Gestion des machines virtuelles (VMM)

Emplacement de la charge de travail

Charges de travail de l'organisation
Source du journal d'audit

Journaux d'audit Kubernetes
Opérations auditées

Créer une VM

Champs de l'entrée de journal contenant des informations d'audit
Métadonnées d'audit Nom du champ d'audit Valeur
Identité de l'utilisateur ou du service user

Par exemple,

"user": {
    "groups": [
      "system:authenticated"
    ],
    "username": "fop-myusername"
    }

Cible

(Champs et valeurs qui appellent l'API)

 objectRef

Par exemple,

"objectRef": {
    "apiGroup": "virtualmachine.gdc.goog",
    "apiVersion": "v1",
    "name": "vm1",
    "namespace": "myusername-test",
    "resource": "virtualmachines"
    }

Action

(Champs contenant l'opération effectuée)

 verb "verb": "create"
Code temporel de l'événement requestReceivedTimestamp

Par exemple,

"requestReceivedTimestamp": "2023-09-19T21:16:11.086606Z"
Source de l'action _gdch_cluster

Par exemple,

"_gdch_cluster": "org-1-infra"
Résultat responseStatus

Par exemple,

"responseStatus": {
    "code": 201,
    "metadata": {}
    }

Autres champs Non applicable Non applicable

Exemple de journal

{
  "_gdch_cluster": "org-1-infra",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-tzdxt",
  "_gdch_org_id": "org-1.zone1.google.gdch.test",
  "_gdch_org_name": "org-1",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by RoleBinding \"fop-myusername-vm-admin/myusername-test\" of Role \"project-vm-admin\" to User \"fop-myusername\"",
    "mutation.webhook.admission.k8s.io/round_0_index_12": "{\"configuration\":\"gatekeeper-mutating-webhook-configuration\",\"webhook\":\"mutation.gatekeeper.sh\",\"mutated\":false}"
  },
  "apiVersion": "audit.k8s.io/v1",
  "auditID": "6b48ee52-baa4-47d1-9357-98d1bf7bee7e",
  "kind": "Event",
  "level": "Metadata",
  "objectRef": {
    "apiGroup": "virtualmachine.gdc.goog",
    "apiVersion": "v1",
    "name": "vm1",
    "namespace": "myusername-test",
    "resource": "virtualmachines"
  },
  "requestReceivedTimestamp": "2023-09-19T21:16:11.086606Z",
  "requestURI": "/apis/virtualmachine.gdc.goog/v1/namespaces/myusername-test/virtualmachines?fieldManager=kubectl-client-side-apply",
  "responseStatus": {
    "code": 201,
    "metadata": {}
  },
  "sourceIPs": [
    "10.200.0.1",
    "10.200.0.6"
  ],
  "stage": "ResponseComplete",
  "stageTimestamp": "2023-09-19T21:16:11.097294Z",
  "user": {
    "groups": [
      "system:authenticated"
    ],
    "username": "fop-myusername"
  },
  "userAgent": "kubectl/v1.23.5 (linux/amd64) kubernetes/c285e78",
  "verb": "create"
}

Répertorier les VM

Champs de l'entrée de journal contenant des informations d'audit
Métadonnées d'audit Nom du champ d'audit Valeur
Identité de l'utilisateur ou du service user

Par exemple,

"user": {
    "groups": [
      "system:authenticated"
    ],
    "username": "fop-myusername"
    }

Cible

(Champs et valeurs qui appellent l'API)

 objectRef

Par exemple,

"objectRef": {
    "apiGroup": "virtualmachine.gdc.goog",
    "apiVersion": "v1",
    "namespace": "myusername-test",
    "resource": "virtualmachines"
    }

Action

(Champs contenant l'opération effectuée)

 verb "verb": "list"
Code temporel de l'événement requestReceivedTimestamp

Par exemple,

"requestReceivedTimestamp": "2023-09-19T21:37:40.632532Z"
Source de l'action _gdch_cluster

Par exemple,

"_gdch_cluster": "org-1-infra"
Résultat responseStatus

Par exemple,

"responseStatus": {
    "code": 200,
    "metadata": {}
    }

Autres champs Non applicable Non applicable

Exemple de journal

{
  "_gdch_cluster": "org-1-infra",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-tzdxt",
  "_gdch_org_id": "org-1.zone1.google.gdch.test",
  "_gdch_org_name": "org-1",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by RoleBinding \"fop-myusername-vm-admin/myusername-test\" of Role \"project-vm-admin\" to User \"fop-myusername\""
  },
  "apiVersion": "audit.k8s.io/v1",
  "auditID": "e848a3a1-da7e-4b74-8c12-f2af066dda55",
  "kind": "Event",
  "level": "Metadata",
  "objectRef": {
    "apiGroup": "virtualmachine.gdc.goog",
    "apiVersion": "v1",
    "namespace": "myusername-test",
    "resource": "virtualmachines"
  },
  "requestReceivedTimestamp": "2023-09-19T21:37:40.632532Z",
  "requestURI": "/apis/virtualmachine.gdc.goog/v1/namespaces/myusername-test/virtualmachines?limit=500",
  "responseStatus": {
    "code": 200,
    "metadata": {}
  },
  "sourceIPs": [
    "10.200.0.1",
    "10.200.0.6"
  ],
  "stage": "ResponseComplete",
  "stageTimestamp": "2023-09-19T21:37:40.639807Z",
  "user": {
    "groups": [
      "system:authenticated"
    ],
    "username": "fop-myusername"
  },
  "userAgent": "kubectl/v1.23.5 (linux/amd64) kubernetes/c285e78",
  "verb": "list"
}

Mettre à jour une VM

Cela inclut les opérations de démarrage/arrêt. Une opération de redémarrage s'affiche également sous la forme de deux opérations de mise à jour (arrêt et démarrage) par un compte de service.

Champs de l'entrée de journal contenant des informations d'audit
Métadonnées d'audit Nom du champ d'audit Valeur
Identité de l'utilisateur ou du service user

Par exemple,

"user":{
    "username": "fop-myname-test",
    "groups":[
      "system: authenticated"
      ]
    }

Cible

(Champs et valeurs qui appellent l'API)

 objectRef

Par exemple,

"objectRef": {
    "apiGroup": "virtualmachine.gdc.goog",
    "apiVersion": "v1",
    "name": "vm1",
    "namespace": "myusername-test",
    "resource": "virtualmachines"
    }

Action

(Champs contenant l'opération effectuée)

 verb "verb": "patch"
Code temporel de l'événement requestReceivedTimestamp

Par exemple,

"requestReceivedTimestamp": "2023-09-19T21:42:20.229318Z"
Source de l'action _gdch_cluster

Par exemple,

"_gdch_cluster": "org-1-infra"
Résultat responseStatus

Par exemple,

"responseStatus": {
    "code": 415,
    "message": "the body of the request was in an unknown format - accepted media types include: application/json-patch+json, application/merge-patch+json, application/apply-patch+yaml",
    "metadata": {},
    "reason": "UnsupportedMediaType",
    "status": "Failure"
    }

Autres champs Non applicable Non applicable

Exemple de journal

{
  "_gdch_cluster": "org-1-infra",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-rxgp7",
  "_gdch_org_id": "org-1.zone1.google.gdch.test",
  "_gdch_org_name": "org-1",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"vmm-controller\" of ClusterRole \"vmm-controller\" to ServiceAccount \"vmm-controller/vm-system\""
  },
  "apiVersion": "audit.k8s.io/v1",
  "auditID": "f094a667-adc8-46cf-9ce7-e0f534b792a9",
  "kind": "Event",
  "level": "Metadata",
  "objectRef": {
    "apiGroup": "virtualmachine.gdc.goog",
    "apiVersion": "v1",
    "name": "vm1",
    "namespace": "myusername-test",
    "resource": "virtualmachines"
  },
  "requestReceivedTimestamp": "2023-09-19T21:42:20.229318Z",
  "requestURI": "/apis/virtualmachine.gdc.goog/v1/namespaces/myusername-test/virtualmachines/vm1",
  "responseStatus": {
    "code": 415,
    "message": "the body of the request was in an unknown format - accepted media types include: application/json-patch+json, application/merge-patch+json, application/apply-patch+yaml",
    "metadata": {},
    "reason": "UnsupportedMediaType",
    "status": "Failure"
  },
  "sourceIPs": [
    "10.201.64.17"
  ],
  "stage": "ResponseComplete",
  "stageTimestamp": "2023-09-19T21:42:20.230057Z",
  "user": {
    "extra": {
      "authentication.kubernetes.io/pod-name": [
        "vmm-controller-588b67d499-p7qzv"
      ],
      "authentication.kubernetes.io/pod-uid": [
        "b5bec7d9-d813-4c9d-a2c6-7c8b2ab7ae9c"
      ]
    },
    "groups": [
      "system:serviceaccounts",
      "system:serviceaccounts:vm-system",
      "system:authenticated"
    ],
    "uid": "24a689d1-aabb-4738-9576-eb3a56e5c3d4",
    "username": "system:serviceaccount:vm-system:vmm-controller"
  },
  "userAgent": "vmm-controller/v0.0.0 (linux/amd64) kubernetes/$Format",
  "verb": "patch"
}

Supprimer une VM

Champs de l'entrée de journal contenant des informations d'audit
Métadonnées d'audit Nom du champ d'audit Valeur
Identité de l'utilisateur ou du service user

Par exemple,

"user": {
    "groups": [
      "system:masters",
      "system:authenticated"
    ],
    "username": "kubernetes-admin"
    }

Cible

(Champs et valeurs qui appellent l'API)

 objectRef

Par exemple,

"objectRef": {
    "apiGroup": "virtualmachine.gdc.goog",
    "apiVersion": "v1",
    "name": "vm1",
    "namespace": "myusername-test",
    "resource": "virtualmachines"
    }

Action

(Champs contenant l'opération effectuée)

 verb "verb": "delete"
Code temporel de l'événement requestReceivedTimestamp

Par exemple,

"requestReceivedTimestamp": "2023-09-19T20:58:25.165020Z"
Source de l'action _gdch_cluster

Par exemple,

"_gdch_cluster": "org-1-infra"
Résultat responseStatus

Par exemple,

"responseStatus": {
    "code": 200,
    "metadata": {}
    }

Autres champs Non applicable Non applicable

Exemple de journal

{
  "_gdch_cluster": "org-1-infra",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-tzdxt",
  "_gdch_org_id": "org-1.zone1.google.gdch.test",
  "_gdch_org_name": "org-1",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": ""
  },
  "apiVersion": "audit.k8s.io/v1",
  "auditID": "b487c3cf-3eda-4cc9-bb5f-1d9665038ee0",
  "kind": "Event",
  "level": "Metadata",
  "objectRef": {
    "apiGroup": "virtualmachine.gdc.goog",
    "apiVersion": "v1",
    "name": "vm1",
    "namespace": "myusername-test",
    "resource": "virtualmachines"
  },
  "requestReceivedTimestamp": "2023-09-19T20:58:25.165020Z",
  "requestURI": "/apis/virtualmachine.gdc.goog/v1/namespaces/myusername-test/virtualmachines/vm1",
  "responseStatus": {
    "code": 200,
    "metadata": {}
  },
  "sourceIPs": [
    "10.200.0.6"
  ],
  "stage": "ResponseComplete",
  "stageTimestamp": "2023-09-19T20:58:25.181044Z",
  "user": {
    "groups": [
      "system:masters",
      "system:authenticated"
    ],
    "username": "kubernetes-admin"
  },
  "userAgent": "kubectl/v1.23.5 (linux/amd64) kubernetes/c285e78",
  "verb": "delete"
}

Créer un disque de VM

Champs de l'entrée de journal contenant des informations d'audit
Métadonnées d'audit Nom du champ d'audit Valeur
Identité de l'utilisateur ou du service user

Par exemple,

"user": {
    "groups": [
      "system:authenticated"
    ],
    "username": "fop-myusername"
    }

Cible

(Champs et valeurs qui appellent l'API)

 objectRef

Par exemple,

"objectRef": {
    "apiGroup": "virtualmachine.gdc.goog",
    "apiVersion": "v1",
    "name": "vm1-boot-disk",
    "namespace": "myusername-test",
    "resource": "virtualmachinedisks"
    }

Action

(Champs contenant l'opération effectuée)

 verb "verb": "create"
Code temporel de l'événement requestReceivedTimestamp

Par exemple,

"requestReceivedTimestamp": "2023-09-19T21:16:11.056904Z"
Source de l'action _gdch_cluster

Par exemple,

"_gdch_cluster": "org-1-infra"
Résultat responseStatus

Par exemple,

"responseStatus": {
    "code": 201,
    "metadata": {}
    }

Autres champs Non applicable Non applicable

Exemple de journal

{
  "_gdch_cluster": "org-1-infra",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-tzdxt",
  "_gdch_org_id": "org-1.zone1.google.gdch.test",
  "_gdch_org_name": "org-1",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by RoleBinding \"fop-myusername-vm-admin/myusername-test\" of Role \"project-vm-admin\" to User \"fop-myusername\"",
    "mutation.webhook.admission.k8s.io/round_0_index_12": "{\"configuration\":\"gatekeeper-mutating-webhook-configuration\",\"webhook\":\"mutation.gatekeeper.sh\",\"mutated\":false}"
  },
  "apiVersion": "audit.k8s.io/v1",
  "auditID": "b304923c-1df4-4184-bafd-40161210e85e",
  "kind": "Event",
  "level": "Metadata",
  "objectRef": {
    "apiGroup": "virtualmachine.gdc.goog",
    "apiVersion": "v1",
    "name": "vm1-boot-disk",
    "namespace": "myusername-test",
    "resource": "virtualmachinedisks"
  },
  "requestReceivedTimestamp": "2023-09-19T21:16:11.056904Z",
  "requestURI": "/apis/virtualmachine.gdc.goog/v1/namespaces/myusername-test/virtualmachinedisks?fieldManager=kubectl-client-side-apply",
  "responseStatus": {
    "code": 201,
    "metadata": {}
  },
  "sourceIPs": [
    "10.200.0.1",
    "10.200.0.6"
  ],
  "stage": "ResponseComplete",
  "stageTimestamp": "2023-09-19T21:16:11.071123Z",
  "user": {
    "groups": [
      "system:authenticated"
    ],
    "username": "fop-myusername"
  },
  "userAgent": "kubectl/v1.23.5 (linux/amd64) kubernetes/c285e78",
  "verb": "create"
}

Lister les disques de VM

Champs de l'entrée de journal contenant des informations d'audit
Métadonnées d'audit Nom du champ d'audit Valeur
Identité de l'utilisateur ou du service user

Par exemple,

"user": {
    "groups": [
      "system:authenticated"
    ],
    "username": "fop-myusername"
    }

Cible

(Champs et valeurs qui appellent l'API)

 objectRef

Par exemple,

"objectRef": {
    "apiGroup": "virtualmachine.gdc.goog",
    "apiVersion": "v1",
    "namespace": "myusername-test",
    "resource": "virtualmachinedisks"
    }

Action

(Champs contenant l'opération effectuée)

 verb "verb": "list"
Code temporel de l'événement requestReceivedTimestamp

Par exemple,

"requestReceivedTimestamp": "2023-09-19T21:18:43.108931Z"
Source de l'action _gdch_cluster

Par exemple,

"_gdch_cluster": "org-1-infra"
Résultat responseStatus

Par exemple,

"responseStatus": {
    "code": 200,
    "metadata": {}
    }

Autres champs Non applicable Non applicable

Exemple de journal

{
  "_gdch_cluster": "org-1-infra",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-l7p8r",
  "_gdch_org_id": "org-1.zone1.google.gdch.test",
  "_gdch_org_name": "org-1",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by RoleBinding \"fop-myusername-vm-admin/myusername-test\" of Role \"project-vm-admin\" to User \"fop-myusername\""
  },
  "apiVersion": "audit.k8s.io/v1",
  "auditID": "3d71f7fd-11d0-4ed7-9d8c-a9bf9f61b46d",
  "kind": "Event",
  "level": "Metadata",
  "objectRef": {
    "apiGroup": "virtualmachine.gdc.goog",
    "apiVersion": "v1",
    "namespace": "myusername-test",
    "resource": "virtualmachinedisks"
  },
  "requestReceivedTimestamp": "2023-09-19T21:18:43.108931Z",
  "requestURI": "/apis/virtualmachine.gdc.goog/v1/namespaces/myusername-test/virtualmachinedisks?limit=500",
  "responseStatus": {
    "code": 200,
    "metadata": {}
  },
  "sourceIPs": [
    "10.200.0.1",
    "10.200.0.7"
  ],
  "stage": "ResponseComplete",
  "stageTimestamp": "2023-09-19T21:18:43.137015Z",
  "user": {
    "groups": [
      "system:authenticated"
    ],
    "username": "fop-myusername"
  },
  "userAgent": "kubectl/v1.23.5 (linux/amd64) kubernetes/c285e78",
  "verb": "list"
}

Supprimer un disque de VM

Champs de l'entrée de journal contenant des informations d'audit
Métadonnées d'audit Nom du champ d'audit Valeur
Identité de l'utilisateur ou du service user

Par exemple,

"user":{
    "username": "fop-myname-test",
    "groups":[
      "system: authenticated"
      ]
    }

Cible

(Champs et valeurs qui appellent l'API)

 objectRef

Par exemple,

"objectRef":{
    "namespace":"foo",
    "resource":"virtualmachinedisks",
    "apiGroup":"virtualmachine.gdc.goog",
    "name":"vm1-boot-disk",
    "apiVersion":"v1"
    }

Action

(Champs contenant l'opération effectuée)

 verb "verb":"delete"
Code temporel de l'événement requestReceivedTimestamp

Par exemple,

"requestReceivedTimestamp":"2022-11-11T22:02:02.034688Z"
Source de l'action _gdch_cluster

Par exemple,

"_gdch_cluster":"org-1-infra"
Résultat responseStatus

Par exemple,

"responseStatus":{
    "metadata":{},
    "code":200
    }

Autres champs Non applicable Non applicable

Exemple de journal

{
  "_gdch_cluster":"org-1-infra",
  "_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-8z2rm",
  "_gdch_service_name":"apiserver",
  "apiVersion":"audit.k8s.io/v1",
  "auditID":"ba0344d7-283f-4d79-aabc-e083al9b053a",
  "kind":"Event",
  "level":"Metadata",
  "objectRef":{
    "namespace":"foo",
    "resource":"virtualmachinedisks",
    "apiGroup":"virtualmachine.gdc.goog",
    "apiVersion":"v1",
    "name":"vm1-boot-disk"
    },
  "requestReceivedTimestamp":"2022-11-11T22:02:02.034688Z",
  "requestURI":"/apis/virtualmachine.gdc.goog/v1/namespaces/foo/virtualmachinedisks/vm1-boot-disk",
  "responseStatus":{
    "metadata":{},
    "code":200
    },
  "sourceIPs":["10.142.5.147"],
  "stage":"ResponseComplete",
  "stageTimestamp":"2022-11-11T22:02:02.045045Z",
  "tsNs":1668204122074601081,
  "user":{
    "username": "fop-myname-test",
    "groups":[
      "system: authenticated"
      ]
    },
  "userAgent":"kubectl/v1.23.5 (linux/amd64) kubernetes/c285e78",
  "verb":"delete"
}

Lister les types de VM

Champs de l'entrée de journal contenant des informations d'audit
Métadonnées d'audit Nom du champ d'audit Valeur
Identité de l'utilisateur ou du service user

Par exemple,

"user":{
    "username": "fop-myname-test",
    "groups":[
      "system: authenticated"
      ]
    }

Cible

(Champs et valeurs qui appellent l'API)

 objectRef

Par exemple,

"objectRef":{
    "resource":"virtualmachinetypes",
    "apiGroup":"virtualmachine.gdc.goog",
    "apiVersion":"v1"
    }

Action

(Champs contenant l'opération effectuée)

 verb "verb":"list"
Code temporel de l'événement requestReceivedTimestamp

Par exemple,

"requestReceivedTimestamp":"2022-11-11T22:02:02.034688Z"
Source de l'action _gdch_cluster

Par exemple,

"_gdch_cluster":"org-1-infra"
Résultat responseStatus

Par exemple,

"responseStatus":{
    "metadata":{},
    "code":200
    }

Autres champs Non applicable Non applicable

Exemple de journal

{
  "_gdch_cluster":"org-1-infra",
  "_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-8z2rm",
  "_gdch_service_name":"apiserver",
  "annotations":{
    "authorization.k8s.io/decision":"allow",
    "authorization.k8s.io/reason":"RBAC: allowed by RoleBinding 'g-vm-admin-binding/foo' of Role 'g-vm-admin' to User 'fop-myname-test'"
    },
  "apiVersion":"audit.k8s.io/v1",
  "auditID":"ba0344d7-283f-4d79-aabc-e083al9b053a",
  "kind":"Event",
  "level":"Metadata",
  "objectRef":{
    "resource":"virtualmachinetypes",
    "apiGroup":"virtualmachine.gdc.goog",
    "apiVersion":"v1"
    },
  "requestReceivedTimestamp":"2022-11-11T22:02:02.034688Z",
  "requestURI":"/apis/virtualmachine.gdc.goog/v1/virtualmachinetypes?limit=500",
  "responseStatus":{
    "metadata":{},
    "code":200
    },
  "sourceIPs":["10.142.5.147"],
  "stage":"ResponseComplete",
  "stageTimestamp":"2022-11-11T22:02:02.045045Z",
  "tsNs":1668204122074601081,
  "user":{
    "username": "fop-myname-test",
    "groups":[
      "system: authenticated"
      ]
    },
  "userAgent":"kubectl/v1.23.5 (linux/amd64) kubernetes/c285e78",
  "verb":"list"
}

Créer un type de VM

Champs de l'entrée de journal contenant des informations d'audit
Métadonnées d'audit Nom du champ d'audit Valeur
Identité de l'utilisateur ou du service user

Par exemple,

"user":{
    "username": "fop-myname-test",
    "groups":[
      "system: authenticated"
      ]
    }

Cible

(Champs et valeurs qui appellent l'API)

 objectRef

Par exemple,

"objectRef":{
    "resource":"virtualmachinetypes",
    "apiGroup":"virtualmachine.gdc.goog",
    "name":"test-type",
    "apiVersion":"v1"
    }

Action

(Champs contenant l'opération effectuée)

 verb "verb":"create"
Code temporel de l'événement requestReceivedTimestamp

Par exemple,

"requestReceivedTimestamp":"2022-11-11T22:02:02.034688Z"
Source de l'action _gdch_cluster

Par exemple,

"_gdch_cluster":"org-1-infra"
Résultat responseStatus

Par exemple,

"responseStatus":{
    "metadata":{},
    "code":201
    }

Autres champs Non applicable Non applicable

Exemple de journal

{
  "_gdch_cluster":"org-1-infra",
  "_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-8z2rm",
  "_gdch_service_name":"apiserver",
  "annotations":{
    "authorization.k8s.io/decision":"allow",
    "authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding 'g-pa-binding' of ClusterRole 'g-cluster' to User 'fop-myname-test'"
    },
  "apiVersion":"audit.k8s.io/v1",
  "auditID":"ba0344d7-283f-4d79-aabc-e083al9b053a",
  "kind":"Event",
  "level":"Metadata",
  "objectRef":{
    "resource":"virtualmachinetypes",
    "apiGroup":"virtualmachine.gdc.goog",
    "name":"test-type",
    "apiVersion":"v1"
    },
  "requestReceivedTimestamp":"2022-11-11T22:02:02.034688Z",
  "requestURI":"/apis/virtualmachine.gdc.goog/v1/virtualmachinetypes?fieldManager=kubectl-client-side-apply",
  "responseStatus":{
    "metadata":{},
    "code":201
    },
  "sourceIPs":["10.142.5.147"],
  "stage":"ResponseComplete",
  "stageTimestamp":"2022-11-11T22:02:02.045045Z",
  "tsNs":1668204122074601081,
  "user":{
    "username": "fop-myname-test",
    "groups":[
      "system: authenticated"
      ]
    },
  "userAgent":"kubectl/v1.23.5 (linux/amd64) kubernetes/c285e78",
  "verb":"create"
}

Supprimer un type de VM

Champs de l'entrée de journal contenant des informations d'audit
Métadonnées d'audit Nom du champ d'audit Valeur
Identité de l'utilisateur ou du service user

Par exemple,

"user":{
    "username": "fop-myname-test",
    "groups":[
      "system: authenticated"
      ]
    }

Cible

(Champs et valeurs qui appellent l'API)

 objectRef

Par exemple,

"objectRef":{
    "resource":"virtualmachinetypes",
    "apiGroup":"virtualmachine.gdc.goog",
    "name":"test-type",
    "apiVersion":"v1"
    }

Action

(Champs contenant l'opération effectuée)

 verb "verb":"delete"
Code temporel de l'événement requestReceivedTimestamp

Par exemple,

"requestReceivedTimestamp":"2022-11-11T22:02:02.034688Z"
Source de l'action _gdch_cluster

Par exemple,

"_gdch_cluster":"org-1-infra"
Résultat responseStatus

Par exemple,

"responseStatus":{
    "metadata":{},
    "code":200,
    "status":"Success"
    }

Autres champs Non applicable Non applicable

Exemple de journal

{
  "_gdch_cluster":"org-1-infra",
  "_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-8z2rm",
  "_gdch_service_name":"apiserver",
  "annotations":{
    "authorization.k8s.io/decision":"allow",
    "authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding 'g-pa-binding' of ClusterRole 'g-cluster' to User 'fop-myname-test'"
    },
  "apiVersion":"audit.k8s.io/v1",
  "auditID":"ba0344d7-283f-4d79-aabc-e083al9b053a",
  "kind":"Event",
  "level":"Metadata",
  "objectRef":{
    "resource":"virtualmachinetypes",
    "apiGroup":"virtualmachine.gdc.goog",
    "name":"test-type",
    "apiVersion":"v1"
    },
  "requestReceivedTimestamp":"2022-11-11T22:02:02.034688Z",
  "requestURI":"/apis/virtualmachine.gdc.goog/v1/virtualmachinetypes/test-type",
  "responseStatus":{
    "metadata":{},
    "code":200,
    "status":"Success"
    },
  "sourceIPs":["10.142.5.147"],
  "stage":"ResponseComplete",
  "stageTimestamp":"2022-11-11T22:02:02.045045Z",
  "tsNs":1668204122074601081,
  "user":{
    "username": "fop-myname-test",
    "groups":[
      "system: authenticated"
      ]
    },
  "userAgent":"kubectl/v1.23.5 (linux/amd64) kubernetes/c285e78",
  "verb":"delete"
}

Mettre à jour un type de VM

Champs de l'entrée de journal contenant des informations d'audit
Métadonnées d'audit Nom du champ d'audit Valeur
Identité de l'utilisateur ou du service user

Par exemple,

"user":{
    "username": "fop-myname-test",
    "groups":[
      "system: authenticated"
      ]
    }

Cible

(Champs et valeurs qui appellent l'API)

 objectRef

Par exemple,

"objectRef":{
    "resource":"virtualmachinetypes",
    "apiGroup":"virtualmachine.gdc.goog",
    "name":"test-type",
    "apiVersion":"v1"
    }

Action

(Champs contenant l'opération effectuée)

 verb "verb":"patch"
Code temporel de l'événement requestReceivedTimestamp

Par exemple,

"requestReceivedTimestamp":"2022-11-11T22:02:02.034688Z"
Source de l'action _gdch_cluster

Par exemple,

"_gdch_cluster":"org-1-infra"
Résultat responseStatus

Par exemple,

"responseStatus":{
    "metadata":{},
    "code":200
    }

Autres champs Non applicable Non applicable

Exemple de journal

{
  "_gdch_cluster":"org-1-infra",
  "_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-8z2rm",
  "_gdch_service_name":"apiserver",
  "annotations":{
    "authorization.k8s.io/decision":"allow",
    "authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding 'g-pa-binding' of ClusterRole 'g-cluster' to User 'fop-myname-test'"
    },
  "apiVersion":"audit.k8s.io/v1",
  "auditID":"ba0344d7-283f-4d79-aabc-e083al9b053a",
  "kind":"Event",
  "level":"Metadata",
  "objectRef":{
    "resource":"virtualmachinetypes",
    "apiGroup":"virtualmachine.gdc.goog",
    "name":"test-type",
    "apiVersion":"v1"
    },
  "requestReceivedTimestamp":"2022-11-11T22:02:02.034688Z",
  "requestURI":"/apis/virtualmachine.gdc.goog/v1/virtualmachinetypes/test-type?fieldManager=kubectl-client-side-apply",
  "responseStatus":{
    "metadata":{},
    "code":200
    },
  "sourceIPs":["10.142.5.147"],
  "stage":"ResponseComplete",
  "stageTimestamp":"2022-11-11T22:02:02.045045Z",
  "tsNs":1668204122074601081,
  "user":{
    "username": "fop-myname-test",
    "groups":[
      "system: authenticated"
      ]
    },
  "userAgent":"kubectl/v1.23.5 (linux/amd64) kubernetes/c285e78",
  "verb":"patch"
}

Créer une demande d'accès à une VM

Champs de l'entrée de journal contenant des informations d'audit
Métadonnées d'audit Nom du champ d'audit Valeur
Identité de l'utilisateur ou du service user

Par exemple,

"user":{
    "username": "fop-myname-test",
    "groups":[
      "system: authenticated"
      ]
    }

Cible

(Champs et valeurs qui appellent l'API)

 objectRef

Par exemple,

"objectRef":{
    "namespace":"foo",
    "resource":"virtualmachineaccessrequests",
    "apiGroup":"virtualmachine.gdc.goog",
    "apiVersion":"v1"
    }

Action

(Champs contenant l'opération effectuée)

 verb "verb":"create"
Code temporel de l'événement requestReceivedTimestamp

Par exemple,

"requestReceivedTimestamp":"2022-11-11T22:02:02.034688Z"
Source de l'action _gdch_cluster

Par exemple,

"_gdch_cluster":"org-1-infra"
Résultat responseStatus

Par exemple,

"responseStatus":{
    "metadata":{},
    "code":201
    }

Autres champs Non applicable Non applicable

Exemple de journal

{
  "_gdch_cluster":"org-1-infra",
  "_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-8z2rm",
  "_gdch_service_name":"apiserver",
  "annotations":{
    "authorization.k8s.io/decision":"allow",
    "authorization.k8s.io/reason":"RBAC: allowed by RoleBinding 'g-vm-admin-binding/foo' of Role 'g-vm-admin' to User 'fop-myname-test'"
    },
  "apiVersion":"audit.k8s.io/v1",
  "auditID":"ba0344d7-283f-4d79-aabc-e083al9b053a",
  "kind":"Event",
  "level":"Metadata",
  "objectRef":{
    "namespace":"foo",
    "resource":"virtualmachineaccessrequests",
    "apiGroup":"virtualmachine.gdc.goog",
    "apiVersion":"v1"
    },
  "requestReceivedTimestamp":"2022-11-11T22:02:02.034688Z",
  "requestURI":"/apis/virtualmachine.gdc.goog/v1/namespaces/foo/virtualmachineaccessrequests?fieldManager=kubectl-create",
  "responseStatus":{
    "metadata":{},
    "code":201
    },
  "sourceIPs":["10.142.5.147"],
  "stage":"ResponseComplete",
  "stageTimestamp":"2022-11-11T22:02:02.045045Z",
  "tsNs":1668204122074601081,
  "user":{
    "username": "fop-myname-test",
    "groups":[
      "system: authenticated"
      ]
    },
  "userAgent":"kubectl/v1.23.5 (linux/amd64) kubernetes/c285e78",
  "verb":"create"
}

Lister les demandes d'accès aux VM

Champs de l'entrée de journal contenant des informations d'audit
Métadonnées d'audit Nom du champ d'audit Valeur
Identité de l'utilisateur ou du service user

Par exemple,

"user":{
    "username": "fop-myname-test",
    "groups":[
      "system: authenticated"
      ]
    }

Cible

(Champs et valeurs qui appellent l'API)

 objectRef

Par exemple,

"objectRef":{
    "namespace":"foo",
    "resource":"virtualmachineaccessrequests",
    "apiGroup":"virtualmachine.gdc.goog",
    "apiVersion":"v1"
    }

Action

(Champs contenant l'opération effectuée)

 verb "verb":"list"
Code temporel de l'événement requestReceivedTimestamp

Par exemple,

"requestReceivedTimestamp":"2022-11-11T22:02:02.034688Z"
Source de l'action _gdch_cluster

Par exemple,

"_gdch_cluster":"org-1-infra"
Résultat responseStatus

Par exemple,

"responseStatus":{
    "metadata":{},
    "code":200
    }

Autres champs Non applicable Non applicable

Exemple de journal

{
  "_gdch_cluster":"org-1-infra",
  "_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-8z2rm",
  "_gdch_service_name":"apiserver",
  "annotations":{
    "authorization.k8s.io/decision":"allow",
    "authorization.k8s.io/reason":"RBAC: allowed by RoleBinding 'g-vm-admin-binding/foo' of Role 'g-vm-admin' to User 'fop-myname-test'"
    },
  "apiVersion":"audit.k8s.io/v1",
  "auditID":"ba0344d7-283f-4d79-aabc-e083al9b053a",
  "kind":"Event",
  "level":"Metadata",
  "objectRef":{
    "namespace":"foo",
    "resource":"virtualmachineaccessrequests",
    "apiGroup":"virtualmachine.gdc.goog",
    "apiVersion":"v1"
    },
  "requestReceivedTimestamp":"2022-11-11T22:02:02.034688Z",
  "requestURI":"/apis/virtualmachine.gdc.goog/v1/namespaces/foo/virtualmachineaccessrequests?limit=500",
  "responseStatus":{
    "metadata":{},
    "code":200
    },
  "sourceIPs":["10.142.5.147"],
  "stage":"ResponseComplete",
  "stageTimestamp":"2022-11-11T22:02:02.045045Z",
  "tsNs":1668204122074601081,
  "user":{
    "username": "fop-myname-test",
    "groups":[
      "system: authenticated"
      ]
    },
  "userAgent":"kubectl/v1.23.5 (linux/amd64) kubernetes/c285e78",
  "verb":"list"
}

Supprimer une demande d'accès à une VM

Champs de l'entrée de journal contenant des informations d'audit
Métadonnées d'audit Nom du champ d'audit Valeur
Identité de l'utilisateur ou du service user

Par exemple,

"user":{
    "username": "fop-myname-test",
    "groups":[
      "system: authenticated"
      ]
    }

Cible

(Champs et valeurs qui appellent l'API)

 objectRef

Par exemple,

"objectRef":{
    "namespace":"foo",
    "resource":"virtualmachineaccessrequests",
    "apiGroup":"virtualmachine.gdc.goog",
    "name":"vm1-jdc9c",
    "apiVersion":"v1"
    }

Action

(Champs contenant l'opération effectuée)

 verb "verb":"delete"
Code temporel de l'événement requestReceivedTimestamp

Par exemple,

"requestReceivedTimestamp":"2022-11-11T22:02:02.034688Z"
Source de l'action _gdch_cluster

Par exemple,

"_gdch_cluster":"org-1-infra"
Résultat responseStatus

Par exemple,

"responseStatus":{
    "metadata":{},
    "code":200
    }

Autres champs Non applicable Non applicable

Exemple de journal

{
  "_gdch_cluster":"org-1-infra",
  "_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-8z2rm",
  "_gdch_service_name":"apiserver",
  "annotations":{
    "authorization.k8s.io/decision":"allow",
    "authorization.k8s.io/reason":"RBAC: allowed by RoleBinding 'g-vm-admin-binding/foo' of Role 'g-vm-admin' to User 'fop-myname-test'"
    },
  "apiVersion":"audit.k8s.io/v1",
  "auditID":"ba0344d7-283f-4d79-aabc-e083al9b053a",
  "kind":"Event",
  "level":"Metadata",
  "objectRef":{
    "namespace":"foo",
    "resource":"virtualmachineaccessrequests",
    "apiGroup":"virtualmachine.gdc.goog",
    "name":"vm1-jdc9c",
    "apiVersion":"v1"
    },
  "requestReceivedTimestamp":"2022-11-11T22:02:02.034688Z",
  "requestURI":"/apis/virtualmachine.gdc.goog/v1/namespaces/foo/virtualmachineaccessrequests/vm1-jdc9c",
  "responseStatus":{
    "metadata":{},
    "code":200
    },
  "sourceIPs":["10.142.5.147"],
  "stage":"ResponseComplete",
  "stageTimestamp":"2022-11-11T22:02:02.045045Z",
  "tsNs":1668204122074601081,
  "user":{
    "username": "fop-myname-test",
    "groups":[
      "system: authenticated"
      ]
    },
  "userAgent":"kubectl/v1.23.5 (linux/amd64) kubernetes/c285e78",
  "verb":"delete"
}

Lister les images de VM

Champs de l'entrée de journal contenant des informations d'audit
Métadonnées d'audit Nom du champ d'audit Valeur
Identité de l'utilisateur ou du service user

Par exemple,

"user":{
  "username": "system:serviceaccount:gatekeeper-system:gatekeeper-admin",
  "uid":"225d02e7-ee06-42c9-a561-df1945d83224",
  "groups":[
    "system:serviceaccounts",
    "system:serviceaccounts:gatekeeper-system",
    "system: authenticated"
    ]
  }

Cible

(Champs et valeurs qui appellent l'API)

 objectRef

Par exemple,

"objectRef":{
  "resource":"virtualmachineimage",
  "apiGroup":"virtualmachineview.gdc.goog",
  "apiVersion":"v1alpha1"
  }

Action

(Champs contenant l'opération effectuée)

 verb "verb":"list"
Code temporel de l'événement requestReceivedTimestamp

Par exemple,

"requestReceivedTimestamp":"2022-11-11T22:02:02.034688Z"
Source de l'action _gdch_cluster

Par exemple,

"_gdch_cluster":"org-1-infra"
Résultat responseStatus

Par exemple,

"responseStatus":{
    "metadata":{},
    "code":200
    }

Autres champs Non applicable Non applicable

Exemple de journal

{
  "_gdch_cluster":"org-1-infra",
  "_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-8z2rm",
  "_gdch_service_name":"apiserver",
  "annotations":{
    "authorization.k8s.io/decision":"allow",
    "authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding 'gatekeeper-manager-rolebinding' of ClusterRole 'gatekeeper-manager-role' to ServiceAccount 'gatekeeper-admin/gatekeeper-system'"
    },
  "apiVersion":"audit.k8s.io/v1",
  "auditID":"ba0344d7-283f-4d79-aabc-e083al9b053a",
  "kind":"Event",
  "level":"Metadata",
  "objectRef":{
    "resource":"virtualmachineimage",
    "apiGroup":"virtualmachineview.gdc.goog",
    "apiVersion":"v1alpha1"
    },
  "requestReceivedTimestamp":"2022-11-11T22:02:02.034688Z",
  "requestURI":"/apis/virtualmachineview.gdc.goog/v1alpha1/virtualmachineimage?limit=500",
  "responseStatus":{
    "metadata":{},
    "code":200
    },
  "sourceIPs":["10.142.5.147"],
  "stage":"ResponseComplete",
  "stageTimestamp":"2022-11-11T22:02:02.045045Z",
  "tsNs":1668204122074601081,
  "user":{
    "username": "system:serviceaccount:gatekeeper-system:gatekeeper-admin",
    "uid":"225d02e7-ee06-42c9-a561-df1945d83224",
    "groups":[
      "system:serviceaccounts",
      "system:serviceaccounts:gatekeeper-system",
      "system: authenticated"
      ]
    },
  "userAgent":"gatekeeper/v3.7.0 (linux/amd64) 3ba8e93/2021-11-15T20:59:44Z",
  "verb":"list"
}

Créer une importation d'image de VM

Champs de l'entrée de journal contenant des informations d'audit
Métadonnées d'audit Nom du champ d'audit Valeur
Identité de l'utilisateur ou du service user

Par exemple,

"user":{
  "username": "kubernetes-admin",
  "groups":[
    "system:masters",
    "system: authenticated"
    ]
  }

Cible

(Champs et valeurs qui appellent l'API)

 objectRef

Par exemple,

"objectRef":{
  "namespace":"foo",
  "resource":"virtualmachineimageimports",
  "apiGroup":"virtualmachine.gdc.goog",
  "apiVersion":"v1alpha1",
  "name":"import-1"
  }

Action

(Champs contenant l'opération effectuée)

 verb "verb":"create"
Code temporel de l'événement requestReceivedTimestamp

Par exemple,

"requestReceivedTimestamp":"2022-11-11T22:02:02.034688Z"
Source de l'action _gdch_cluster

Par exemple,

"_gdch_cluster":"org-1-infra"
Résultat responseStatus

Par exemple,

"responseStatus":{
    "metadata":{},
    "code":201
    }

Autres champs Non applicable Non applicable

Exemple de journal

{
  "_gdch_cluster":"org-1-infra",
  "_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-8z2rm",
  "_gdch_service_name":"apiserver",
  "annotations":{
    "apiserver.latency.k8s.io/response-write":"1.476μs",
    "authorization.k8s.io/reason":"",
    "apiserver.latency.k8s.io/serialize-response-object":"71.971μs",
    "authorization.k8s.io/decision":"allow",
    "apiserver.latency.k8s.io/total":"7.405669466s",
    "apiserver.latency.k8s.io/validating-webhook":"7.395358418s",
    "apiserver.latency.k8s.io/transform-response-object":"2.358μs"
    },
  "apiVersion":"audit.k8s.io/v1",
  "auditID":"ba0344d7-283f-4d79-aabc-e083al9b053a",
  "kind":"Event",
  "level":"Metadata",
  "objectRef":{
    "namespace":"foo",
    "resource":"virtualmachineimageimports",
    "apiGroup":"virtualmachine.gdc.goog",
    "apiVersion":"v1alpha1",
    "name":"import-1"
    },
  "requestReceivedTimestamp":"2022-11-11T22:02:02.034688Z",
  "requestURI":"/apis/virtualmachine.gdc.goog/v1alpha1/namespaces/foo/virtualmachineimageimports?fieldManager=kubectl-client-side-apply",
  "responseStatus":{
    "metadata":{},
    "code":201
    },
  "sourceIPs":["10.142.5.147"],
  "stage":"ResponseComplete",
  "stageTimestamp":"2022-11-11T22:02:02.045045Z",
  "tsNs":1668204122074601081,
  "user":{
    "username": "kubernetes-admin",
    "groups":[
      "system:masters",
      "system: authenticated"
      ]
    },
  "userAgent":"kubectl/v1.23.5 (linux/amd64) kubernetes/c285e78",
  "verb":"create"
}

Lister les importations d'images de VM

Champs de l'entrée de journal contenant des informations d'audit
Métadonnées d'audit Nom du champ d'audit Valeur
Identité de l'utilisateur ou du service user

Par exemple,

"user":{
  "username": "system:serviceaccount:gatekeeper-system:gatekeeper-admin",
  "groups":[
    "system:serviceaccounts",
    "system:serviceaccounts:gatekeeper-system",
    "system: authenticated"
    ]
  }

Cible

(Champs et valeurs qui appellent l'API)

 objectRef

Par exemple,

"objectRef":{
  "resource":"virtualmachineimageimports",
  "apiGroup":"virtualmachine.gdc.goog",
  "apiVersion":"v1alpha1"
  }

Action

(Champs contenant l'opération effectuée)

 verb "verb":"list"
Code temporel de l'événement requestReceivedTimestamp

Par exemple,

"requestReceivedTimestamp":"2022-11-11T22:02:02.034688Z"
Source de l'action _gdch_cluster

Par exemple,

"_gdch_cluster":"org-1-infra"
Résultat responseStatus

Par exemple,

"responseStatus":{
    "metadata":{},
    "code":201
    }

Autres champs Non applicable Non applicable

Exemple de journal

{
  "_gdch_cluster":"org-1-infra",
  "_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-8z2rm",
  "_gdch_service_name":"apiserver",
  "apiVersion":"audit.k8s.io/v1",
  "auditID":"ba0344d7-283f-4d79-aabc-e083al9b053a",
  "kind":"Event",
  "level":"Metadata",
  "objectRef":{
    "resource":"virtualmachineimageimports",
    "apiGroup":"virtualmachine.gdc.goog",
    "apiVersion":"v1alpha1"
    },
  "requestReceivedTimestamp":"2022-11-11T22:02:02.034688Z",
  "requestURI":"/apis/virtualmachine.gdc.goog/v1alpha1/virtualmachineimageimports?limit=500",
  "responseStatus":{
    "metadata":{},
    "code":201
    },
  "sourceIPs":["10.142.5.147"],
  "stage":"ResponseComplete",
  "stageTimestamp":"2022-11-11T22:02:02.045045Z",
  "tsNs":1668204122074601081,
  "user":{
    "username": "system:serviceaccount:gatekeeper-system:gatekeeper-admin",
    "groups":[
      "system:serviceaccounts",
      "system:serviceaccounts:gatekeeper-system",
      "system: authenticated"
      ]
    },
  "userAgent":"gatekeeper/v3.7.0 (linux/amd64) 3ba8e93/2021-11-15T20:59:44Z",
  "verb":"list"
}

Supprimer une importation d'image de VM

Champs de l'entrée de journal contenant des informations d'audit
Métadonnées d'audit Nom du champ d'audit Valeur
Identité de l'utilisateur ou du service user

Par exemple,

"user":{
  "username": "kubernetes-admin",
  "groups":[
    "system:masters",
    "system: authenticated"
    ]
  }

Cible

(Champs et valeurs qui appellent l'API)

 objectRef

Par exemple,

"objectRef":{
  "namespace":"foo",
  "resource":"virtualmachineimageimports",
  "apiGroup":"virtualmachine.gdc.goog",
  "name":"import-1",
  "apiVersion":"v1alpha1"
  }

Action

(Champs contenant l'opération effectuée)

 verb "verb":"delete"
Code temporel de l'événement requestReceivedTimestamp

Par exemple,

"requestReceivedTimestamp":"2022-11-11T22:02:02.034688Z"
Source de l'action _gdch_cluster

Par exemple,

"_gdch_cluster":"org-1-infra"
Résultat responseStatus

Par exemple,

"responseStatus":{
    "metadata":{},
    "code":200
    }

Autres champs Non applicable Non applicable

Exemple de journal

{
  "_gdch_cluster":"org-1-infra",
  "_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-8z2rm",
  "_gdch_service_name":"apiserver",
  "apiVersion":"audit.k8s.io/v1",
  "auditID":"ba0344d7-283f-4d79-aabc-e083al9b053a",
  "kind":"Event",
  "level":"Metadata",
  "objectRef":{
    "namespace":"foo",
    "resource":"virtualmachineimageimports",
    "apiGroup":"virtualmachine.gdc.goog",
    "name":"import-1",
    "apiVersion":"v1alpha1"
    },
  "requestReceivedTimestamp":"2022-11-11T22:02:02.034688Z",
  "requestURI":"/apis/virtualmachine.gdc.goog/v1alpha1/namespaces/foo/virtualmachineimageimports/import-1",
  "responseStatus":{
    "metadata":{},
    "code":200
    },
  "sourceIPs":["10.142.5.147"],
  "stage":"ResponseComplete",
  "stageTimestamp":"2022-11-11T22:02:02.045045Z",
  "tsNs":1668204122074601081,
  "user":{
    "username": "kubernetes-admin",
    "groups":[
      "system:masters",
      "system: authenticated"
      ]
    },
  "userAgent":"kubectl/v1.23.5 (linux/amd64) kubernetes/c285e78",
  "verb":"delete"
}

Démarrer une VM

Champs de l'entrée de journal contenant des informations d'audit
Métadonnées d'audit Nom du champ d'audit Valeur
Identité de l'utilisateur ou du service user

Par exemple,

"user": {
    "groups": [
      "system:authenticated"
    ],
    "username": "fop-myusername"
    }

Cible

(Champs et valeurs qui appellent l'API)

 requestURI

Son format est le suivant :

"requestURI": "/apis/virtualmachineoperations.gdc.goog/v1/namespaces/namespace/virtualmachines/name/start"

Où namespace et name identifient l'objet cible. Par exemple,

"requestURI": "/apis/virtualmachineoperations.gdc.goog/v1/namespaces/myusername-test/virtualmachines/vm1/start"
Code temporel de l'événement requestReceivedTimestamp

Par exemple,

"requestReceivedTimestamp": "2023-09-19T22:27:26.787243Z"
Source de l'action _gdch_cluster

Par exemple,

"_gdch_cluster": "org-1-infra"
Résultat responseStatus

Par exemple,

"responseStatus": {
    "code": 202,
    "metadata": {}
    }

Autres champs Non applicable Non applicable

Exemple de journal

{
  "_gdch_cluster": "org-1-infra",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-rxgp7",
  "_gdch_org_id": "org-1.zone1.google.gdch.test",
  "_gdch_org_name": "org-1",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by RoleBinding \"fop-myusername-vm-admin/myusername-test\" of Role \"project-vm-admin\" to User \"fop-myusername\""
  },
  "apiVersion": "audit.k8s.io/v1",
  "auditID": "1446c6b9-f728-4f0d-9a70-aa8361749eef",
  "kind": "Event",
  "level": "Metadata",
  "objectRef": {
    "apiGroup": "virtualmachineoperations.gdc.goog",
    "apiVersion": "v1",
    "name": "vm1",
    "namespace": "myusername-test",
    "resource": "virtualmachines",
    "subresource": "start"
  },
  "requestReceivedTimestamp": "2023-09-19T22:27:26.787243Z",
  "requestURI": "/apis/virtualmachineoperations.gdc.goog/v1/namespaces/myusername-test/virtualmachines/vm1/start",
  "responseStatus": {
    "code": 202,
    "metadata": {}
  },
  "sourceIPs": [
    "10.200.0.1",
    "10.200.0.5"
  ],
  "stage": "ResponseComplete",
  "stageTimestamp": "2023-09-19T22:27:26.929619Z",
  "user": {
    "groups": [
      "system:authenticated"
    ],
    "username": "fop-myusername"
  },
  "userAgent": "Go-http-client/2.0",
  "verb": "update"
}

Arrêter une VM

Champs de l'entrée de journal contenant des informations d'audit
Métadonnées d'audit Nom du champ d'audit Valeur
Identité de l'utilisateur ou du service user

Par exemple,

"user": {
    "groups": [
      "system:authenticated"
    ],
    "username": "fop-myusername"
    }

Cible

(Champs et valeurs qui appellent l'API)

 requestURI

Son format est le suivant :

"requestURI": "/apis/virtualmachineoperations.gdc.goog/v1/namespaces/namespace/virtualmachines/name/stop"

Où namespace et name identifient l'objet cible. Par exemple,

"requestURI": "/apis/virtualmachineoperations.gdc.goog/v1/namespaces/myusername-test/virtualmachines/vm1/stop"
Code temporel de l'événement requestReceivedTimestamp

Par exemple,

"requestReceivedTimestamp": "2023-09-19T22:27:26.787243Z"
Source de l'action _gdch_cluster

Par exemple,

"_gdch_cluster": "org-1-infra"
Résultat responseStatus

Par exemple,

"responseStatus": {
    "code": 202,
    "metadata": {}
    }

Autres champs Non applicable Non applicable

Exemple de journal

{
  "_gdch_cluster": "org-1-infra",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-rxgp7",
  "_gdch_org_id": "org-1.zone1.google.gdch.test",
  "_gdch_org_name": "org-1",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by RoleBinding \"fop-myusername-vm-admin/myusername-test\" of Role \"project-vm-admin\" to User \"fop-myusername\""
  },
  "apiVersion": "audit.k8s.io/v1",
  "auditID": "1446c6b9-f728-4f0d-9a70-aa8361749eef",
  "kind": "Event",
  "level": "Metadata",
  "objectRef": {
    "apiGroup": "virtualmachineoperations.gdc.goog",
    "apiVersion": "v1",
    "name": "vm1",
    "namespace": "myusername-test",
    "resource": "virtualmachines",
    "subresource": "stop"
  },
  "requestReceivedTimestamp": "2023-09-19T22:27:26.787243Z",
  "requestURI": "/apis/virtualmachineoperations.gdc.goog/v1/namespaces/myusername-test/virtualmachines/vm1/stop",
  "responseStatus": {
    "code": 202,
    "metadata": {}
  },
  "sourceIPs": [
    "10.200.0.1",
    "10.200.0.5"
  ],
  "stage": "ResponseComplete",
  "stageTimestamp": "2023-09-19T22:27:26.929619Z",
  "user": {
    "groups": [
      "system:authenticated"
    ],
    "username": "fop-myusername"
  },
  "userAgent": "Go-http-client/2.0",
  "verb": "update"
}

Redémarrer une VM

Champs de l'entrée de journal contenant des informations d'audit
Métadonnées d'audit Nom du champ d'audit Valeur
Identité de l'utilisateur ou du service user

Par exemple,

"user": {
    "groups": [
      "system:authenticated"
    ],
    "username": "fop-myusername"
    }

Cible

(Champs et valeurs qui appellent l'API)

 requestURI

Son format est le suivant :

"requestURI": "/apis/virtualmachineoperations.gdc.goog/v1/namespaces/namespace/virtualmachines/name/restart"

Où namespace et name identifient l'objet cible. Par exemple,

"requestURI": "/apis/virtualmachineoperations.gdc.goog/v1/namespaces/myusername-test/virtualmachines/vm1/restart"
Code temporel de l'événement requestReceivedTimestamp

Par exemple,

"requestReceivedTimestamp": "2023-09-19T22:27:26.787243Z"
Source de l'action _gdch_cluster

Par exemple,

"_gdch_cluster": "org-1-infra"
Résultat responseStatus

Par exemple,

"responseStatus": {
    "code": 202,
    "metadata": {}
    }

Autres champs Non applicable Non applicable

Exemple de journal

{
  "_gdch_cluster": "org-1-infra",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-rxgp7",
  "_gdch_org_id": "org-1.zone1.google.gdch.test",
  "_gdch_org_name": "org-1",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by RoleBinding \"fop-myusername-vm-admin/myusername-test\" of Role \"project-vm-admin\" to User \"fop-myusername\""
  },
  "apiVersion": "audit.k8s.io/v1",
  "auditID": "1446c6b9-f728-4f0d-9a70-aa8361749eef",
  "kind": "Event",
  "level": "Metadata",
  "objectRef": {
    "apiGroup": "virtualmachineoperations.gdc.goog",
    "apiVersion": "v1",
    "name": "vm1",
    "namespace": "myusername-test",
    "resource": "virtualmachines",
    "subresource": "restart"
  },
  "requestReceivedTimestamp": "2023-09-19T22:27:26.787243Z",
  "requestURI": "/apis/virtualmachineoperations.gdc.goog/v1/namespaces/myusername-test/virtualmachines/vm1/restart",
  "responseStatus": {
    "code": 202,
    "metadata": {}
  },
  "sourceIPs": [
    "10.200.0.1",
    "10.200.0.5"
  ],
  "stage": "ResponseComplete",
  "stageTimestamp": "2023-09-19T22:27:26.929619Z",
  "user": {
    "groups": [
      "system:authenticated"
    ],
    "username": "fop-myusername"
  },
  "userAgent": "Go-http-client/2.0",
  "verb": "update"
}

Mettre en veille une VM

Champs de l'entrée de journal contenant des informations d'audit
Métadonnées d'audit Nom du champ d'audit Valeur
Identité de l'utilisateur ou du service user

Par exemple,

"user": {
    "groups": [
      "system:authenticated"
    ],
    "username": "fop-myusername"
    }

Cible

(Champs et valeurs qui appellent l'API)

 requestURI

Son format est le suivant :

"requestURI": "/apis/virtualmachineoperations.gdc.goog/v1/namespaces/namespace/virtualmachines/name/pause"

Où namespace et name identifient l'objet cible. Par exemple,

"requestURI": "/apis/virtualmachineoperations.gdc.goog/v1/namespaces/myusername-test/virtualmachines/vm1/pause"
Code temporel de l'événement requestReceivedTimestamp

Par exemple,

"requestReceivedTimestamp": "2023-09-19T22:27:26.787243Z"
Source de l'action _gdch_cluster

Par exemple,

"_gdch_cluster": "org-1-infra"
Résultat responseStatus

Par exemple,

"responseStatus": {
    "code": 202,
    "metadata": {}
    }

Autres champs Non applicable Non applicable

Exemple de journal

{
  "_gdch_cluster": "org-1-infra",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-rxgp7",
  "_gdch_org_id": "org-1.zone1.google.gdch.test",
  "_gdch_org_name": "org-1",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by RoleBinding \"fop-myusername-vm-admin/myusername-test\" of Role \"project-vm-admin\" to User \"fop-myusername\""
  },
  "apiVersion": "audit.k8s.io/v1",
  "auditID": "1446c6b9-f728-4f0d-9a70-aa8361749eef",
  "kind": "Event",
  "level": "Metadata",
  "objectRef": {
    "apiGroup": "virtualmachineoperations.gdc.goog",
    "apiVersion": "v1",
    "name": "vm1",
    "namespace": "myusername-test",
    "resource": "virtualmachines",
    "subresource": "pause"
  },
  "requestReceivedTimestamp": "2023-09-19T22:27:26.787243Z",
  "requestURI": "/apis/virtualmachineoperations.gdc.goog/v1/namespaces/myusername-test/virtualmachines/vm1/pause",
  "responseStatus": {
    "code": 202,
    "metadata": {}
  },
  "sourceIPs": [
    "10.200.0.1",
    "10.200.0.5"
  ],
  "stage": "ResponseComplete",
  "stageTimestamp": "2023-09-19T22:27:26.929619Z",
  "user": {
    "groups": [
      "system:authenticated"
    ],
    "username": "fop-myusername"
  },
  "userAgent": "Go-http-client/2.0",
  "verb": "update"
}

Réactiver une VM

Champs de l'entrée de journal contenant des informations d'audit
Métadonnées d'audit Nom du champ d'audit Valeur
Identité de l'utilisateur ou du service user

Par exemple,

"user": {
    "groups": [
      "system:authenticated"
    ],
    "username": "fop-myusername"
    }

Cible

(Champs et valeurs qui appellent l'API)

 requestURI

Son format est le suivant :

"requestURI": "/apis/virtualmachineoperations.gdc.goog/v1/namespaces/namespace/virtualmachines/name/unpause"

Où namespace et name identifient l'objet cible. Par exemple,

"requestURI": "/apis/virtualmachineoperations.gdc.goog/v1/namespaces/myusername-test/virtualmachines/vm1/unpause"
Code temporel de l'événement requestReceivedTimestamp

Par exemple,

"requestReceivedTimestamp": "2023-09-19T22:27:26.787243Z"
Source de l'action _gdch_cluster

Par exemple,

"_gdch_cluster": "org-1-infra"
Résultat responseStatus

Par exemple,

"responseStatus": {
    "code": 202,
    "metadata": {}
    }

Autres champs Non applicable Non applicable

Exemple de journal

{
  "_gdch_cluster": "org-1-infra",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-rxgp7",
  "_gdch_org_id": "org-1.zone1.google.gdch.test",
  "_gdch_org_name": "org-1",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by RoleBinding \"fop-myusername-vm-admin/myusername-test\" of Role \"project-vm-admin\" to User \"fop-myusername\""
  },
  "apiVersion": "audit.k8s.io/v1",
  "auditID": "1446c6b9-f728-4f0d-9a70-aa8361749eef",
  "kind": "Event",
  "level": "Metadata",
  "objectRef": {
    "apiGroup": "virtualmachineoperations.gdc.goog",
    "apiVersion": "v1",
    "name": "vm1",
    "namespace": "myusername-test",
    "resource": "virtualmachines",
    "subresource": "unpause"
  },
  "requestReceivedTimestamp": "2023-09-19T22:27:26.787243Z",
  "requestURI": "/apis/virtualmachineoperations.gdc.goog/v1/namespaces/myusername-test/virtualmachines/vm1/unpause",
  "responseStatus": {
    "code": 202,
    "metadata": {}
  },
  "sourceIPs": [
    "10.200.0.1",
    "10.200.0.5"
  ],
  "stage": "ResponseComplete",
  "stageTimestamp": "2023-09-19T22:27:26.929619Z",
  "user": {
    "groups": [
      "system:authenticated"
    ],
    "username": "fop-myusername"
  },
  "userAgent": "Go-http-client/2.0",
  "verb": "update"
}

Examiner les actions d'accès d'urgence d'un OI

L'opérateur d'infrastructure (IO) est autorisé à effectuer toutes les opérations auditées du VMM décrites dans ce document. Toutes leurs actions sont automatiquement consignées dans le journal d'audit Kubernetes.

Champs de l'entrée de journal contenant des informations d'audit
Métadonnées d'audit Nom du champ d'audit Valeur
Identité de l'utilisateur ou du service user

Par exemple,

"user": {
  "groups": [
    "system:masters",
    "system:authenticated"
    ],
  "username": "kubernetes-admin"
  }

Cible

(Champs et valeurs qui appellent l'API)

objectRef

Les ressources spécifiques aux VM suivent le modèle suivant pour objectRef.apiGroup :

"virtualmachine.gdc.goog|.*kubevirt.*|.*cdi.*"

Par exemple,

"objectRef": {
  "resource": "vmruntimes",
  "apiGroup": "vm.cluster.gke.io",
  "apiVersion": "v1"
  }

Action

(Champs contenant l'opération effectuée)

 verb "verb":"list"
Code temporel de l'événement requestReceivedTimestamp

Par exemple,

"requestReceivedTimestamp":"2022-11-30T00:47:09.472822Z"
Source de l'action _gdch_cluster

Par exemple,

"_gdch_cluster":"org-1-infra"
Résultat responseStatus

Par exemple,

"responseStatus": {
  "code": 200,
  "metadata": {}
  }

Autres champs Non applicable Non applicable

Exemple de journal

{
  "_gdch_cluster": "org-1-infra",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-ztsnr",
  "responseStatus": {
    "code": 200,
    "metadata": {}
  },
  "kind": "Event",
  "stageTimestamp": "2022-11-30T00:47:09.475563Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": ""
  },
  "sourceIPs": [
    "10.200.1.109"
  ],
  "objectRef": {
    "resource": "vmruntimes",
    "apiGroup": "virtualmachine.private.gdc.goog",
    "apiVersion": "v1"
  },
  "apiVersion": "audit.k8s.io/v1",
  "verb": "list",
  "auditID": "fe338dca-f502-4fde-ba25-98bd29341a83",
  "level": "Metadata",
  "requestURI": "/apis/virtualmachine.private.gdc.goog/v1/vmruntimes",
  "user": {
    "groups": [
      "system:masters",
      "system:authenticated"
    ],
    "username": "kubernetes-admin"
  },
  "stage": "ResponseComplete",
  "requestReceivedTimestamp": "2022-11-30T00:47:09.472822Z",
  "userAgent": "operator/v0.0.0 (linux/amd64) kubernetes/$Format",
  "_gdch_service_name": "apiserver"
}