Sistema de nombres de dominio (DNS)

Ubicación de la carga de trabajo

Cargas de trabajo de la raíz y de la organización
Origen del archivo de registro de auditoría

Registros de auditoría de Kubernetes
Operaciones auditadas

Actualizar una zona

Campos de la entrada de registro que contienen información de auditoría
Auditar metadatos Nombre del campo de auditoría Valor
Identidad de usuario o servicio user.username

Por ejemplo,

"user":{
  "username": "dns@example.com"
  }

Objetivo

(Campos y valores que llaman a la API)

 requestURI

"requestURI":"/api/v1/namespaces/dns-system/configmaps/gpc-coredns-external-zonefile"

Acción

(Campos que contienen la operación realizada)

 verb

"verb":"update"

Marca de tiempo de evento ts

Por ejemplo,

"ts":2022-11-11T22:02:02.074Z

Fuente de la acción sourceIPs

Por ejemplo,

"sourceIPs":["10.142.5.147"]
Resultado responseStatus.code

Por ejemplo,

"responseStatus":{
  "code":200
  }

Otros campos
  • annotations
  • objectRef

Por ejemplo,

"annotations":{
  "authorization.k8s.io/decision":"allow"
  },
"objectRef":{
  "resourceVersion":"697063",
  "uid":"aed2e6f7-ca03-4bcd-9c07-167ccd4da88e",
  "apiVersion":"v1",
  "resource":"configmaps",
  "apiGroup":"UNKNOWN",
  "namespace":"dns-system",
  "name":"gpc-coredns-external-zonefile"
    }

Registro de ejemplo

{
  "_gdch_cluster":"root-admin",
  "_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-7s769",
  "_gdch_service_name":"apiserver",
  "annotations":{
    "authorization.k8s.io/decision":"allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"dns-core-controllers-rolebinding\" of ClusterRole \"dns-core-controllers-role\" to ServiceAccount \"dns-core-controller-sa/dns-system\"",
    },
  "apiVersion":"audit.k8s.io/v1",
  "auditID":"ba0344d7-283f-4d79-aabc-e083al9b053a",
  "kind":"Event",
  "level":"Metadata",
  "objectRef":{
    "resourceVersion":"697063",
    "uid":"aed2e6f7-ca03-4bcd-9c07-167ccd4da88e",
    "apiVersion":"v1",
    "resource":"configmaps",
    "apiGroup":"UNKNOWN",
    "namespace":"dns-system",
    "name":"gpc-coredns-external-zonefile"
    },
  "requestReceivedTimestamp":"2022-11-11T22:02:02.034688Z",
  "requestURI":"/api/v1/namespaces/dns-system/configmaps/gpc-coredns-external-zonefile",
  "responseStatus":{
    "metadata":{},
    "code":200
    },
  "sourceIPs":["10.142.5.147"],
  "stage":"ResponseComplete",
  "stageTimestamp":"2022-11-11T22:02:02.045045Z",
  "ts":2022-11-11T22:02:02.074Z,
  "tsNs":1668204122074601081,
  "user":{
    "uid":"08f727c9-5e3d-403f-bf35-06ef53f9832c",
    "groups":[
      "system:serviceaccounts",
      "system:serviceaccounts:dns-system",
      "system:authenticated"
      ],
    "username": "system:serviceaccount:dns-system:dns-core-controller-sa",
    "extra": {
      "authentication.kubernetes.io/pod-name":["dns-core-controller-58c4646858-z8kmr"],
      "authentication.kubernetes.io/pod-uid":["7cfc9b72-aacc-4e86-b43f-016498055230"]
      }
    },
  "userAgent":"controller-manager/v0.0.0 (linux/amd64) kubernetes/$Format",
  "verb":"update"
}

Crea un ManagedDNSZone

Campos de la entrada de registro que contienen información de auditoría
Auditar metadatos Nombre del campo de auditoría Valor
Identidad de usuario o servicio user.username

Por ejemplo,

"user":{
  "username": "system:bootstrap:xqk4xc"
  }

Objetivo

(Campos y valores que llaman a la API)

 requestURI

"requestURI":"/apis/networking.global.gdc.goog/v1/namespaces/cloud-dns-2/manageddnszones?fieldManager=kubectl-create&fieldValidation=Strict"

Acción

(Campos que contienen la operación realizada)

 verb

"verb":"create"

Marca de tiempo de evento requestReceivedTimestamp

Por ejemplo,

"requestReceivedTimestamp":"2026-05-08T09:51:45.320229Z"

Fuente de la acción sourceIPs

Por ejemplo,

"sourceIPs":["10.200.0.1","10.0.138.150"]
Resultado responseStatus.code

Por ejemplo,

"responseStatus":{
  "code":201
  }

Otros campos
  • annotations
  • objectRef

Por ejemplo,

"annotations":{
  "authorization.k8s.io/decision":"allow",
  "authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"e2e-test\" of ClusterRole \"cluster-admin\" to Group \"system:bootstrappers:gce-e2e\"",
  "mutation.webhook.admission.k8s.io/round_0_index_1":"{\"configuration\":\"gatekeeper-mutating-webhook-configuration\",\"webhook\":\"mutation.gatekeeper.sh\",\"mutated\":false}"
  },
"objectRef":{
  "apiGroup":"networking.global.gdc.goog",
  "apiVersion":"v1",
  "name":"public-cf-zone-1",
  "namespace":"cloud-dns-2",
  "resource":"manageddnszones"
    }

Registro de ejemplo

{
  "_gdch_cluster": "org-1-admin",
  "_gdch_component": "user_kubectl",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-ttpfw",
  "_gdch_org_id": "org-1.zone1.google.gdch.test",
  "_gdch_org_name": "org-1",
  "_gdch_zone_id": "zone1",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"e2e-test\" of ClusterRole \"cluster-admin\" to Group \"system:bootstrappers:gce-e2e\"",
    "mutation.webhook.admission.k8s.io/round_0_index_1": "{\"configuration\":\"gatekeeper-mutating-webhook-configuration\",\"webhook\":\"mutation.gatekeeper.sh\",\"mutated\":false}"
  },
  "apiVersion": "audit.k8s.io/v1",
  "auditID": "3de6821e-4e40-4bbc-9c9c-285c59ddaa19",
  "kind": "Event",
  "level": "Request",
  "objectRef": {
    "apiGroup": "networking.global.gdc.goog",
    "apiVersion": "v1",
    "name": "public-cf-zone-1",
    "namespace": "cloud-dns-2",
    "resource": "manageddnszones"
  },
  "requestObject": {
    "apiVersion": "networking.global.gdc.goog/v1",
    "kind": "ManagedDNSZone",
    "metadata": {
      "creationTimestamp": null,
      "name": "public-cf-zone-1",
      "namespace": "cloud-dns-2"
    },
    "spec": {
      "description": "Public DNS zone for Cloud Foundry",
      "dnsName": "cf1.dns2",
      "visibility": "PUBLIC"
    }
  },
  "requestReceivedTimestamp": "2026-05-08T09:51:45.320229Z",
  "requestURI": "/apis/networking.global.gdc.goog/v1/namespaces/cloud-dns-2/manageddnszones?fieldManager=kubectl-create&fieldValidation=Strict",
  "responseStatus": {
    "code": 201,
    "metadata": {}
  },
  "sourceIPs": [
    "10.200.0.1",
    "10.0.138.150"
  ],
  "stage": "ResponseComplete",
  "stageTimestamp": "2026-05-08T09:51:45.528379Z",
  "user": {
    "groups": [
      "system:bootstrappers",
      "system:bootstrappers:gce-e2e",
      "system:authenticated"
    ],
    "username": "system:bootstrap:xqk4xc"
  },
  "userAgent": "kubectl/v1.28.3 (linux/amd64) kubernetes/a8a1abc",
  "verb": "create"
}

Crear un ResourceRecordSet

Campos de la entrada de registro que contienen información de auditoría
Auditar metadatos Nombre del campo de auditoría Valor
Identidad de usuario o servicio user.username

Por ejemplo,

"user":{
  "username": "system:serviceaccount:dns-system:dns-prober-sa"
  }

Objetivo

(Campos y valores que llaman a la API)

 requestURI

"requestURI":"/apis/networking.global.gdc.goog/v1/namespaces/dns-system/resourcerecordsets"

Acción

(Campos que contienen la operación realizada)

 verb

"verb":"create"

Marca de tiempo de evento requestReceivedTimestamp

Por ejemplo,

"requestReceivedTimestamp":"2026-05-08T08:48:30.748194Z"

Fuente de la acción sourceIPs

Por ejemplo,

"sourceIPs":["10.0.130.26","10.0.136.209"]
Resultado responseStatus.code

Por ejemplo,

"responseStatus":{
  "code":201
  }

Otros campos
  • annotations
  • objectRef

Por ejemplo,

"annotations":{
  "authorization.k8s.io/decision":"allow",
  "authorization.k8s.io/reason":"RBAC: allowed by RoleBinding \"dns-prober-global-prober-rolebinding/dns-system\" of Role \"dns-prober-global-prober-role\" to ServiceAccount \"dns-prober-sa/dns-system\"",
  "mutation.webhook.admission.k8s.io/round_0_index_0":"{\"configuration\":\"dns-managed-dns-v1-mutation\",\"webhook\":\"resourcerecordsets.networking.global.gdc.goog\",\"mutated\":true}",
  "mutation.webhook.admission.k8s.io/round_0_index_1":"{\"configuration\":\"gatekeeper-mutating-webhook-configuration\",\"webhook\":\"mutation.gatekeeper.sh\",\"mutated\":false}",
  "patch.webhook.admission.k8s.io/round_0_index_0":"{\"configuration\":\"dns-managed-dns-v1-mutation\",\"webhook\":\"resourcerecordsets.networking.global.gdc.goog\",\"patch\":[{\"op\":\"add\",\"path\":\"/metadata/creationTimestamp\",\"value\":null},{\"op\":\"add\",\"path\":\"/metadata/labels\",\"value\":{\"clouddns.private.gdc.goog/dnszone\":\"test.prober.private\"}},{\"op\":\"add\",\"path\":\"/metadata/annotations\",\"value\":{\"clouddns.private.gdc.goog/token\":\"synpi4vyatjbdwy2-a-pri\"}}],\"patchType\":\"JSONPatch\"}"
  },
"objectRef":{
  "apiGroup":"networking.global.gdc.goog",
  "apiVersion":"v1",
  "name":"prober-test-rrs-zone1-private",
  "namespace":"dns-system",
  "resource":"resourcerecordsets"
    }

Registro de ejemplo

{
  "_gdch_cluster": "org-1-admin",
  "_gdch_component": "dns",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-ggwr5",
  "_gdch_org_id": "org-1.zone1.google.gdch.test",
  "_gdch_org_name": "org-1",
  "_gdch_zone_id": "zone1",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by RoleBinding \"dns-prober-global-prober-rolebinding/dns-system\" of Role \"dns-prober-global-prober-role\" to ServiceAccount \"dns-prober-sa/dns-system\"",
    "mutation.webhook.admission.k8s.io/round_0_index_0": "{\"configuration\":\"dns-managed-dns-v1-mutation\",\"webhook\":\"resourcerecordsets.networking.global.gdc.goog\",\"mutated\":true}",
    "mutation.webhook.admission.k8s.io/round_0_index_1": "{\"configuration\":\"gatekeeper-mutating-webhook-configuration\",\"webhook\":\"mutation.gatekeeper.sh\",\"mutated\":false}",
    "patch.webhook.admission.k8s.io/round_0_index_0": "{\"configuration\":\"dns-managed-dns-v1-mutation\",\"webhook\":\"resourcerecordsets.networking.global.gdc.goog\",\"patch\":[{\"op\":\"add\",\"path\":\"/metadata/creationTimestamp\",\"value\":null},{\"op\":\"add\",\"path\":\"/metadata/labels\",\"value\":{\"clouddns.private.gdc.goog/dnszone\":\"test.prober.private\"}},{\"op\":\"add\",\"path\":\"/metadata/annotations\",\"value\":{\"clouddns.private.gdc.goog/token\":\"synpi4vyatjbdwy2-a-pri\"}}],\"patchType\":\"JSONPatch\"}"
  },
  "apiVersion": "audit.k8s.io/v1",
  "auditID": "12851275-a785-41fa-8e2b-8469bd9d1f65",
  "kind": "Event",
  "level": "Request",
  "objectRef": {
    "apiGroup": "networking.global.gdc.goog",
    "apiVersion": "v1",
    "name": "prober-test-rrs-zone1-private",
    "namespace": "dns-system",
    "resource": "resourcerecordsets"
  },
  "requestObject": {
    "apiVersion": "networking.global.gdc.goog/v1",
    "kind": "ResourceRecordSet",
    "metadata": {
      "creationTimestamp": null,
      "name": "prober-test-rrs-zone1-private",
      "namespace": "dns-system"
    },
    "spec": {
      "dnsZone": "prober-test-managed-dns-private",
      "name": "prober-test-rrs-zone1-private.test.prober.private",
      "rrData": [
        "192.168.100.100"
      ],
      "ttlSeconds": 30,
      "type": "A"
    },
    "status": {
      "rollout": {
        "strategy": {
          "type": ""
        }
      }
    }
  },
  "requestReceivedTimestamp": "2026-05-08T08:48:30.748194Z",
  "requestURI": "/apis/networking.global.gdc.goog/v1/namespaces/dns-system/resourcerecordsets",
  "responseStatus": {
    "code": 201,
    "metadata": {}
  },
  "sourceIPs": [
    "10.0.130.26",
    "10.0.136.209"
  ],
  "stage": "ResponseComplete",
  "stageTimestamp": "2026-05-08T08:48:30.964607Z",
  "user": {
    "extra": {
      "__AIS_token_issuer_zone": [
        "zone1"
      ]
    },
    "groups": [
      "system:authenticated"
    ],
    "username": "system:serviceaccount:dns-system:dns-prober-sa"
  },
  "userAgent": "prober/v0.0.0 (linux/amd64) kubernetes/$Format",
  "verb": "create"
}