| Workload location | Root only workloads |
| Audit log source | |
| Audited operations |
Data changes (CRUD operations)
| Fields in the log entry that contain audit information | ||
|---|---|---|
| Audit metadata | Audit field name | Value |
| User or service identity | username | For example,
|
| Target (Fields and values that call the API) | requestURI | |
| Action (Fields containing the performed operation) | verb | |
| Event timestamp | requestReceivedTimestamp | For example, |
| Source of action | _gdch_service_name | For example,
|
| Outcome | responseStatus_code | For example,
|
| Other fields | Not applicable | Not applicable |
Example log
{ "_gdch_cluster": "root-admin", "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-w5srk", "_gdch_service_name": "apiserver", "annotations_authorization_k8s_io_decision": " allow", "annotations_authorization_k8s_io_reason RBAC": allowed by ClusterRoleBinding "root-admin-common-controllers-rolebinding" of ClusterRole "root-admin-common-controllers-role" to ServiceAccount "root-admin-controller-sa/gpc-system", "apiGroup" : "system.private.gdc.goog", "apiVersion": "audit.k8s.io/v1", "auditID": 05e72a29-1b18-4db7-9ded-8f51e3a145d8, "cluster": "root-admin", "fluentbit_pod": "anthos-audit-logs-forwarder-w5srk", "kind": "Event", "level": "Metadata", "objectRef": { "apiGroup": "system.private.gdc.goog", "apiVersion": "v1alpha1", "name": "ntp-relay-fhr6t", "namespace": "gpc-system", "resource": "ntpservers", "subresource": "status" }, "requestReceivedTimestamp": "2022-12-13T13:48:29.996912Z", "requestURI": "/apis/system.private.gdc.goog/v1alpha1/namespaces/gpc-system/ntpservers/ntp-relay-fhr6t/status" "responseStatus": { "code": 200, "metadata": {}, }, "service_name": "apiserver", "stage": "ResponseComplete", "stageTimestamp": "2022-12-13T13:48:30.014578Z", "userAgent": "root-admin-cm/v0.0.0 (linux/amd64) kubernetes/$Format", "user_uid": "c01df74a-a983-44db-8fd3-e0dae87c0796", "user_username": "system:serviceaccount:gpc-system:root-admin-controller-sa", "verb": "patch", "Time" : "1670939310014", "tsNs": "1670939310014791527" }