kubernetes 如何找到GKE的控制面板日志?

ix0qys7i  于 2022-12-11  发布在  Kubernetes
关注(0)|答案(3)|浏览(143)

So there's this page about auditing-logs and I'm very confused about:
The k8s.io service is used for Kubernetes audit logs. These logs are generated by the Kubernetes API Server component and they contain information about actions performed using the Kubernetes API. For example, any changes you make on a Kubernetes resource by using the kubectl command are recorded by the k8s.io service. For more information, see Auditing in the Kubernetes documentation.
The container.googleapis.com service is used for GKE control plane audit logs. These logs are generated by the GKE internal components and they contain information about actions performed using the GKE API. For example, any changes you perform on a GKE cluster configuration using a gcloud command are recorded by the container.googleapis.com service.
which one shall I pick to get:

  1. /var/log/kube-apiserver.log - API Server, responsible for serving the API
  2. /var/log/kube-controller-manager.log - Controller that manages replication controllers
    or these are all similar to EKS where audit logs means a separate thing ?
    Audit (audit) – Kubernetes audit logs provide a record of the individual users, administrators, or system components that have affected your cluster. For more information, see Auditing in the Kubernetes documentation.
w9apscun

w9apscun1#

如果集群仍然存在,您应该能够在GKE上执行以下操作

kubectl proxy
curl http://localhost:8001/logs/kube-apiserver.log

AFAIK,无法获取已删除群集的服务器日志。

yv5phkfx

yv5phkfx2#

你不能。GKE不提供它们。审计日志是不同的,那些是API操作的记录。

6gpjuf90

6gpjuf903#

Logs for GKE control-plane components are available since November 29, 2022 for clusters with versions 1.22.0 and later.
You simply need to activate it on the clusters. Either via CLI:

gcloud container clusters update [CLUSTER_NAME] \
      --region=[REGION] \
      --monitoring=SYSTEM,WORKLOAD,API_SERVER,SCHEDULER,CONTROLLER_MANAGER

or in web-console under "Features -> Cloud Logging" (as usual). See documentation .

Note the notes in the solutions documentation, especially about reaching the logging.googleapis.com/write_requests quota ( quick link ).

相关问题