How to debug ABAC to RBAC transition in a GKE kubernetes cluster?

Question

Where does GKE log RBAC permission events?

On Google Container Engine (GKE) clusters with kubernetes version v1.6 enable RBAC authorization per default. Apparently ABAC is enabled as fallback authorization as well in order to ease the transition of existing clusters to the new authorization scheme. The idea is that first RBAC is tried to authorize an action. If that fails , this should be logged somewhere and then ABAC is consulted to allow the action. This should enabled cluster admins to inspect the logs for missed RBAC permissions before finally switching off ABAC.

We have some clusters that disable GCP logging/monitoring, instead use an own ELK stack. Just to be sure I've created a test cluster with GCP's cloud logging and monitoring, but still can's find any RBAC events anywhere. The test pod is a prometheus server that discovers and scrapes other pods and nodes.

Answer 1

To make this more comprehensive. From Using RBAC Authorization :

When run with a log level of 2 or higher (--v=2), you can see RBAC denials in the apiserver log (prefixed with RBAC DENY:).

In GKE the apiservers logs can be accessed via HTTP like:

kubectl proxy &
curl -s http://localhost:8001/logs/kube-apiserver.log

Answer 2

RBAC拒绝将记录到主apiserver日志中。