| Lokasi workload |
Penyimpanan file dan blok |
| Sumber log audit |
|
| Operasi yang diaudit |
|
Operasi CRUD pada kebijakan jaringan project
Jenis log: Log audit bidang pengelolaan KRM API.
| Kolom dalam entri log yang berisi informasi audit | ||
|---|---|---|
| Metadata audit | Nama kolom audit | Nilai |
| Identitas pengguna atau layanan | user |
Misalnya, "user": { "uid": "6e805ff0-3f8c-4073-b4e1-6a0582ff1263", "username": "system:serviceaccount:gpc-system:fleet-admin-controller", "extra": { "authentication.kubernetes.io/pod-uid": [ "45ce2b16-3584-448e-8caf-49cb299dfb55" ], "authentication.kubernetes.io/pod-name": [ "fleet-admin-controller-5b5d848876-764mt" ] }, "groups": [ "system:serviceaccounts", "system:serviceaccounts:gpc-system", "system:authenticated" ] } |
|
Target (Kolom dan nilai yang memanggil API) |
requestURI |
|
|
Tindakan (Kolom yang berisi operasi yang dilakukan) |
verb |
Misalnya,
|
| Stempel waktu peristiwa | requestReceivedTimestamp |
Misalnya,
|
| Sumber tindakan | sourceIPs |
Misalnya, "sourceIPs": [ "10.253.164.215" ] |
| Hasil | stage |
Misalnya,
|
| Kolom lainnya | Tidak berlaku | Tidak berlaku |
Contoh log
{
"auditID": "ff8266f6-685f-4239-9ab8-c55083d575e0",
"responseStatus": {
"code": 200,
"metadata": {}
},
"level": "Metadata",
"requestURI": "/apis/networking.gdc.goog/v1alpha1/namespaces/platform-obs/projectnetworkpolicies/base-policy-allow-intra-project-traffic/status",
"user": {
"uid": "6e805ff0-3f8c-4073-b4e1-6a0582ff1263",
"username": "system:serviceaccount:gpc-system:fleet-admin-controller",
"extra": {
"authentication.kubernetes.io/pod-uid": [
"45ce2b16-3584-448e-8caf-49cb299dfb55"
],
"authentication.kubernetes.io/pod-name": [
"fleet-admin-controller-5b5d848876-764mt"
]
},
"groups": [
"system:serviceaccounts",
"system:serviceaccounts:gpc-system",
"system:authenticated"
]
},
"_gdch_cluster": "org-1-admin",
"objectRef": {
"resource": "projectnetworkpolicies",
"apiGroup": "networking.gdc.goog",
"name": "base-policy-allow-intra-project-traffic",
"apiVersion": "v1alpha1",
"namespace": "platform-obs",
"subresource": "status"
},
"verb": "patch",
"kind": "Event",
"_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-4267r",
"stage": "ResponseComplete",
"apiVersion": "audit.k8s.io/v1",
"requestReceivedTimestamp": "2022-12-09T04:21:55.497089Z",
"sourceIPs": [
"10.253.164.215"
],
"userAgent": "fleet-admin-cm/v0.0.0 (linux/amd64) kubernetes/$Format",
"stageTimestamp": "2022-12-09T04:21:55.505045Z",
"annotations": {
"authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"fleet-admin-controller\" of ClusterRole \"fleet-admin-controller\" to ServiceAccount \"fleet-admin-controller/gpc-system\"",
"authorization.k8s.io/decision": "allow"
},
"_gdch_service_name": "apiserver"
}
Operasi CRUD pada load balancer
Jenis log: Log audit bidang pengelolaan KRM API.
| Kolom dalam entri log yang berisi informasi audit | ||
|---|---|---|
| Metadata audit | Nama kolom audit | Nilai |
| Identitas pengguna atau layanan | user |
Misalnya, "user": { "groups": [ "system:masters", "system:authenticated" ], "username": "kubernetes-admin" } |
|
Target (Kolom dan nilai yang memanggil API) |
objectRef.resource |
"objectRef": { "resource": "services" } |
|
Tindakan (Kolom yang berisi operasi yang dilakukan) |
verb |
Misalnya,
|
| Stempel waktu peristiwa | requestReceivedTimestamp |
Misalnya,
|
| Sumber tindakan | sourceIPs |
Misalnya, "sourceIPs": [ "10.200.0.5" ] |
| Hasil | stage |
Misalnya,
|
| Kolom lainnya | Tidak berlaku | Tidak berlaku |
Contoh log
{
"apiVersion": "audit.k8s.io/v1",
"level": "Metadata",
"_gdch_cluster": "org-1-admin",
"auditID": "113e562b-0576-4b97-bc5f-168a60428f6d",
"user": {
"groups": [
"system:masters",
"system:authenticated"
],
"username": "kubernetes-admin"
},
"stageTimestamp": "2022-12-09T04:29:53.579903Z",
"sourceIPs": [
"10.200.0.5"
],
"responseStatus": {
"code": 200,
"metadata": {}
},
"annotations": {
"authorization.k8s.io/decision": "allow",
"authorization.k8s.io/reason": ""
},
"stage": "ResponseComplete",
"requestURI": "/api/v1/namespaces/harbor-system/services/harbor-harbor-harbor-core",
"_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-8kc9n",
"verb": "get",
"objectRef": {
"apiVersion": "v1",
"apiGroup": "UNKNOWN",
"resource": "services",
"namespace": "harbor-system",
"name": "harbor-harbor-harbor-core"
},
"userAgent": "root-admin-cm/v0.0.0 (linux/amd64) kubernetes/$Format",
"kind": "Event",
"requestReceivedTimestamp": "2022-12-09T04:29:53.577417Z",
"_gdch_service_name": "apiserver"
}
Log alur node untuk cluster infrastruktur organisasi dan server Management API
Jenis log: Data plane.
| Kolom dalam entri log yang berisi informasi audit | ||
|---|---|---|
| Metadata audit | Nama kolom audit | Nilai |
| Identitas pengguna atau layanan | src |
Misalnya, "src": { "pod_name": "konnectivity-agent-58fdb55d57-5h2gj", "workload_kind": "Deployment", "workload_name": "konnectivity-agent", "pod_namespace": "kube-system", "namespace": "kube-system" } |
|
Target (Kolom dan nilai yang memanggil API) |
dest |
Misalnya, "dest": { "node_name": "xwxwxwx-default-pool-16baec8f-zkjw", "workload_kind": "Node" } |
|
Tindakan (Kolom yang berisi operasi yang dilakukan) |
Tidak berlaku | Tidak berlaku |
| Stempel waktu peristiwa | timestamp |
Misalnya,
|
| Sumber tindakan | src |
Misalnya, "src": { "pod_name": "konnectivity-agent-58fdb55d57-5h2gj", "workload_kind": "Deployment", "workload_name": "konnectivity-agent", "pod_namespace": "kube-system", "namespace": "kube-system" } |
| Hasil | disposition |
Misalnya,
|
| Kolom lainnya | Tidak berlaku | Tidak berlaku |
Contoh log
{
"connection": {
"src_ip": "10.4.0.7",
"dest_ip": "10.128.0.16",
"src_port": 52932,
"dest_port": 10250,
"protocol": "tcp",
"direction": "ingress"
},
"disposition": "allow",
"src": {
"pod_name": "konnectivity-agent-58fdb55d57-5h2gj",
"workload_kind": "Deployment",
"workload_name": "konnectivity-agent",
"pod_namespace": "kube-system",
"namespace": "kube-system"
},
"dest": {
"node_name": "xwxwxwx-default-pool-16baec8f-zkjw",
"workload_kind": "Node"
},
"count": 1,
"node_name": "xwxwxwx-default-pool-16baec8f-zkjw",
"timestamp": "2022-11-21T20:34:32.027881823Z"
}
Log alur kerja untuk cluster infrastruktur organisasi dan server Management API
Jenis log: Data plane.
| Kolom dalam entri log yang berisi informasi audit | ||
|---|---|---|
| Metadata audit | Nama kolom audit | Nilai |
| Identitas pengguna atau layanan | src |
Misalnya, "src": { "instance": "10.4.0.1" } |
|
Target (Kolom dan nilai yang memanggil API) |
dest |
Misalnya, "dest": { "pod_name": "kube-dns-6d5d89dccb-5fjzs", "workload_kind": "Deployment", "workload_name": "kube-dns", "pod_namespace": "kube_system", "namespace": "kube-system" } |
|
Tindakan (Kolom yang berisi operasi yang dilakukan) |
Tidak berlaku | Tidak berlaku |
| Stempel waktu peristiwa | timestamp |
Misalnya,
|
| Sumber tindakan | src |
Misalnya, "src": { "instance": "10.4.0.1" } |
| Hasil | disposition |
Misalnya,
|
| Kolom lainnya | Tidak berlaku | Tidak berlaku |
Contoh log
{
"connection": {
"src_ip": "10.4.0.1",
"dest_ip": "10.4.0.9",
"src_port": 46768,
"dest_port": 10054,
"protocol": "tcp",
"direction": "ingress"
},
"disposition": "allow",
"policies": [
{
"kind": "CiliumClusterwideNetworkPolicy",
"name": "allow-all"
}
],
"src": {
"instance": "10.4.0.1"
},
"dest": {
"pod_name": "kube-dns-6d5d89dccb-5fjzs",
"workload_kind": "Deployment",
"workload_name": "kube-dns",
"pod_namespace": "kube_system",
"namespace": "kube-system"
},
"count": 1,
"node_name": "xwxwxwx-default-pool-16baec8f-zkjw",
"timestamp": "2022-11-21T20:34:32.027881823Z"
}