Upper Networking (UNET)

Log audit Upper Networking (UNET) di peralatan Google Distributed Cloud (GDC) dengan air gap memungkinkan Anda melacak operasi buat, baca, update, dan hapus (CRUD) pada kebijakan jaringan project dan load balancer, serta alur traffic node dan workload. Log audit Kubernetes dan perangkat jaringan lanjutan mencatat identitas pemanggil atau sumber, resource target atau tujuan, tindakan, stempel waktu, dan disposisi di seluruh cluster infrastruktur organisasi dan server API pengelolaan.

Lokasi workload	Penyimpanan file dan blok
Sumber log audit	Operasi CRUD pada resource Kubernetes: Log audit Kubernetes Log alur node dan workload: Perangkat jaringan lanjutan
Operasi yang diaudit	Operasi CRUD pada kebijakan jaringan project Operasi CRUD pada load balancer Log alur node untuk cluster infrastruktur organisasi Log alur workload untuk cluster infrastruktur Org

Operasi CRUD pada kebijakan jaringan project

Jenis log: Log audit bidang pengelolaan KRM API.

Kolom dalam entri log yang berisi informasi audit
Metadata audit	Nama kolom audit	Nilai
Identitas pengguna atau layanan	user	Misalnya, "user": { "uid": "6e805ff0-3f8c-4073-b4e1-6a0582ff1263", "username": "system:serviceaccount:gpc-system:fleet-admin-controller", "extra": { "authentication.kubernetes.io/pod-uid": [ "45ce2b16-3584-448e-8caf-49cb299dfb55" ], "authentication.kubernetes.io/pod-name": [ "fleet-admin-controller-5b5d848876-764mt" ] }, "groups": [ "system:serviceaccounts", "system:serviceaccounts:gpc-system", "system:authenticated" ] }
Target (Kolom dan nilai yang memanggil API)	requestURI	"requestURI": "/apis/networking.gdc.goog/v1alpha1/namespaces/platform-obs/projectnetworkpolicies"
Tindakan (Kolom yang berisi operasi yang dilakukan)	verb	Misalnya, "verb": "patch"
Stempel waktu peristiwa	requestReceivedTimestamp	Misalnya, "requestReceivedTimestamp": "2022-12-09T04:21:55.497089Z"
Sumber tindakan	sourceIPs	Misalnya, "sourceIPs": [ "10.253.164.215" ]
Hasil	stage	Misalnya, "stage": "ResponseComplete"
Kolom lain	Tidak berlaku	Tidak berlaku

Contoh log

{
  "auditID": "ff8266f6-685f-4239-9ab8-c55083d575e0",
  "responseStatus": {
    "code": 200,
    "metadata": {}
  },
  "level": "Metadata",
  "requestURI": "/apis/networking.gdc.goog/v1alpha1/namespaces/platform-obs/projectnetworkpolicies/base-policy-allow-intra-project-traffic/status",
  "user": {
    "uid": "6e805ff0-3f8c-4073-b4e1-6a0582ff1263",
    "username": "system:serviceaccount:gpc-system:fleet-admin-controller",
    "extra": {
      "authentication.kubernetes.io/pod-uid": [
        "45ce2b16-3584-448e-8caf-49cb299dfb55"
      ],
      "authentication.kubernetes.io/pod-name": [
        "fleet-admin-controller-5b5d848876-764mt"
      ]
    },
    "groups": [
      "system:serviceaccounts",
      "system:serviceaccounts:gpc-system",
      "system:authenticated"
    ]
  },
  "_gdch_cluster": "org-1-admin",
  "objectRef": {
    "resource": "projectnetworkpolicies",
    "apiGroup": "networking.gdc.goog",
    "name": "base-policy-allow-intra-project-traffic",
    "apiVersion": "v1alpha1",
    "namespace": "platform-obs",
    "subresource": "status"
  },
  "verb": "patch",
  "kind": "Event",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-4267r",
  "stage": "ResponseComplete",
  "apiVersion": "audit.k8s.io/v1",
  "requestReceivedTimestamp": "2022-12-09T04:21:55.497089Z",
  "sourceIPs": [
    "10.253.164.215"
  ],
  "userAgent": "fleet-admin-cm/v0.0.0 (linux/amd64) kubernetes/$Format",
  "stageTimestamp": "2022-12-09T04:21:55.505045Z",
  "annotations": {
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"fleet-admin-controller\" of ClusterRole \"fleet-admin-controller\" to ServiceAccount \"fleet-admin-controller/gpc-system\"",
    "authorization.k8s.io/decision": "allow"
  },
  "_gdch_service_name": "apiserver"
}

Operasi CRUD pada load balancer

Jenis log: Log audit bidang pengelolaan KRM API.

Kolom dalam entri log yang berisi informasi audit
Metadata audit	Nama kolom audit	Nilai
Identitas pengguna atau layanan	user	Misalnya, "user": { "groups": [ "system:masters", "system:authenticated" ], "username": "kubernetes-admin" }
Target (Kolom dan nilai yang memanggil API)	objectRef.resource	"objectRef": { "resource": "services" }
Tindakan (Kolom yang berisi operasi yang dilakukan)	verb	Misalnya, "verb": "get"
Stempel waktu peristiwa	requestReceivedTimestamp	Misalnya, "requestReceivedTimestamp": "2022-12-09T04:29:53.577417Z"
Sumber tindakan	sourceIPs	Misalnya, "sourceIPs": [ "10.200.0.5" ]
Hasil	stage	Misalnya, "stage": "ResponseComplete"
Kolom lain	Tidak berlaku	Tidak berlaku

Contoh log

{
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "_gdch_cluster": "org-1-admin",
  "auditID": "113e562b-0576-4b97-bc5f-168a60428f6d",
  "user": {
    "groups": [
      "system:masters",
      "system:authenticated"
    ],
    "username": "kubernetes-admin"
  },
  "stageTimestamp": "2022-12-09T04:29:53.579903Z",
  "sourceIPs": [
    "10.200.0.5"
  ],
  "responseStatus": {
    "code": 200,
    "metadata": {}
  },
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": ""
  },
  "stage": "ResponseComplete",
  "requestURI": "/api/v1/namespaces/harbor-system/services/harbor-harbor-harbor-core",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-8kc9n",
  "verb": "get",
  "objectRef": {
    "apiVersion": "v1",
    "apiGroup": "UNKNOWN",
    "resource": "services",
    "namespace": "harbor-system",
    "name": "harbor-harbor-harbor-core"
  },
  "userAgent": "root-admin-cm/v0.0.0 (linux/amd64) kubernetes/$Format",
  "kind": "Event",
  "requestReceivedTimestamp": "2022-12-09T04:29:53.577417Z",
  "_gdch_service_name": "apiserver"
}

Log alur node untuk cluster infrastruktur organisasi dan server Management API

Jenis log: Bidang data.

Kolom dalam entri log yang berisi informasi audit
Metadata audit	Nama kolom audit	Nilai
Identitas pengguna atau layanan	src	Misalnya, "src": { "pod_name": "konnectivity-agent-58fdb55d57-5h2gj", "workload_kind": "Deployment", "workload_name": "konnectivity-agent", "pod_namespace": "kube-system", "namespace": "kube-system" }
Target (Kolom dan nilai yang memanggil API)	dest	Misalnya, "dest": { "node_name": "xwxwxwx-default-pool-16baec8f-zkjw", "workload_kind": "Node" }
Tindakan (Kolom yang berisi operasi yang dilakukan)	Tidak berlaku	Tidak berlaku
Stempel waktu peristiwa	timestamp	Misalnya, "timestamp": "2022-11-21T20:34:32.027881823Z"
Sumber tindakan	src	Misalnya, "src": { "pod_name": "konnectivity-agent-58fdb55d57-5h2gj", "workload_kind": "Deployment", "workload_name": "konnectivity-agent", "pod_namespace": "kube-system", "namespace": "kube-system" }
Hasil	disposition	Misalnya, "disposition": "allow"
Kolom lain	Tidak berlaku	Tidak berlaku

Contoh log

{
  "connection": {
    "src_ip": "10.4.0.7",
    "dest_ip": "10.128.0.16",
    "src_port": 52932,
    "dest_port": 10250,
    "protocol": "tcp",
    "direction": "ingress"
  },
  "disposition": "allow",
  "src": {
    "pod_name": "konnectivity-agent-58fdb55d57-5h2gj",
    "workload_kind": "Deployment",
    "workload_name": "konnectivity-agent",
    "pod_namespace": "kube-system",
    "namespace": "kube-system"
  },
  "dest": {
    "node_name": "xwxwxwx-default-pool-16baec8f-zkjw",
    "workload_kind": "Node"
  },
  "count": 1,
  "node_name": "xwxwxwx-default-pool-16baec8f-zkjw",
  "timestamp": "2022-11-21T20:34:32.027881823Z"
}

Log alur workload untuk cluster infrastruktur organisasi dan server Management API

Jenis log: Bidang data.

Kolom dalam entri log yang berisi informasi audit
Metadata audit	Nama kolom audit	Nilai
Identitas pengguna atau layanan	src	Misalnya, "src": { "instance": "10.4.0.1" }
Target (Kolom dan nilai yang memanggil API)	dest	Misalnya, "dest": { "pod_name": "kube-dns-6d5d89dccb-5fjzs", "workload_kind": "Deployment", "workload_name": "kube-dns", "pod_namespace": "kube_system", "namespace": "kube-system" }
Tindakan (Kolom yang berisi operasi yang dilakukan)	Tidak berlaku	Tidak berlaku
Stempel waktu peristiwa	timestamp	Misalnya, "timestamp": "2022-11-21T20:34:32.027881823Z"
Sumber tindakan	src	Misalnya, "src": { "instance": "10.4.0.1" }
Hasil	disposition	Misalnya, "disposition": "allow"
Kolom lain	Tidak berlaku	Tidak berlaku

Contoh log

{
  "connection": {
    "src_ip": "10.4.0.1",
    "dest_ip": "10.4.0.9",
    "src_port": 46768,
    "dest_port": 10054,
    "protocol": "tcp",
    "direction": "ingress"
  },
  "disposition": "allow",
  "policies": [
    {
      "kind": "CiliumClusterwideNetworkPolicy",
      "name": "allow-all"
    }
  ],
  "src": {
    "instance": "10.4.0.1"
  },
  "dest": {
    "pod_name": "kube-dns-6d5d89dccb-5fjzs",
    "workload_kind": "Deployment",
    "workload_name": "kube-dns",
    "pod_namespace": "kube_system",
    "namespace": "kube-system"
  },
  "count": 1,
  "node_name": "xwxwxwx-default-pool-16baec8f-zkjw",
  "timestamp": "2022-11-21T20:34:32.027881823Z"
}