K
Q

GKE Audit logs - what kind of logs GKE is being generate?

3/5/2020

according to the documentation there are three kind of audit: Admin Activity audit logs, System Event logs and Data Access audit logs.

which kind of logs GKE cluster is being generated? its not clear for me. i would like to understand what will be the pricing

https://cloud.google.com/stackdriver/pricing

-- inza
audit-logging
google-cloud-platform
google-kubernetes-engine

Similar Questions

Options for running k8s in local system without vm (single node)
I'm trying to create High Available master node but getting Exception in cni Plugin
Cannot determine if job needs to be started: Too many missed start time (> 100). Set or decrease .spec.startingDeadlineSeconds or check clock skew
Kubernetes load balancing rabbitmq on digital ocean

1 Answer

3/5/2020

As per documentation:

  1. Admin activity logs - those are enabled by default at no cost

    • k8s_cluster - Log entries written by the Kubernetes API server apply to the k8s_cluster resource type. These log entries describe operations on Kubernetes resources in your cluster, for example, Pods, Deployments, and Secrets.
    logName="projects/[PROJECT_ID]/logs/cloudaudit.googleapis.com%2Factivity"
protoPayload.serviceName="k8s.io"
    • gke_cluster - Log entries written by the Kubernetes Engine API server apply to the gke_cluster resource. These log entries describe operations like cluster creation and deletion.
    logName="projects/[PROJECT_ID]/logs/cloudaudit.googleapis.com%2Factivity"
protoPayload.serviceName="gke_cluster"

  2. Data access logs - Data Access audit logs contain API calls that read the configuration or metadata of resources, as well as user-driven API calls that create, modify, or read user-provided resource data. Data Access audit logs do not record the data-access operations on resources that are publicly shared (available to All Users or All Authenticated Users) or that can be accessed without logging into Google Cloud. Data access logs are something that can log very extensively depending on the configuration. Those you need to enable yourself, may be billed according to Quotas.

There are 3 kinds of operations, you choose which you want to log:

  • ADMIN_READ: Records operations that read metadata or configuration information.
  • DATA_READ: Records operations that read user-provided data (eg. CRD).
  • DATA_WRITE: Records operations that write user-provided data (eg. CRD).
resource.type="k8s_cluster"
logName="projects/my-project/logs/cloudaudit.googleapis.com%2Fdata_access"

For most projects Admin activity logs is enough. If you need to log what type of resources which service / user access then you should enable Data Access logs.

More here GKE Audit logs

-- lukaszberwid
Source: StackOverflow