Marketplace (MKT)

Marketplace (MKT) audit logs in Google Distributed Cloud (GDC) air-gapped let you track lifecycle and access control changes for Marketplace services in organization workloads. Kubernetes Resource Model (KRM) API audit logs record the caller identity, target API group, action, timestamp, and response status for service and permission operations.

Workload location

Organization only workloads
Audit log source

KRM API
Audited operations

Creating a Marketplace service

Fields in the log entry that contain audit information
Audit metadata Audit field name Value
User or service identity username

For example,

"username": "system:serviceaccount:gpc-system:mkt-controller"

Target

(Fields and values that call the API)

 apiGroup

For example,

"apiGroup": "marketplace.gdc.goog"

Action

(Fields containing the performed operation)

 verb

For example,

"verb": "create"
Event timestamp requestReceivedTimestamp

For example,

"requestReceivedTimestamp":"2022-12-04T03:07:21.657328Z"
Source of action userAgent

For example,

"userAgent": "fleet-admin-cm/v0.0.0 (linux/amd64) kubernetes/$Format"
Outcome response_code

For example,

"response_code":"200"
Other fields Not applicable Not applicable

Example log

{
  "_gdch_cluster": "org-1-admin",
  "apiVersion": "audit.k8s.io/v1",
  "auditID": "c142325e-8dee-4f36-b392-6d4dfe33947f",
  "kind": "Event",
  "level": "Metadata",
  "objectRef": {
    "name": "dataproc-service",
    "namespace": "gpc-system",
    "resource": "marketplaceservices",
    "apiGroup": "marketplace.gdc.goog",
    "apiVersion": "v1alpha1"
  },
  "requestReceivedTimestamp": "2022-12-04T03:07:21.657328Z",
  "requestURI": "/apis/marketplace.gdc.goog/v1alpha1/namespaces/gpc-system/marketplaceservices"
  "responseStatus": {
    "code": 201,
    "metadata": {},
  }
   "sourceIPs": [
    "10.53.166.199"
  ],
  "stage": "ResponseComplete",
  "stageTimestamp": "2022-12-04T03:07:21.657328Z",
  "user": {
    "extra": {
      "authentication.kubernetes.io/pod-name": [
        "fleet-admin-controller-59cc779bfd-vtx96"
      ],
      "authentication.kubernetes.io/pod-uid": [
        "3f656979-43ea-4012-892c-a595cf94a17b"
      ]
    }
    "username": "system:serviceaccount:gpc-system:mkt-controller",
    "uid": "884009bb-d50c-46a1-a68c-8fa1b91da675"
    "groups": [
      "system:serviceaccounts",
      "system:serviceaccounts:gpc-system",
      "system:authenticated"
    ]
      },
      "userAgent": "fleet-admin-cm/v0.0.0 (linux/amd64) kubernetes/$Format",
      "verb": "create"
}

Updating a Marketplace service

Fields in the log entry that contain audit information
Audit metadata Audit field name Value
User or service identity username

For example,

"username": "kubernetes-admin"

Target

(Fields and values that call the API)

 apiGroup

For example,

"apiGroup": "marketplace.gdc.goog"

Action

(Fields containing the performed operation)

 verb

For example,

"verb": "patch"
Event timestamp requestReceivedTimestamp

For example,

"requestReceivedTimestamp":"2022-12-03T01:09:47.451242Z"
Source of action userAgent

For example,

"userAgent": "kubectl/v1.23.5 (linux/amd64) kubernetes/c285e78"
Outcome response_code

For example,

"response_code":"200"
Other fields Not applicable Not applicable

Example log

{
  "cluster": "org-1-admin",
  "apiVersion": "audit.k8s.io/v1",
  "auditID": "c142325e-8dee-4f36-b392-6d4dfe33947f",
  "kind": "Event",
  "level": "Metadata",
  "objectRef": {
    "name": "dataproc-service",
    "namespace": "gpc-system",
    "resource": "marketplaceservices",
    "apiGroup": "marketplace.gdc.goog",
    "apiVersion": "v1alpha1"
  },
  "requestReceivedTimestamp": "2022-12-04T03:07:21.657328Z",
  "requestURI": "/apis/marketplace.gdc.goog/v1alpha1/namespaces/gpc-system/marketplaceservices/dataproc-service?fieldManager=kubectl-edit"
  "responseStatus": {
    "code": 201,
    "metadata": {},
  }
   "sourceIPs": [
    "10.200.0.6"
  ],
  "stage": "ResponseComplete",
  "stageTimestamp": "2022-12-04T03:07:21.657328Z",
   "user": {
    "groups": [
      "system:masters",
      "system:authenticated"
      ],
      "username": "kubernetes-admin"
      },
      "userAgent": "kubectl/v1.23.5 (linux/amd64) kubernetes/c285e78",
      "verb": "patch"
}

Revoking or granting access to a Marketplace service

Fields in the log entry that contain audit information
Audit metadata Audit field name Value
User or service identity username

For example,

"username": "fop-platform-admin@example.com"

Target

(Fields and values that call the API)

 apiGroup

For example,

"apiGroup": "rbac.authorization.k8s.io"

Action

(Fields containing the performed operation)

 verb

For example,

"verb": "create"
Event timestamp time

For example,

"time":"2022-12-04T02:00:17.475634Z"
Source of action username

For example,

"username": "fop-platform-admin@example.com"
Outcome response_code

For example,

"response_code":"201"
Other fields Not applicable Not applicable

Example log

{
  "cluster": "org-1-admin",
  "apiVersion": "audit.k8s.io/v1",
  "auditID": "c142325e-8dee-4f36-b392-6d4dfe33947f",
  "impersonatedUser": {
  "groups": [
    "system:authenticated"
    "username": "fop-platform-admin@example.com"
    }
  "kind": "Event",
  "level": "Metadata",
  "objectRef": {
    "apiVersion": "v1"
    "name": "user-fop-platform-admin--example--com-marketplace-viewer",
    "resource": "clusterrolebindings",
    "apiGroup": "rbac.authorization.k8s.io",
  },
  "requestReceivedTimestamp": "2022-12-04T03:07:21.657328Z",
  "requestURI": "/apis/rbac.authorization.k8s.io/v1/clusterrolebindings"
  "responseStatus": {
    "code": 201,
    "metadata": {},
  }
   "sourceIPs": [
    "10.253.164.220"
  ],
  "stage": "ResponseComplete",
  "stageTimestamp": "2022-12-04T03:07:21.657328Z",
   "user": {
    "extra": {
      "authentication.kubernetes.io/pod-name": [
        "fleet-admin-gateway-server-c8b7f879c-zwchc"
      ],
      "authentication.kubernetes.io/pod-uid": [
        "f0ec7e0-a604-4b70-a5fc-793e0c158349"
      ]
      }
    "username": "system:serviceaccount:gpc-system:fleet-admin-gateway-server-sa",
    "uid": "72904c96-d59a-4344-8408-5751f42ffdd88"
    "groups": [
      "system:serviceaccounts",
      "system:serviceaccounts:gpc-system",
      "system:authenticated"
      },
      "userAgent": "ui-gateway-server/v0.0.0 (linux/amd64) kubernetes/$Format",
      "verb": "create"
}