1

according to the documentation there are three kind of audit: Admin Activity audit logs, System Event logs and Data Access audit logs.

which kind of logs GKE cluster is being generated? its not clear for me. i would like to understand what will be the pricing

https://cloud.google.com/stackdriver/pricing

inza
  • 97
  • 2
  • 10

1 Answers1

0

As per documentation:

  1. Admin activity logs - those are enabled by default at no cost
    • k8s_cluster - Log entries written by the Kubernetes API server apply to the k8s_cluster resource type. These log entries describe operations on Kubernetes resources in your cluster, for example, Pods, Deployments, and Secrets. 
    logName="projects/[PROJECT_ID]/logs/cloudaudit.googleapis.com%2Factivity"
protoPayload.serviceName="k8s.io"
    • gke_cluster - Log entries written by the Kubernetes Engine API server apply to the gke_cluster resource. These log entries describe operations like cluster creation and deletion.
    logName="projects/[PROJECT_ID]/logs/cloudaudit.googleapis.com%2Factivity"
protoPayload.serviceName="gke_cluster"
  2. Data access logs - Data Access audit logs contain API calls that read the configuration or metadata of resources, as well as user-driven API calls that create, modify, or read user-provided resource data. Data Access audit logs do not record the data-access operations on resources that are publicly shared (available to All Users or All Authenticated Users) or that can be accessed without logging into Google Cloud. Data access logs are something that can log very extensively depending on the configuration. Those you need to enable yourself, may be billed according to Quotas.

There are 3 kinds of operations, you choose which you want to log:

  • ADMIN_READ: Records operations that read metadata or configuration information.
  • DATA_READ: Records operations that read user-provided data (eg. CRD).
  • DATA_WRITE: Records operations that write user-provided data (eg. CRD).
resource.type="k8s_cluster"
logName="projects/my-project/logs/cloudaudit.googleapis.com%2Fdata_access"

For most projects Admin activity logs is enough. If you need to log what type of resources which service / user access then you should enable Data Access logs.

More here GKE Audit logs

lukaszberwid
  • 1,097
  • 7
  • 19
  • thanks! what do you mean by "user-provided resource data"? i still dont understand the main different between them. Does "Admin logs" is only for objects creation and "data logs" if only for their configuration? – inza Mar 08 '20 at 09:39
  • I've updated my post, admin logs are create/modify/delete operations on gke resources and data access logs could be everything like reading config to creating new custom resource definition – lukaszberwid Mar 09 '20 at 15:58