Workload server NTP (NTP)

Log audit workload server Protokol Waktu Jaringan (NTP) di Google Distributed Cloud (GDC) dengan air gap memungkinkan Anda melacak perubahan data untuk resource server NTP dalam workload root. Log audit Kubernetes mencatat identitas pemanggil, URI permintaan target, tindakan, stempel waktu, nama layanan, dan kode status respons untuk operasi pembuatan, pembacaan, pembaruan, dan penghapusan (CRUD).

Lokasi workload	Workload khusus root
Sumber log audit	Log audit Kubernetes
Operasi yang diaudit	Perubahan data

Perubahan data (operasi CRUD)

Kolom dalam entri log yang berisi informasi audit
Metadata audit	Nama kolom audit	Nilai
Identitas pengguna atau layanan	username	Misalnya, "user_username": "system:serviceaccount:gpc-system:root-admin-controller-sa"
Target (Kolom dan nilai yang memanggil API)	requestURI	"requestURI":"//apis/system.private.gdc.goog/VERSION/ namespaces/gpc-system/ntpservers/ntp-relay-fhr6t/status"
Tindakan (Kolom yang berisi operasi yang dilakukan)	verb	"verb":"patch"
Stempel waktu peristiwa	requestReceivedTimestamp	Misalnya, "requestReceivedTimestamp":2022-12-13T13:48:30.014578Z
Sumber tindakan	_gdch_service_name	Misalnya, "_gdch_service_name": "apiserver"
Hasil	responseStatus_code	Misalnya, "responseStatus_code":"200"
Kolom lain	Tidak berlaku	Tidak berlaku

Contoh log

{
"_gdch_cluster": "root-admin",
"_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-w5srk",
"_gdch_service_name": "apiserver",
"annotations_authorization_k8s_io_decision":  " allow",
"annotations_authorization_k8s_io_reason RBAC": allowed by ClusterRoleBinding "root-admin-common-controllers-rolebinding" of ClusterRole "root-admin-common-controllers-role" to ServiceAccount "root-admin-controller-sa/gpc-system",
"apiGroup"  :  "system.private.gdc.goog",
"apiVersion":  "audit.k8s.io/v1",
"auditID": 05e72a29-1b18-4db7-9ded-8f51e3a145d8,
"cluster": "root-admin",
"fluentbit_pod":   "anthos-audit-logs-forwarder-w5srk",
"kind": "Event",
  "level": "Metadata",
  "objectRef": {
    "apiGroup": "system.private.gdc.goog",
    "apiVersion": "v1alpha1",
    "name": "ntp-relay-fhr6t",
    "namespace": "gpc-system",
    "resource": "ntpservers",
    "subresource":  "status"
  },
"requestReceivedTimestamp": "2022-12-13T13:48:29.996912Z",
"requestURI": "/apis/system.private.gdc.goog/v1alpha1/namespaces/gpc-system/ntpservers/ntp-relay-fhr6t/status"
"responseStatus": {
    "code": 200,
    "metadata": {},
  },
"service_name": "apiserver",
"stage": "ResponseComplete",
"stageTimestamp": "2022-12-13T13:48:30.014578Z",
"userAgent": "root-admin-cm/v0.0.0 (linux/amd64) kubernetes/$Format",
"user_uid": "c01df74a-a983-44db-8fd3-e0dae87c0796",
"user_username": "system:serviceaccount:gpc-system:root-admin-controller-sa",
"verb": "patch",
"Time" : "1670939310014",
"tsNs": "1670939310014791527"
}