Jaringan virtual (VNET)

Log audit jaringan virtual (VNET) di Google Distributed Cloud (GDC) dengan air gap memungkinkan Anda melacak operasi pembuatan, pembacaan, pembaruan, dan penghapusan (CRUD) pada kebijakan jaringan project dan load balancer. Log audit Kubernetes mencatat identitas pemanggil, resource target, tindakan, stempel waktu, alamat IP sumber, dan hasil untuk permintaan jaringan virtual API Model Resource Kubernetes (KRM) di server API pengelolaan.

Lokasi workload	Penyimpanan file dan blok
Sumber log audit	Log audit Kubernetes
Operasi yang diaudit	Operasi CRUD pada kebijakan jaringan project Operasi CRUD pada load balancer

Operasi CRUD pada kebijakan jaringan project

Jenis log: Log audit bidang pengelolaan API KRM.

Kolom dalam entri log yang berisi informasi audit
Metadata audit	Nama kolom audit	Nilai
Identitas pengguna atau layanan	user	Misalnya, "user": { "uid": "6e805ff0-3f8c-4073-b4e1-6a0582ff1263", "username": "system:serviceaccount:gpc-system:fleet-admin-controller", "extra": { "authentication.kubernetes.io/pod-uid": [ "45ce2b16-3584-448e-8caf-49cb299dfb55" ], "authentication.kubernetes.io/pod-name": [ "fleet-admin-controller-5b5d848876-764mt" ] }, "groups": [ "system:serviceaccounts", "system:serviceaccounts:gpc-system", "system:authenticated" ] }
Target (Kolom dan nilai yang memanggil API)	requestURI	"requestURI": "/apis/networking.gdc.goog/v1alpha1/namespaces/platform-obs/projectnetworkpolicies"
Tindakan (Kolom yang berisi operasi yang dilakukan)	verb	Misalnya, "verb": "patch"
Stempel waktu peristiwa	requestReceivedTimestamp	Misalnya, "requestReceivedTimestamp": "2022-12-09T04:21:55.497089Z"
Sumber tindakan	sourceIPs	Misalnya, "sourceIPs": [ "10.253.164.215" ]
Hasil	stage	Misalnya, "stage": "ResponseComplete"
Kolom lain	Tidak berlaku	Tidak berlaku

Contoh log

{
  "auditID": "ff8266f6-685f-4239-9ab8-c55083d575e0",
  "responseStatus": {
    "code": 200,
    "metadata": {}
  },
  "level": "Metadata",
  "requestURI": "/apis/networking.gdc.goog/v1alpha1/namespaces/platform-obs/projectnetworkpolicies/base-policy-allow-intra-project-traffic/status",
  "user": {
    "uid": "6e805ff0-3f8c-4073-b4e1-6a0582ff1263",
    "username": "system:serviceaccount:gpc-system:fleet-admin-controller",
    "extra": {
      "authentication.kubernetes.io/pod-uid": [
        "45ce2b16-3584-448e-8caf-49cb299dfb55"
      ],
      "authentication.kubernetes.io/pod-name": [
        "fleet-admin-controller-5b5d848876-764mt"
      ]
    },
    "groups": [
      "system:serviceaccounts",
      "system:serviceaccounts:gpc-system",
      "system:authenticated"
    ]
  },
  "_gdch_cluster": "org-1-admin",
  "objectRef": {
    "resource": "projectnetworkpolicies",
    "apiGroup": "networking.gdc.goog",
    "name": "base-policy-allow-intra-project-traffic",
    "apiVersion": "v1alpha1",
    "namespace": "platform-obs",
    "subresource": "status"
  },
  "verb": "patch",
  "kind": "Event",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-4267r",
  "stage": "ResponseComplete",
  "apiVersion": "audit.k8s.io/v1",
  "requestReceivedTimestamp": "2022-12-09T04:21:55.497089Z",
  "sourceIPs": [
    "10.253.164.215"
  ],
  "userAgent": "fleet-admin-cm/v0.0.0 (linux/amd64) kubernetes/$Format",
  "stageTimestamp": "2022-12-09T04:21:55.505045Z",
  "annotations": {
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"fleet-admin-controller\" of ClusterRole \"fleet-admin-controller\" to ServiceAccount \"fleet-admin-controller/gpc-system\"",
    "authorization.k8s.io/decision": "allow"
  },
  "_gdch_service_name": "apiserver"
}

Operasi CRUD pada load balancer

Jenis log: Log audit bidang pengelolaan KRM API.

Kolom dalam entri log yang berisi informasi audit
Metadata audit	Nama kolom audit	Nilai
Identitas pengguna atau layanan	user	Misalnya, "user": { "groups": [ "system:masters", "system:authenticated" ], "username": "kubernetes-admin" }
Target (Kolom dan nilai yang memanggil API)	objectRef.resource	"objectRef": { "resource": "services" }
Tindakan (Kolom yang berisi operasi yang dilakukan)	verb	Misalnya, "verb": "get"
Stempel waktu peristiwa	requestReceivedTimestamp	Misalnya, "requestReceivedTimestamp": "2022-12-09T04:29:53.577417Z"
Sumber tindakan	sourceIPs	Misalnya, "sourceIPs": [ "10.200.0.5" ]
Hasil	stage	Misalnya, "stage": "ResponseComplete"
Kolom lain	Tidak berlaku	Tidak berlaku

Contoh log

{
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "_gdch_cluster": "org-1-admin",
  "auditID": "113e562b-0576-4b97-bc5f-168a60428f6d",
  "user": {
    "groups": [
      "system:masters",
      "system:authenticated"
    ],
    "username": "kubernetes-admin"
  },
  "stageTimestamp": "2022-12-09T04:29:53.579903Z",
  "sourceIPs": [
    "10.200.0.5"
  ],
  "responseStatus": {
    "code": 200,
    "metadata": {}
  },
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": ""
  },
  "stage": "ResponseComplete",
  "requestURI": "/api/v1/namespaces/harbor-system/services/harbor-harbor-harbor-core",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-8kc9n",
  "verb": "get",
  "objectRef": {
    "apiVersion": "v1",
    "apiGroup": "UNKNOWN",
    "resource": "services",
    "namespace": "harbor-system",
    "name": "harbor-harbor-harbor-core"
  },
  "userAgent": "root-admin-cm/v0.0.0 (linux/amd64) kubernetes/$Format",
  "kind": "Event",
  "requestReceivedTimestamp": "2022-12-09T04:29:53.577417Z",
  "_gdch_service_name": "apiserver"
}