NTP server workloads (NTP)

Network Time Protocol (NTP) server workload audit logs in Google Distributed Cloud (GDC) air-gapped let you track data changes for NTP server resources in root workloads. Kubernetes audit logs record the caller identity, target request URI, action, timestamp, service name, and response status code for create, read, update, and delete (CRUD) operations.

Workload location

Root only workloads
Audit log source

Kubernetes audit logs
Audited operations

Data changes

Data changes (CRUD operations)

Fields in the log entry that contain audit information
Audit metadata Audit field name Value
User or service identity username

For example,

"user_username": "system:serviceaccount:gpc-system:root-admin-controller-sa"

Target

(Fields and values that call the API)

 requestURI

"requestURI":"//apis/system.private.gdc.goog/VERSION/ namespaces/gpc-system/ntpservers/ntp-relay-fhr6t/status"

Action

(Fields containing the performed operation)

 verb

"verb":"patch"

Event timestamp requestReceivedTimestamp

For example,

"requestReceivedTimestamp":2022-12-13T13:48:30.014578Z

Source of action _gdch_service_name

For example,

"_gdch_service_name": "apiserver"
Outcome responseStatus_code

For example,

"responseStatus_code":"200"
Other fields Not applicable Not applicable

Example log

{
"_gdch_cluster": "root-admin",
"_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-w5srk",
"_gdch_service_name": "apiserver",
"annotations_authorization_k8s_io_decision":  " allow",
"annotations_authorization_k8s_io_reason RBAC": allowed by ClusterRoleBinding "root-admin-common-controllers-rolebinding" of ClusterRole "root-admin-common-controllers-role" to ServiceAccount "root-admin-controller-sa/gpc-system",
"apiGroup"  :  "system.private.gdc.goog",
"apiVersion":  "audit.k8s.io/v1",
"auditID": 05e72a29-1b18-4db7-9ded-8f51e3a145d8,
"cluster": "root-admin",
"fluentbit_pod":   "anthos-audit-logs-forwarder-w5srk",
"kind": "Event",
  "level": "Metadata",
  "objectRef": {
    "apiGroup": "system.private.gdc.goog",
    "apiVersion": "v1alpha1",
    "name": "ntp-relay-fhr6t",
    "namespace": "gpc-system",
    "resource": "ntpservers",
    "subresource":  "status"
  },
"requestReceivedTimestamp": "2022-12-13T13:48:29.996912Z",
"requestURI": "/apis/system.private.gdc.goog/v1alpha1/namespaces/gpc-system/ntpservers/ntp-relay-fhr6t/status"
"responseStatus": {
    "code": 200,
    "metadata": {},
  },
"service_name": "apiserver",
"stage": "ResponseComplete",
"stageTimestamp": "2022-12-13T13:48:30.014578Z",
"userAgent": "root-admin-cm/v0.0.0 (linux/amd64) kubernetes/$Format",
"user_uid": "c01df74a-a983-44db-8fd3-e0dae87c0796",
"user_username": "system:serviceaccount:gpc-system:root-admin-controller-sa",
"verb": "patch",
"Time" : "1670939310014",
"tsNs": "1670939310014791527"
}