Resource Manager (RM)

Les journaux d'audit du gestionnaire de ressources (RM) dans l'appareil avec isolation physique Google Distributed Cloud (GDC) vous permettent de suivre les actions d'administration sur les ressources de projet et de contrôle des accès basé sur les rôles (RBAC) dans les charges de travail racine et d'organisation. Les journaux d'audit Kubernetes enregistrent l'identité de l'utilisateur ou du service, l'URI de la requête cible et les champs de charge utile JSON pour les opérations d'API du modèle de ressource Kubernetes (KRM) sur le serveur d'API de gestion.

Emplacement de la charge de travail

Charges de travail racine et de l'organisation
Source du journal d'audit

Journaux d'audit Kubernetes
Opérations auditées

Journaux d'audit du plan de gestion de l'API KRM (projet)

Champs de l'entrée de journal contenant des informations d'audit
Métadonnées d'audit Nom du champ d'audit Valeur
Identité de l'utilisateur ou du service username

Par exemple,

"username":system:serviceaccount:gpc-system:fleet-admin-controller"

Cible

(Champs et valeurs qui appellent l'API)

 requestURI

"apis/resourcemanager.gdc.goog/v1alpha1/namespaces/ gpc-system/projects/istio-system

Action

(Champs contenant l'opération effectuée)

 verb

"verb":"update"

Code temporel de l'événement requestReceivedTimestamp

Par exemple,

"requestReceivedTimestamp": "2022-12-22T15:46:41.028873Z"

Source de l'action sourceIPs

Par exemple,

"sourceIPs":["10.253.128.178"],
Résultat stage

Par exemple,

"stage": "ResponseComplete"

Autres champs
  • kind
  • objectRef

Par exemple,

"kind": "Event",
"objectRef": {
      "name": "istio-system",
      "apiVersion": "v1alpha1",
      "apiGroup": "resourcemanager.gdc.goog",
      "resourceVersion": "7812139",
      "resource": "projects",
      "uid": "7d3a3bb1-a0be-4c5c-980b-f9cd3632f6e3",
      "namespace": "gpc-system"
  },

Exemple de journal

{
    "stage": "ResponseComplete",
    "apiVersion": "audit.k8s.io/v1",
    "objectRef": {
      "name": "istio-system",
      "apiVersion": "v1alpha1",
      "apiGroup": "resourcemanager.gdc.goog",
      "resourceVersion": "7812139",
      "resource": "projects",
      "uid": "7d3a3bb1-a0be-4c5c-980b-f9cd3632f6e3",
      "namespace": "gpc-system"
    },
    "requestReceivedTimestamp": "2022-12-22T15:46:41.028873Z",
    "sourceIPs": [
      "10.253.128.178"
    ],
    "annotations": {
      "authorization.k8s.io/decision": "allow",
      "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"fleet-admin-common-controller\" of ClusterRole \"fleet-admin-common-controllers-role\" to ServiceAccount \"fleet-admin-controller/gpc-system\"",
      "mutation.webhook.admission.k8s.io/round_0_index_5": "{\"configuration\":\"gatekeeper-mutating-webhook-configuration\",\"webhook\":\"mutation.gatekeeper.sh\",\"mutated\":false}"
    },
    "_gdch_cluster": "root-admin",
    "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-t4rld",
    "user": {
      "uid": "da8e839f-eca4-4a96-9058-94fa4202824f",
      "extra": {
        "authentication.kubernetes.io/pod-uid": [
          "09335650-82b0-451c-83e2-f8157e9d518c"
        ],
        "authentication.kubernetes.io/pod-name": [
          "fleet-admin-controller-75dbdf7659-ccfrn"
        ]
      },
      "groups": [
        "system:serviceaccounts",
        "system:serviceaccounts:gpc-system",
        "system:authenticated"
      ],
      "username": "system:serviceaccount:gpc-system:fleet-admin-controller"
    },
    "stageTimestamp": "2022-12-22T15:46:41.119767Z",
    "kind": "Event",
    "verb": "update",
    "requestURI": "/apis/resourcemanager.gdc.goog/v1alpha1/namespaces/gpc-system/projects/istio-system",
    "responseStatus": {
      "metadata": {},
      "code": 200
    },
    "userAgent": "fleet-admin-cm/v0.0.0 (linux/amd64) kubernetes/$Format",
    "auditID": "5aeaeab6-7371-4b63-8355-b4469e1440bb",
    "level": "Metadata",
    "_gdch_service_name": "apiserver",
    "_gdch_tenant_id": "infra-obs"
  }

Journaux d'audit du plan de gestion d'API KRM (RBAC du projet – ProjectRole)

Champs de l'entrée de journal contenant des informations d'audit
Métadonnées d'audit Nom du champ d'audit Valeur
Identité de l'utilisateur ou du service username

Par exemple,

"username": "system:serviceaccount:
gpc-system:fleet-admin-controller"

Cible

(Champs et valeurs qui appellent l'API)

 requestURI

"requestURI":"/apis/resourcemanager.gdc.goog/ v1alpha1/namespaces/vm-prober-system-obs-system/ projectroles/service-now-admin/status"

Action

(Champs contenant l'opération effectuée)

 verb

"verb":"update"

Code temporel de l'événement requestReceivedTimestamp

Par exemple,

"requestReceivedTimestamp": "2022-12-21T23:36:45.808663Z"

Source de l'action sourceIPs

Par exemple,

"sourceIPs":["10.253.128.178"]
Résultat stage

Par exemple,

  "stage": "ResponseComplete"

Autres champs
  • kind
  • objectRef

Par exemple,

"kind": "Event",
"objectRef": {
   "apiVersion": "v1alpha1",
   "namespace": "vm-prober-system-obs-system",
   "resourceVersion": "5573513",
   "apiGroup": "resourcemanager.gdc.goog",
   "resource": "projectroles",
   "name": "service-now-admin",
   "subresource": "status",
   "uid": "c220806d-a708-4e42-8a2c-8442b6a74038"
},

Exemple de journal

{
    "verb": "update",
    "responseStatus": {
      "metadata": {},
      "code": 200
    },
    "objectRef": {
      "apiVersion": "v1alpha1",
      "namespace": "vm-prober-system-obs-system",
      "resourceVersion": "5573513",
      "apiGroup": "resourcemanager.gdc.goog",
      "resource": "projectroles",
      "name": "service-now-admin",
      "subresource": "status",
      "uid": "c220806d-a708-4e42-8a2c-8442b6a74038"
    },
    "apiVersion": "audit.k8s.io/v1",
    "sourceIPs": [
      "10.253.128.178"
    ],
    "kind": "Event",
    "requestURI": "/apis/resourcemanager.gdc.goog/v1alpha1/namespaces/vm-prober-system-obs-system/projectroles/service-now-admin/status",
    "auditID": "e40537d8-0e49-4f34-85b3-f6bb5c373a58",
    "_gdch_cluster": "root-admin",
    "annotations": {
      "authorization.k8s.io/decision": "allow",
      "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"fleet-admin-controller\" of ClusterRole \"fleet-admin-controller\" to ServiceAccount \"fleet-admin-controller/gpc-system\""
    },
    "stageTimestamp": "2022-12-21T23:36:45.814414Z",
    "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-t4rld",
    "level": "Metadata",
    "stage": "ResponseComplete",
    "userAgent": "fleet-admin-cm/v0.0.0 (linux/amd64) kubernetes/$Format",
    "requestReceivedTimestamp": "2022-12-21T23:36:45.808663Z",
    "user": {
      "extra": {
        "authentication.kubernetes.io/pod-name": [
          "fleet-admin-controller-75dbdf7659-ccfrn"
        ],
        "authentication.kubernetes.io/pod-uid": [
          "09335650-82b0-451c-83e2-f8157e9d518c"
        ]
      },
      "groups": [
        "system:serviceaccounts",
        "system:serviceaccounts:gpc-system",
        "system:authenticated"
      ],
      "username": "system:serviceaccount:gpc-system:fleet-admin-controller",
      "uid": "da8e839f-eca4-4a96-9058-94fa4202824f"
    },
    "_gdch_service_name": "apiserver",
    "_gdch_tenant_id": "infra-obs"
  }

Journaux d'audit du plan de gestion d'API KRM (RBAC du projet – ProjectRoleBinding)

Champs de l'entrée de journal contenant des informations d'audit
Métadonnées d'audit Nom du champ d'audit Valeur
Identité de l'utilisateur ou du service username

Par exemple,

"username": "system:serviceaccount:
gatekeeper-system:gatekeeper-admin"

Cible

(Champs et valeurs qui appellent l'API)

 requestURI

"/apis/resourcemanager.gdc.goog/ v1alpha1/projectrolebindings?limit=500"

Action

(Champs contenant l'opération effectuée)

 verb

"verb":"list"

Code temporel de l'événement requestReceivedTimestamp

Par exemple,

"requestReceivedTimestamp": "2022-12-06T23:03:32.904478Z"

Source de l'action sourceIPs

Par exemple,

"sourceIPs":["10.253.165.69"],
Résultat stage

Par exemple,

"stage": "RequestReceived"

Autres champs
  • kind
  • objectRef

Par exemple,

"kind": "Event",
"objectRef": {
    "resource": "projectrolebindings",
    "apiVersion": "v1alpha1",
    "apiGroup": "resourcemanager.gdc.goog"
  },

Exemple de journal

{
  "verb": "list",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-t4rld",
  "userAgent": "gatekeeper/v3.7.0 (linux/amd64) 3ba8e93/2021-11-15T20:59:44Z",
  "objectRef": {
    "apiVersion": "v1alpha1",
    "resource": "projectrolebindings",
    "apiGroup": "resourcemanager.gdc.goog"
  },
  "sourceIPs": [
    "10.253.128.219"
  ],
  "responseStatus": {
    "code": 200,
    "metadata": {}
  },
  "kind": "Event",
  "stage": "ResponseComplete",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"gatekeeper-manager-rolebinding\" of ClusterRole \"gatekeeper-manager-role\" to ServiceAccount \"gatekeeper-admin/gatekeeper-system\""
  },
  "requestURI": "/apis/resourcemanager.gdc.goog/v1alpha1/projectrolebindings?limit=500",
  "user": {
    "uid": "d23f8b07-b318-47fb-a81d-9932e81c3be8",
    "groups": [
      "system:serviceaccounts",
      "system:serviceaccounts:gatekeeper-system",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/pod-uid": [
        "86ab2ec3-93ae-49b6-9feb-cadae6d014c4"
      ],
      "authentication.kubernetes.io/pod-name": [
        "gatekeeper-audit-54d846f776-z6bzn"
      ]
    },
    "username": "system:serviceaccount:gatekeeper-system:gatekeeper-admin"
  },
  "stageTimestamp": "2022-12-21T23:11:57.899640Z",
  "auditID": "e8d0d02b-f309-4127-8cdb-e93a39ebaea7",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "_gdch_cluster": "root-admin",
  "requestReceivedTimestamp": "2022-12-21T23:11:57.897447Z",
  "_gdch_service_name": "apiserver",
  "_gdch_tenant_id": "infra-obs"
}