在 GKE 中配置审计

Question

How to pass on my own kube.netes audit policy yaml to the GKE master node?

For self-managed kube.netes, we can ssh into master node and pass the policy yaml into /etc/kube.netes/manifests/kube-apiserver.yaml . How could we achieve the same in GKE?

Answer 1

For creating or updating an audit policy you have to set --audit-policy-file flag and --audit-webhook-config-file flags as arguments in the API server.

Google manages GKE master completely and you cannot reach it or update it.Currently, it's impossible to update cluster.networks and remove tags for existing clusters using the gcloud command. I have verified this information using the gcloud container clusters update command documentation .

Instead you can filter the audit logs in the Cloud Console, the Logs page has two filtering interfaces: basic and advanced. For information about the two filtering interfaces, see Logs Viewer filter interfaces .

There is a feature request on it, check it and raise a new request if you need it by using the issue tracker .