How can I find GKE's control plane logs?

Question

So there's this page about auditing-logs and I'm very confused about:

The k8s.io service is used for Kube.netes audit logs. These logs are generated by the Kube.netes API Server component and they contain information about actions performed using the Kube.netes API. For example, any changes you make on a Kube.netes resource by using the kubectl command are recorded by the k8s.io service. For more information, see Auditing in the Kube.netes documentation.

The container.googleapis.com service is used for GKE control plane audit logs. These logs are generated by the GKE internal components and they contain information about actions performed using the GKE API. For example, any changes you perform on a GKE cluster configuration using a gcloud command are recorded by the container.googleapis.com service.

which one shall I pick to get:

1. /var/log/kube-apiserver.log - API Server, responsible for serving the API
2. /var/log/kube-controller-manager.log - Controller that manages replication controllers

or these are all similar to EKS where audit logs means a separate thing ?

Audit (audit) – Kube.netes audit logs provide a record of the individual users, administrators, or system components that have affected your cluster. For more information, see Auditing in the Kube.netes documentation.

Answer 1

You cannot. GKE does not make them available. Audit logs are different, those are a record of API actions.

Answer 2

If the cluster still exists, you should be able to do the following on GKE

kubectl proxy
curl http://localhost:8001/logs/kube-apiserver.log

AFAIK, there's no way to get server logs for clusters that have been deleted.

Answer 3

Logs for GKE control-plane components are available since November 29, 2022 for clusters with versions 1.22.0 and later.

You simply need to activate it on the clusters. Either via CLI:

gcloud container clusters update [CLUSTER_NAME] \
      --region=[REGION] \
      --monitoring=SYSTEM,WORKLOAD,API_SERVER,SCHEDULER,CONTROLLER_MANAGER

or in web-console under "Features -> Cloud Logging" (as usual). See documentation .

Note the notes in the solutions documentation , especially about reaching the logging.googleapis.com/write_requests quota ( quick link ).