria
Metadados de auditoria Nome do campo de auditoria Valor
Identidade de usuário ou serviço user.username

Por exemplo,

"user":{
 "username":"system:serviceaccount:kube-system:
  anthos-cluster-operator-1.13.2"
  }

Objetivo

(Campos e valores que chamam a API)

 requestURI

"requestURI":"/apis/baremetal.cluster.gke.io/v1/ namespaces/org-1/nodepoolclaims/admin-control-plane-node-pool/ status"

Ação

(Campos que contêm a operação realizada)

 verb

"verb":"update"

Carimbo de data/hora do evento requestReceivedTimestamp

Por exemplo,

"requestReceivedTimestamp":"2022-11-18T23:15:22.882546Z"

Origem da ação sourceIPs

Por exemplo,

"sourceIPs":["10.253.128.74"]
Resultado stage

Por exemplo,

"stage":"ResponseComplete"
Outros campos
  • kind
  • objectRef

Por exemplo,

"kind": "Event",
  "objectRef": {
    "resource": "nodepoolclaims",
    "namespace": "org-1",
    "subresource": "status",
    "name": "admin-control-plane-node-pool",
    "apiVersion": "v1",
    "apiGroup": "baremetal.cluster.gke.io",
    "resourceVersion": "878163",
    "uid": "b2e1bec0-0f7c-4a57-869b-3fcb969ba7e2"
    }

Exemplo de registro

{
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "_gdch_cluster": "root-admin",
  "sourceIPs": [
    "10.253.128.74"
  ],
  "annotations": {
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \
    "operator-rolebinding-1.13.2\
    "of ClusterRole \"anthos-baremetal-operator-1.13.2\" 
    to ServiceAccount \"anthos-cluster-operator-1.13.2/kube-system\"",
    "authorization.k8s.io/decision": "allow"
  },
  "requestReceivedTimestamp": "2022-11-23T23:19:42.690064Z",
  "stageTimestamp": "2022-11-23T23:19:42.695372Z",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-4hlmv",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "user": {
    "extra": {
      "authentication.kubernetes.io/pod-name": [
        "anthos-cluster-operator-1.13.2-bc6b7467d-22z88"
      ],
      "authentication.kubernetes.io/pod-uid": [
        "004e1b37-6d4d-4959-b77d-0e69dce5ef4a"
      ]
    },
    "groups": [
      "system:serviceaccounts",
      "system:serviceaccounts:kube-system",
      "system:authenticated"
    ],
    "username": "system:serviceaccount:kube-system:anthos-cluster-operator-1.13.2",
    "uid": "4ebfd4f7-f371-4c40-9f88-ea0709a7039e"
  },
  "stage": "ResponseComplete",
  "requestURI": "/apis/baremetal.cluster.gke.io/v1/namespaces/org-1/
                 nodepoolclaims/admin-control-plane-node-pool/status",
  "kind": "Event",
  "objectRef": {
    "resource": "nodepoolclaims",
    "namespace": "org-1",
    "subresource": "status",
    "name": "admin-control-plane-node-pool",
    "apiVersion": "v1",
    "apiGroup": "baremetal.cluster.gke.io",
    "resourceVersion": "878163",
    "uid": "b2e1bec0-0f7c-4a57-869b-3fcb969ba7e2"
  },
  "verb": "update",
  "userAgent": "operator/v0.0.0 (linux/amd64) kubernetes/$Format",
  "auditID": "0539ea3a-b858-4a43-b516-812fc7e80dbd",
  "_gdch_service_name": "apiserver"
}

Mudanças nos dados de AddressPoolClaim (operações CRUD)

Campos na entrada de registro que contêm informações de auditoria
Metadados de auditoria Nome do campo de auditoria Valor
Identidade de usuário ou serviço user.username

Por exemplo,

"user":{
 "username":"system:serviceaccount:
  gpc-system:root-admin-controller-sa"
  }

Objetivo

(Campos e valores que chamam a API)

 requestURI

"requestURI":"/apis/system.private.gdc.goog/VERSION/ namespaces/org-1/addresspoolclaims/admin-control-plane-node-pool? fieldManager=Organization&force=true"

Ação

(Campos que contêm a operação realizada)

 verb

"verb":"patch"

Carimbo de data/hora do evento requestReceivedTimestamp

Por exemplo,

"requestReceivedTimestamp":"2022-11-23T23:24:13.087516Z"

Origem da ação sourceIPs

Por exemplo,

"sourceIPs":["10.128.3.197"]
Resultado stage

Por exemplo,

"stage":"ResponseComplete"
Outros campos
  • kind
  • objectRef

Por exemplo,

  "objectRef": {
    "namespace": "org-1",
    "name": "admin-control-plane-node-pool",
    "apiGroup": "system.private.gdc.goog",
    "apiVersion": "VERSION",
    "resource": "addresspoolclaims"
    }

Exemplo de registro

{
  "_gdch_cluster": "root-admin",
  "requestReceivedTimestamp": "2022-11-23T23:24:13.087516Z",
  "userAgent": "root-admin-cm/v0.0.0 (linux/amd64) kubernetes/$Format",
  "kind": "Event",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-4hlmv",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "3e46bf8d-fc26-4b43-85fe-34f1f55a0398",
  "requestURI": "/apis/system.private.gdc.goog/VERSION/namespaces/org-1/
    addresspoolclaims/admin-control-plane-node-pool?
    fieldManager=Organization&force=true",
  "stage": "ResponseComplete",
  "user": {
    "groups": [
      "system:serviceaccounts",
      "system:serviceaccounts:gpc-system",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/pod-name": [
        "root-admin-controller-55b54bc95c-wjnwm"
      ],
      "authentication.kubernetes.io/pod-uid": [
        "915f7dcd-e8cb-4a1a-9c53-4b8e2751cf03"
      ]
    },
    "username": "system:serviceaccount:gpc-system:root-admin-controller-sa",
    "uid": "1ddfb03e-0dd5-42df-b8cb-c53a504d9026"
  },
  "verb": "patch",
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "objectRef": {
    "namespace": "org-1",
    "name": "admin-control-plane-node-pool",
    "apiGroup": "system.private.gdc.goog",
    "apiVersion": "VERSION",
    "resource": "addresspoolclaims"
  },
  "sourceIPs": [
    "10.128.3.197"
  ],
  "annotations": {
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \
    "root-admin-rootadmin-controllers-rolebinding\" of ClusterRole \
    "root-admin-rootadmin-controllers-role\" to ServiceAccount \"root-admin-controller-sa/
    gpc-system\"",
    "authorization.k8s.io/decision": "allow"
  },
  "stageTimestamp": "2022-11-23T23:24:13.100163Z",
  "_gdch_service_name": "apiserver"
}

Mudanças nos dados de SubnetClaim (operações CRUD)

Campos na entrada de registro que contêm informações de auditoria
Metadados de auditoria Nome do campo de auditoria Valor
Identidade de usuário ou serviço user.username

Por exemplo,

"user":{
 "username":"system:serviceaccount:
             gatekeeper-system:gatekeeper-admin"
  }

Objetivo

(Campos e valores que chamam a API)

 requestURI

"requestURI":"/apis/system.private.gdc.goog/ VERSION/subnetclaims?limit=500"

Ação

(Campos que contêm a operação realizada)

 verb

"verb":"list"

Carimbo de data/hora do evento requestReceivedTimestamp

Por exemplo,

"requestReceivedTimestamp":"2022-11-23T23:25:32.726387Z"

Origem da ação sourceIPs

Por exemplo,

"sourceIPs":["10.253.129.191"]
Resultado stage

Por exemplo,

"stage":"ResponseComplete"
Outros campos
  • kind
  • objectRef

Por exemplo,

  "objectRef": {
    "resource": "subnetclaims",
    apiVersion": "VERSION",
    "apiGroup": "system.private.gdc.goog"
    }

Exemplo de registro

{
  "_gdch_cluster": "root-admin",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-gc5d7",
  "stageTimestamp": "2022-11-23T23:25:32.733616Z",
  "responseStatus": {
    "code": 200,
    "metadata": {}
  },
  "objectRef": {
    "resource": "subnetclaims",
    "apiVersion": "VERSION",
    "apiGroup": "system.private.gdc.goog"
  },
  "auditID": "b611ebea-4c30-4962-9283-c5dcc95c6e13",
  "verb": "list",
  "kind": "Event",
  "annotations": {
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"gatekeeper-manager-rolebinding\
                                   " of ClusterRole \"gatekeeper-manager-role\" to ServiceAccount \
                                   "gatekeeper-admin/gatekeeper-system\"",
    "authorization.k8s.io/decision": "allow"
  },
  "user": {
    "extra": {
      "authentication.kubernetes.io/pod-name": [
        "gatekeeper-audit-b765495d8-4znjd"
      ],
      "authentication.kubernetes.io/pod-uid": [
        "9e515f53-15bf-4570-9c57-2f53e0b69a5d"
      ]
    },
    "uid": "d5dc180d-1bca-4d84-885d-a871e0b6d5a2",
    "groups": [
      "system:serviceaccounts",
      "system:serviceaccounts:gatekeeper-system",
      "system:authenticated"
    ],
    "username": "system:serviceaccount:gatekeeper-system:gatekeeper-admin"
  },
  "stage": "ResponseComplete",
  "userAgent": "gatekeeper/v3.7.0 (linux/amd64) 3ba8e93/2021-11-15T20:59:44Z",
  "requestURI": "/apis/system.private.gdc.goog/VERSION/subnetclaims?limit=500",
  "requestReceivedTimestamp": "2022-11-23T23:25:32.726387Z",
  "sourceIPs": [
    "10.253.129.191"
  ],
  "level": "Metadata",
  "apiVersion": "audit.k8s.io/v1",
  "_gdch_service_name": "apiserver"
}

Mudanças nos dados do CIDRClaim (operações CRUD)

Campos na entrada de registro que contêm informações de auditoria
Metadados de auditoria Nome do campo de auditoria Valor
Identidade de usuário ou serviço user.username

Por exemplo,

"user":{
 "username":"system:serviceaccount:
             gatekeeper-system:gatekeeper-admin"
  }

Objetivo

(Campos e valores que chamam a API)

 requestURI

"requestURI":"/apis/baremetal.cluster.gke.io/ VERSION/addonconfigurations?limit=500"

Ação

(Campos que contêm a operação realizada)

 verb

"verb":"list"

Carimbo de data/hora do evento requestReceivedTimestamp

Por exemplo,

"requestReceivedTimestamp":"2022-11-23T23:29:31.952355Z"

Origem da ação sourceIPs

Por exemplo,

"sourceIPs":["10.253.129.191"]
Resultado stage

Por exemplo,

"stage":"ResponseComplete"
Outros campos
  • kind
  • objectRef

Por exemplo,

"objectRef": {
    "apiGroup": "dr.private.gdc.goog",
    "resource": "cidrclaimallocations",
    "apiVersion": "VERSION"
    }

Exemplo de registro

{
  "_gdch_cluster": "root-admin",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-gc5d7",
  "objectRef": {
    "apiGroup": "dr.private.gdc.goog",
    "resource": "cidrclaimallocations",
    "apiVersion": "VERSION"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"gatekeeper-manager-rolebinding\" of ClusterRole \"gatekeeper-manager-role\" to ServiceAccount \"gatekeeper-admin/gatekeeper-system\""
  },
  "stageTimestamp": "2022-11-23T23:26:28.165121Z",
  "kind": "Event",
  "level": "Metadata",
  "auditID": "a21c62ab-6f86-4898-a719-0970e89a031c",
  "user": {
    "groups": [
      "system:serviceaccounts",
      "system:serviceaccounts:gatekeeper-system",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/pod-name": [
        "gatekeeper-audit-b765495d8-4znjd"
      ],
      "authentication.kubernetes.io/pod-uid": [
        "9e515f53-15bf-4570-9c57-2f53e0b69a5d"
      ]
    },
    "username": "system:serviceaccount:gatekeeper-system:gatekeeper-admin",
    "uid": "d5dc180d-1bca-4d84-885d-a871e0b6d5a2"
  },
  "stage": "ResponseComplete",
  "apiVersion": "audit.k8s.io/v1",
  "requestURI": "/apis/dr.private.gdc.goog/VERSION/cidrclaimallocations?limit=500",
  "requestReceivedTimestamp": "2022-11-23T23:26:28.159646Z",
  "verb": "list",
  "sourceIPs": [
    "10.253.129.191"
  ],
  "userAgent": "gatekeeper/v3.7.0 (linux/amd64) 3ba8e93/2021-11-15T20:59:44Z",
  "_gdch_service_name": "apiserver"
}

Mudanças nos dados do cluster (operações CRUD)

Campos na entrada de registro que contêm informações de auditoria
Metadados de auditoria Nome do campo de auditoria Valor
Identidade de usuário ou serviço user.username

Por exemplo,

"user":{
 "username":"system:serviceaccount:
             gatekeeper-system:gatekeeper-admin"
  }

Objetivo

(Campos e valores que chamam a API)

 requestURI

"requestURI":"/apis/baremetal.cluster.gke.io/ VERSION/addonconfigurations?limit=500"

Ação

(Campos que contêm a operação realizada)

 verb

"verb":"list"

Carimbo de data/hora do evento requestReceivedTimestamp

Por exemplo,

"requestReceivedTimestamp":"2022-11-23T23:29:31.952355Z"

Origem da ação sourceIPs

Por exemplo,

"sourceIPs":["10.253.129.191"]
Resultado stage

Por exemplo,

"stage":"ResponseComplete"
Outros campos
  • kind
  • objectRef

Por exemplo,

"objectRef": {
    "apiGroup": "baremetal.cluster.gke.io",
    "resource": "addonconfigurations",
    "apiVersion": "VERSION"
    }

Exemplo de registro

{
  "sourceIPs": [
    "10.253.129.191"
  ],
  "stageTimestamp": "2022-11-23T23:29:31.952355Z",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-gc5d7",
  "_gdch_cluster": "root-admin",
  "userAgent": "gatekeeper/v3.7.0 (linux/amd64) 3ba8e93/2021-11-15T20:59:44Z",
  "stage": "RequestReceived",
  "auditID": "3f05e001-38f0-431e-8cc2-61d00d992b6d",
  "kind": "Event",
  "level": "Metadata",
  "apiVersion": "audit.k8s.io/v1",
  "requestURI": "/apis/baremetal.cluster.gke.io/VERSION/addonconfigurations?limit=500",
  "requestReceivedTimestamp": "2022-11-23T23:29:31.952355Z",
  "verb": "list",
  "user": {
    "extra": {
      "authentication.kubernetes.io/pod-name": [
        "gatekeeper-audit-b765495d8-4znjd"
      ],
      "authentication.kubernetes.io/pod-uid": [
        "9e515f53-15bf-4570-9c57-2f53e0b69a5d"
      ]
    },
    "uid": "d5dc180d-1bca-4d84-885d-a871e0b6d5a2",
    "groups": [
      "system:serviceaccounts",
      "system:serviceaccounts:gatekeeper-system",
      "system:authenticated"
    ],
    "username": "system:serviceaccount:gatekeeper-system:gatekeeper-admin"
  },
  "objectRef": {
    "apiGroup": "baremetal.cluster.gke.io",
    "resource": "addonconfigurations",
    "apiVersion": "VERSION"
  },
  "_gdch_service_name": "apiserver"
}

Mudanças nos dados do NodePool (operações CRUD)

Campos na entrada de registro que contêm informações de auditoria
Metadados de auditoria Nome do campo de auditoria Valor
Identidade de usuário ou serviço user.username

Por exemplo,

"user":{
 "username":"system:serviceaccount:
             kube-system:lifecycle-controllers-manager"
  }

Objetivo

(Campos e valores que chamam a API)

 requestURI

"requestURI":"/apis/baremetal.cluster.gke.io/v1/nodepools"

Ação

(Campos que contêm a operação realizada)

 verb

"verb":"list"

Carimbo de data/hora do evento requestReceivedTimestamp

Por exemplo,

"requestReceivedTimestamp":"2022-11-23T23:29:31.952355Z"

Origem da ação sourceIPs

Por exemplo,

"sourceIPs":["2022-11-23T23:28:41.742117Z"]
Resultado stage

Por exemplo,

"stage":"ResponseComplete"
Outros campos
  • kind
  • objectRef

Por exemplo,

"objectRef": {
    "apiGroup": "baremetal.cluster.gke.io",
    "resource": "nodepools",
    "apiVersion": "v1"
    }

Exemplo de registro

{
  "requestURI": "/apis/baremetal.cluster.gke.io/v1/nodepools",
  "_gdch_cluster": "root-admin",
  "sourceIPs": [
    "10.253.130.147"
  ],
  "stageTimestamp": "2022-11-23T23:28:41.746854Z",
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "annotations": {
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \
                                  "lifecycl-controllers-manager-rolebinding\" 
                                  of ClusterRole \"lifecycle-controllers-manager\
                                  " to ServiceAccount \"lifecycle-controllers-manager/kube-system\"",
    "authorization.k8s.io/decision": "allow"
  },
  "requestReceivedTimestamp": "2022-11-23T23:28:41.742117Z",
  "userAgent": "manager/v0.0.0 (linux/amd64) kubernetes/$Format",
  "kind": "Event",
  "auditID": "c916fab1-a10b-4df8-b680-71ccb5d339ac",
  "user": {
    "extra": {
      "authentication.kubernetes.io/pod-uid": [
        "0b1e3b51-8bdb-4527-8a34-1ae7577cf0aa"
      ],
      "authentication.kubernetes.io/pod-name": [
        "lifecycle-controllers-manager-7495f9dd99-bfvdg"
      ]
    },
    "groups": [
      "system:serviceaccounts",
      "system:serviceaccounts:kube-system",
      "system:authenticated"
    ],
    "username": "system:serviceaccount:kube-system:lifecycle-controllers-manager",
    "uid": "c84957dc-f483-41c4-b0e1-1a2c9cb93dda"
  },
  "stage": "ResponseComplete",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-4hlmv",
  "verb": "list",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "objectRef": {
    "apiGroup": "baremetal.cluster.gke.io",
    "resource": "nodepools",
    "apiVersion": "v1"
  },
  "_gdch_service_name": "apiserver"
}