Les journaux d'audit du système de noms de domaine (DNS) dans Google Distributed Cloud (GDC) avec air gap enregistrent les mises à jour de la zone CoreDNS ainsi que les événements de création ManagedDNSZone et ResourceRecordSet. Ce document liste les opérations auditées, les champs de métadonnées et des exemples de charges utiles JSON provenant des journaux d'audit Kubernetes pour les charges de travail racine et d'organisation.
| Emplacement de la charge de travail |
Charges de travail racine et de l'organisation |
| Source du journal d'audit | |
| Opérations auditées |
Modifier une zone
| Champs de l'entrée de journal contenant des informations d'audit | ||
|---|---|---|
| Métadonnées d'audit | Nom du champ d'audit | Valeur |
| Identité de l'utilisateur ou du service | user.username |
Par exemple, "user":{ "username": "dns@example.com" } |
|
Cible (Champs et valeurs qui appellent l'API) |
requestURI |
|
|
Action (Champs contenant l'opération effectuée) |
verb |
|
| Code temporel de l'événement |
ts
|
Par exemple,
|
| Source de l'action | sourceIPs |
Par exemple,
|
| Résultat | responseStatus.code |
Par exemple, "responseStatus":{ "code":200 } |
| Autres champs |
|
Par exemple, "annotations":{ "authorization.k8s.io/decision":"allow" }, "objectRef":{ "resourceVersion":"697063", "uid":"aed2e6f7-ca03-4bcd-9c07-167ccd4da88e", "apiVersion":"v1", "resource":"configmaps", "apiGroup":"UNKNOWN", "namespace":"dns-system", "name":"gpc-coredns-external-zonefile" } |
Exemple de journal
{
"_gdch_cluster":"root-admin",
"_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-7s769",
"_gdch_service_name":"apiserver",
"annotations":{
"authorization.k8s.io/decision":"allow",
"authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"dns-core-controllers-rolebinding\" of ClusterRole \"dns-core-controllers-role\" to ServiceAccount \"dns-core-controller-sa/dns-system\"",
},
"apiVersion":"audit.k8s.io/v1",
"auditID":"ba0344d7-283f-4d79-aabc-e083al9b053a",
"kind":"Event",
"level":"Metadata",
"objectRef":{
"resourceVersion":"697063",
"uid":"aed2e6f7-ca03-4bcd-9c07-167ccd4da88e",
"apiVersion":"v1",
"resource":"configmaps",
"apiGroup":"UNKNOWN",
"namespace":"dns-system",
"name":"gpc-coredns-external-zonefile"
},
"requestReceivedTimestamp":"2022-11-11T22:02:02.034688Z",
"requestURI":"/api/v1/namespaces/dns-system/configmaps/gpc-coredns-external-zonefile",
"responseStatus":{
"metadata":{},
"code":200
},
"sourceIPs":["10.142.5.147"],
"stage":"ResponseComplete",
"stageTimestamp":"2022-11-11T22:02:02.045045Z",
"ts":2022-11-11T22:02:02.074Z,
"tsNs":1668204122074601081,
"user":{
"uid":"08f727c9-5e3d-403f-bf35-06ef53f9832c",
"groups":[
"system:serviceaccounts",
"system:serviceaccounts:dns-system",
"system:authenticated"
],
"username": "system:serviceaccount:dns-system:dns-core-controller-sa",
"extra": {
"authentication.kubernetes.io/pod-name":["dns-core-controller-58c4646858-z8kmr"],
"authentication.kubernetes.io/pod-uid":["7cfc9b72-aacc-4e86-b43f-016498055230"]
}
},
"userAgent":"controller-manager/v0.0.0 (linux/amd64) kubernetes/$Format",
"verb":"update"
}
Créer une ressource ManagedDNSZone
| Champs de l'entrée de journal contenant des informations d'audit | ||
|---|---|---|
| Métadonnées d'audit | Nom du champ d'audit | Valeur |
| Identité de l'utilisateur ou du service | user.username |
Par exemple, "user":{ "username": "system:bootstrap:xqk4xc" } |
|
Cible (Champs et valeurs qui appellent l'API) |
requestURI |
|
|
Action (Champs contenant l'opération effectuée) |
verb |
|
| Code temporel de l'événement |
requestReceivedTimestamp
|
Par exemple,
|
| Source de l'action | sourceIPs |
Par exemple,
|
| Résultat | responseStatus.code |
Par exemple, "responseStatus":{ "code":201 } |
| Autres champs |
|
Par exemple, "annotations":{ "authorization.k8s.io/decision":"allow", "authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"e2e-test\" of ClusterRole \"cluster-admin\" to Group \"system:bootstrappers:gce-e2e\"", "mutation.webhook.admission.k8s.io/round_0_index_1":"{\"configuration\":\"gatekeeper-mutating-webhook-configuration\",\"webhook\":\"mutation.gatekeeper.sh\",\"mutated\":false}" }, "objectRef":{ "apiGroup":"networking.global.gdc.goog", "apiVersion":"v1", "name":"public-cf-zone-1", "namespace":"cloud-dns-2", "resource":"manageddnszones" } |
Exemple de journal
{
"_gdch_cluster": "org-1-admin",
"_gdch_component": "user_kubectl",
"_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-ttpfw",
"_gdch_org_id": "org-1.zone1.google.gdch.test",
"_gdch_org_name": "org-1",
"_gdch_zone_id": "zone1",
"annotations": {
"authorization.k8s.io/decision": "allow",
"authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"e2e-test\" of ClusterRole \"cluster-admin\" to Group \"system:bootstrappers:gce-e2e\"",
"mutation.webhook.admission.k8s.io/round_0_index_1": "{\"configuration\":\"gatekeeper-mutating-webhook-configuration\",\"webhook\":\"mutation.gatekeeper.sh\",\"mutated\":false}"
},
"apiVersion": "audit.k8s.io/v1",
"auditID": "3de6821e-4e40-4bbc-9c9c-285c59ddaa19",
"kind": "Event",
"level": "Request",
"objectRef": {
"apiGroup": "networking.global.gdc.goog",
"apiVersion": "v1",
"name": "public-cf-zone-1",
"namespace": "cloud-dns-2",
"resource": "manageddnszones"
},
"requestObject": {
"apiVersion": "networking.global.gdc.goog/v1",
"kind": "ManagedDNSZone",
"metadata": {
"creationTimestamp": null,
"name": "public-cf-zone-1",
"namespace": "cloud-dns-2"
},
"spec": {
"description": "Public DNS zone for Cloud Foundry",
"dnsName": "cf1.dns2",
"visibility": "PUBLIC"
}
},
"requestReceivedTimestamp": "2026-05-08T09:51:45.320229Z",
"requestURI": "/apis/networking.global.gdc.goog/v1/namespaces/cloud-dns-2/manageddnszones?fieldManager=kubectl-create&fieldValidation=Strict",
"responseStatus": {
"code": 201,
"metadata": {}
},
"sourceIPs": [
"10.200.0.1",
"10.0.138.150"
],
"stage": "ResponseComplete",
"stageTimestamp": "2026-05-08T09:51:45.528379Z",
"user": {
"groups": [
"system:bootstrappers",
"system:bootstrappers:gce-e2e",
"system:authenticated"
],
"username": "system:bootstrap:xqk4xc"
},
"userAgent": "kubectl/v1.28.3 (linux/amd64) kubernetes/a8a1abc",
"verb": "create"
}
Créer un ResourceRecordSet
| Champs de l'entrée de journal contenant des informations d'audit | ||
|---|---|---|
| Métadonnées d'audit | Nom du champ d'audit | Valeur |
| Identité de l'utilisateur ou du service | user.username |
Par exemple, "user":{ "username": "system:serviceaccount:dns-system:dns-prober-sa" } |
|
Cible (Champs et valeurs qui appellent l'API) |
requestURI |
|
|
Action (Champs contenant l'opération effectuée) |
verb |
|
| Code temporel de l'événement |
requestReceivedTimestamp
|
Par exemple,
|
| Source de l'action | sourceIPs |
Par exemple,
|
| Résultat | responseStatus.code |
Par exemple, "responseStatus":{ "code":201 } |
| Autres champs |
|
Par exemple, "annotations":{ "authorization.k8s.io/decision":"allow", "authorization.k8s.io/reason":"RBAC: allowed by RoleBinding \"dns-prober-global-prober-rolebinding/dns-system\" of Role \"dns-prober-global-prober-role\" to ServiceAccount \"dns-prober-sa/dns-system\"", "mutation.webhook.admission.k8s.io/round_0_index_0":"{\"configuration\":\"dns-managed-dns-v1-mutation\",\"webhook\":\"resourcerecordsets.networking.global.gdc.goog\",\"mutated\":true}", "mutation.webhook.admission.k8s.io/round_0_index_1":"{\"configuration\":\"gatekeeper-mutating-webhook-configuration\",\"webhook\":\"mutation.gatekeeper.sh\",\"mutated\":false}", "patch.webhook.admission.k8s.io/round_0_index_0":"{\"configuration\":\"dns-managed-dns-v1-mutation\",\"webhook\":\"resourcerecordsets.networking.global.gdc.goog\",\"patch\":[{\"op\":\"add\",\"path\":\"/metadata/creationTimestamp\",\"value\":null},{\"op\":\"add\",\"path\":\"/metadata/labels\",\"value\":{\"clouddns.private.gdc.goog/dnszone\":\"test.prober.private\"}},{\"op\":\"add\",\"path\":\"/metadata/annotations\",\"value\":{\"clouddns.private.gdc.goog/token\":\"synpi4vyatjbdwy2-a-pri\"}}],\"patchType\":\"JSONPatch\"}" }, "objectRef":{ "apiGroup":"networking.global.gdc.goog", "apiVersion":"v1", "name":"prober-test-rrs-zone1-private", "namespace":"dns-system", "resource":"resourcerecordsets" } |
Exemple de journal
{
"_gdch_cluster": "org-1-admin",
"_gdch_component": "dns",
"_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-ggwr5",
"_gdch_org_id": "org-1.zone1.google.gdch.test",
"_gdch_org_name": "org-1",
"_gdch_zone_id": "zone1",
"annotations": {
"authorization.k8s.io/decision": "allow",
"authorization.k8s.io/reason": "RBAC: allowed by RoleBinding \"dns-prober-global-prober-rolebinding/dns-system\" of Role \"dns-prober-global-prober-role\" to ServiceAccount \"dns-prober-sa/dns-system\"",
"mutation.webhook.admission.k8s.io/round_0_index_0": "{\"configuration\":\"dns-managed-dns-v1-mutation\",\"webhook\":\"resourcerecordsets.networking.global.gdc.goog\",\"mutated\":true}",
"mutation.webhook.admission.k8s.io/round_0_index_1": "{\"configuration\":\"gatekeeper-mutating-webhook-configuration\",\"webhook\":\"mutation.gatekeeper.sh\",\"mutated\":false}",
"patch.webhook.admission.k8s.io/round_0_index_0": "{\"configuration\":\"dns-managed-dns-v1-mutation\",\"webhook\":\"resourcerecordsets.networking.global.gdc.goog\",\"patch\":[{\"op\":\"add\",\"path\":\"/metadata/creationTimestamp\",\"value\":null},{\"op\":\"add\",\"path\":\"/metadata/labels\",\"value\":{\"clouddns.private.gdc.goog/dnszone\":\"test.prober.private\"}},{\"op\":\"add\",\"path\":\"/metadata/annotations\",\"value\":{\"clouddns.private.gdc.goog/token\":\"synpi4vyatjbdwy2-a-pri\"}}],\"patchType\":\"JSONPatch\"}"
},
"apiVersion": "audit.k8s.io/v1",
"auditID": "12851275-a785-41fa-8e2b-8469bd9d1f65",
"kind": "Event",
"level": "Request",
"objectRef": {
"apiGroup": "networking.global.gdc.goog",
"apiVersion": "v1",
"name": "prober-test-rrs-zone1-private",
"namespace": "dns-system",
"resource": "resourcerecordsets"
},
"requestObject": {
"apiVersion": "networking.global.gdc.goog/v1",
"kind": "ResourceRecordSet",
"metadata": {
"creationTimestamp": null,
"name": "prober-test-rrs-zone1-private",
"namespace": "dns-system"
},
"spec": {
"dnsZone": "prober-test-managed-dns-private",
"name": "prober-test-rrs-zone1-private.test.prober.private",
"rrData": [
"192.168.100.100"
],
"ttlSeconds": 30,
"type": "A"
},
"status": {
"rollout": {
"strategy": {
"type": ""
}
}
}
},
"requestReceivedTimestamp": "2026-05-08T08:48:30.748194Z",
"requestURI": "/apis/networking.global.gdc.goog/v1/namespaces/dns-system/resourcerecordsets",
"responseStatus": {
"code": 201,
"metadata": {}
},
"sourceIPs": [
"10.0.130.26",
"10.0.136.209"
],
"stage": "ResponseComplete",
"stageTimestamp": "2026-05-08T08:48:30.964607Z",
"user": {
"extra": {
"__AIS_token_issuer_zone": [
"zone1"
]
},
"groups": [
"system:authenticated"
],
"username": "system:serviceaccount:dns-system:dns-prober-sa"
},
"userAgent": "prober/v0.0.0 (linux/amd64) kubernetes/$Format",
"verb": "create"
}