OPA Gatekeeper (OPA)

All operations through the Kubernetes API

Log schema: KRM API

Fields in the log entry that contain audit information
Audit metadata Audit field name Value
User or service identity user 

"user": {  "groups": [  "system:authenticated"  ],  "username": "fop-platform-admin@example.com" }, "annotations": {  "authorization.k8s.io/decision": "allow",  "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"project-creator-binding\" of ClusterRole \"project-creator\" to Group \"system:authenticated\"" }

Target

(Fields and values that call the API)

 objectRef 

"objectRef": {  "apiVersion": "v1",  "name": "app1-project",  "resource": "projects",  "namespace": "gpc-system",  "apiGroup": "resourcemanager.gdc.goog" }

Action

(Fields containing the performed operation)

 verb 

"verb": "create"
Event timestamp requestReceivedTimestamp 

"requestReceivedTimestamp": "2022-12-09T23:51:56.997825Z"
Source of action sourceIPs 

"sourceIPs": [  "10.200.0.2" ]
Outcome responseStatus 

"responseStatus": {  "code": 403,  "status": "Failure",  "metadata": {},  "message": "admission webhook \"validation.gatekeeper.sh\" denied the request: [restrictprojectaccess] username  with groups <[\"system:authenticated\"]> is not allowed for this resource ",  "reason": "[restrictprojectaccess] username  with groups <[\"system:authenticated\"]> is not allowed for this resource " }
Other fields responseStatus_message 

"responseStatus": {  "code": 403,  "status": "Failure",  "metadata": {},  "message": "admission webhook \"validation.gatekeeper.sh\" denied the request: [restrictprojectaccess] username  with groups <[\"system:authenticated\"]> is not allowed for this resource ",  "reason": "[restrictprojectaccess] username  with groups <[\"system:authenticated\"]> is not allowed for this resource " }

Example log KRM API

{  "sourceIPs": [  "10.200.0.2"  ],  "_gdch_cluster": "root-admin",  "objectRef": {  "apiVersion": "v1",  "name": "app1-project",  "resource": "projects",  "namespace": "gpc-system",  "apiGroup": "resourcemanager.gdc.goog"  },  "kind": "Event",  "level": "Metadata",  "apiVersion": "audit.k8s.io/v1",  "auditID": "3611358c-f8b0-4780-9268-950eccc5881a",  "stage": "ResponseComplete",  "requestURI": "/apis/resourcemanager.gdc.goog/v1/namespaces/gpc-system/projects?fieldManager=kubectl-client-side-apply&fieldValidation=Strict",  "verb": "create",  "requestReceivedTimestamp": "2022-12-09T23:51:56.997825Z",  "responseStatus": {  "code": 403,  "status": "Failure",  "metadata": {},  "message": "admission webhook \"validation.gatekeeper.sh\" denied the request: [restrictprojectaccess] username <fop-platform-admin@example.com> with groups <[\"system:authenticated\"]> is not allowed for this resource <Project/app1-project>",  "reason": "[restrictprojectaccess] username <fop-platform-admin@example.com> with groups <[\"system:authenticated\"]> is not allowed for this resource <Project/app1-project>"  },  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-b9kk4",  "stageTimestamp": "2022-12-09T23:51:57.015134Z",  "userAgent": "kubectl/v1.25.4 (linux/amd64) kubernetes/872a965",  "user": {  "groups": [  "system:authenticated"  ],  "username": "fop-platform-admin@example.com"  },  "annotations": {  "authorization.k8s.io/decision": "allow",  "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"project-creator-binding\" of ClusterRole \"project-creator\" to Group \"system:authenticated\""  },  "_gdch_service_name": "apiserver" }

Start an audit process

Log schema: Gatekeeper

Fields in the log entry that contain audit information
Audit metadata Audit field name Value
User or service identity Not applicable

Target

(Fields and values that call the API)

 process 

\"process\":\"audit\"

Action

(Fields containing the performed operation)

 event_type 

\"event_type\":\"audit_started\"
Event timestamp audit_id 

\"audit_id\":\"2022-12-13T23:07:11Z\"
Source of action pod_name 

"pod_name": "gatekeeper-audit-b7 65495d8-tb4kc"
Outcome msg 

 \"msg\":\"auditing constraints and violations\"
Other fields Not applicable

Finish an audit process

Log schema: Gatekeeper

Fields in the log entry that contain audit information
Audit metadata Audit field name Value
User or service identity Not applicable

Target

(Fields and values that call the API)

 process 

\"process\":\"audit\"

Action

(Fields containing the performed operation)

 event_type 

\"event_type\":\"audit_finished\"
Event timestamp audit_id 

\"audit_id\":\"2022-12-13T23:05:32Z\"
Source of action pod_name 

"pod_name": "gatekeeper-audit-b765495d8-tb4k c"
Outcome msg 

 \"msg\":\"auditing is complete\"
Other fields Not applicable

Audit violation

Log schema:Gatekeeper

Fields in the log entry that contain audit information
Audit metadata Audit field name Value
User or service identity details 

\"details\":{\"missing_labels\":[\"gatekeeper\"]}

Target

(Fields and values that call the API)

 process 

\"process\":\"audit\"

Action

(Fields containing the performed operation)

 event_type 

\"event_type\":\"violation_audited\"
Event timestamp audit_id 

\"audit_id\":\"2022-12-13T23:07:11Z\"
Source of action pod_name 

"pod_name": "gatekeeper-audit-b765495d8-tb4kc"
Outcome msg 

\"msg\":\"you must provide labels: {\\\"gatekeeper\\\"}\"
Other fields Not applicable

Audit constraint

Log schema: Gatekeeper

Fields in the log entry that contain audit information
Audit metadata Audit field name Value
User or service identity constraint_name 

\"constraint_name\":\"ns-must-have-gk\"

Target

(Fields and values that call the API)

 process 

\"process\":\"audit\"

Action

(Fields containing the performed operation)

 event_type 

\"event_type\":\"constraint_audited\"
Event timestamp audit_id 

\"audit_id\":\"2022-12-13T23:07:11Z\"
Source of action pod_name 

"pod_name": "gatekeeper-audit-b 765495d8-tb4kc"
Outcome msg 

\"msg\":\"audit results for constraint\"
Other fields Not applicable

Example log Gatekeeper

{  "stream":"stderr",  "logtag":"F",  "log":"{  \"level\":\"info\",  \"ts\":1670972934.0394588,  \"logger\":\"controller\",  \"msg\":\"audit results for constraint\",  \"process\":\"audit\",  \"audit_id\":\"2022-12-13T23:07:11Z\",  \"event_type\":\"constraint_audited\",  \"constraint_group\":\"constraints.gatekeeper.sh \",  \"constraint_api_version\":\"v1\",  \"constraint_kind\":\"K8sRequiredLabels\",  \"constraint_name\":\"ns-must-have-gk\",  \"constraint_namespace\":\"\",  \"constraint_action\":\"deny\",  \"constraint_status\":\"enforced\",  \"constraint_violations\":\"64\"  }",  "kubernetes":{  "pod_name": "gatekeeper-audit-b 765495d8-tb4kc",  "namespace_name":"gatekeeper-system",  "pod_id":"3c75b257-0917-4575-bb69-ab5eb6f5839d",  "labels":{  "app": "gatekeeper",  "chart": "gatekeeper",  "control-plane":"audit-controller",  "gatekeeper.sh/operation":"audit",  "gatekeeper.sh/system": "yes",  "heritage" : "Helm",  "pod-template-hash": "b765495d 8",  "release":"gatekeeper"  },  "host": "gpc-adhoc-2801b240vm-worker-node2",  "container_name": "manager",  "docker_id":"33f7eb658cb7a17c50ce917dcc727628bc40ea7d160fb1a20d0d61ae4e51b473",  "container_hash": "gcr.io/private-cloud-staging/gatekeeper@sha256:5d91735b2378723a74930cdff2298efeea6f6bebc8ea9dd0106bfdb067f5a07d", "container_image": "gcr.io/private-cloud-staging/gatekeeper: v3.7.0"  },  "_gdch_tenant_id":"infra-obs" }