NTP 服务器工作负载 (NTP)

工作负载位置	仅限 root 用户的工作负载
审核日志源	Kubernetes 审核日志
接受审核的操作	数据变化

数据更改（CRUD 操作）

包含审核信息的日志条目中的字段
审核元数据	审核字段名称	值
用户或服务身份	username	例如， "user_username": "system:serviceaccount:gpc-system:root-admin-controller-sa"
目标 （调用 API 的字段和值）	requestURI	"requestURI":"//apis/system.private.gdc.goog/VERSION/ namespaces/gpc-system/ntpservers/ntp-relay-fhr6t/status"
操作 （包含所执行操作的字段）	verb	"verb":"patch"
活动时间戳	requestReceivedTimestamp	例如， "requestReceivedTimestamp":2022-12-13T13:48:30.014578Z
操作来源	_gdch_service_name	例如， "_gdch_service_name": "apiserver"
结果	responseStatus_code	例如， "responseStatus_code":"200"
其他字段	不适用	不适用

日志示例

{
"_gdch_cluster": "root-admin",
"_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-w5srk",
"_gdch_service_name": "apiserver",
"annotations_authorization_k8s_io_decision":  " allow",
"annotations_authorization_k8s_io_reason RBAC": allowed by ClusterRoleBinding "root-admin-common-controllers-rolebinding" of ClusterRole "root-admin-common-controllers-role" to ServiceAccount "root-admin-controller-sa/gpc-system",
"apiGroup"  :  "system.private.gdc.goog",
"apiVersion":  "audit.k8s.io/v1",
"auditID": 05e72a29-1b18-4db7-9ded-8f51e3a145d8,
"cluster": "root-admin",
"fluentbit_pod":   "anthos-audit-logs-forwarder-w5srk",
"kind": "Event",
  "level": "Metadata",
  "objectRef": {
    "apiGroup": "system.private.gdc.goog",
    "apiVersion": "v1alpha1",
    "name": "ntp-relay-fhr6t",
    "namespace": "gpc-system",
    "resource": "ntpservers",
    "subresource":  "status"
  },
"requestReceivedTimestamp": "2022-12-13T13:48:29.996912Z",
"requestURI": "/apis/system.private.gdc.goog/v1alpha1/namespaces/gpc-system/ntpservers/ntp-relay-fhr6t/status"
"responseStatus": {
    "code": 200,
    "metadata": {},
  },
"service_name": "apiserver",
"stage": "ResponseComplete",
"stageTimestamp": "2022-12-13T13:48:30.014578Z",
"userAgent": "root-admin-cm/v0.0.0 (linux/amd64) kubernetes/$Format",
"user_uid": "c01df74a-a983-44db-8fd3-e0dae87c0796",
"user_username": "system:serviceaccount:gpc-system:root-admin-controller-sa",
"verb": "patch",
"Time" : "1670939310014",
"tsNs": "1670939310014791527"
}