How can I find GKE's control plane logs?

2/1/2021

So there's this page about auditing-logs and I'm very confused about:

The k8s.io service is used for Kubernetes audit logs. These logs are generated by the Kubernetes API Server component and they contain information about actions performed using the Kubernetes API. For example, any changes you make on a Kubernetes resource by using the kubectl command are recorded by the k8s.io service. For more information, see Auditing in the Kubernetes documentation.

The container.googleapis.com service is used for GKE control plane audit logs. These logs are generated by the GKE internal components and they contain information about actions performed using the GKE API. For example, any changes you perform on a GKE cluster configuration using a gcloud command are recorded by the container.googleapis.com service.

which one shall I pick to get:

  1. /var/log/kube-apiserver.log - API Server, responsible for serving the API
  2. /var/log/kube-controller-manager.log - Controller that manages replication controllers

or these are all similar to EKS where audit logs means a separate thing?

Audit (audit) – Kubernetes audit logs provide a record of the individual users, administrators, or system components that have affected your cluster. For more information, see Auditing in the Kubernetes documentation.

-- Ivan Petrov
google-kubernetes-engine
kubernetes

2 Answers

2/18/2021

If the cluster still exists, you should be able to do the following on GKE

kubectl proxy
curl http://localhost:8001/logs/kube-apiserver.log

AFAIK, there's no way to get server logs for clusters that have been deleted.

-- Brian Gibbon
Source: StackOverflow

2/1/2021

You cannot. GKE does not make them available. Audit logs are different, those are a record of API actions.

-- coderanger
Source: StackOverflow