NTP server workloads (NTP)

Workload location	Root only workloads
Audit log source	Kubernetes audit logs
Audited operations	Data changes

Data changes (CRUD operations)

Fields in the log entry that contain audit information
Audit metadata	Audit field name	Value
User or service identity	`username`	For example, `"user_username": "system:serviceaccount:gpc-system:root-admin-controller-sa"`
Target (Fields and values that call the API)	`requestURI`	`"requestURI":"//apis/system.private.gdc.goog/VERSION/ namespaces/gpc-system/ntpservers/ntp-relay-fhr6t/status"`
Action (Fields containing the performed operation)	`verb`	`"verb":"patch"`
Event timestamp	`requestReceivedTimestamp`	For example, `"requestReceivedTimestamp":2022-12-13T13:48:30.014578Z`
Source of action	`_gdch_service_name`	For example, `"_gdch_service_name": "apiserver"`
Outcome	`responseStatus_code`	For example, `"responseStatus_code":"200"`
Other fields	Not applicable	Not applicable

Example log

{
"_gdch_cluster": "root-admin",
"_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-w5srk",
"_gdch_service_name": "apiserver",
"annotations_authorization_k8s_io_decision":  " allow",
"annotations_authorization_k8s_io_reason RBAC": allowed by ClusterRoleBinding "root-admin-common-controllers-rolebinding" of ClusterRole "root-admin-common-controllers-role" to ServiceAccount "root-admin-controller-sa/gpc-system",
"apiGroup"  :  "system.private.gdc.goog",
"apiVersion":  "audit.k8s.io/v1",
"auditID": 05e72a29-1b18-4db7-9ded-8f51e3a145d8,
"cluster": "root-admin",
"fluentbit_pod":   "anthos-audit-logs-forwarder-w5srk",
"kind": "Event",
  "level": "Metadata",
  "objectRef": {
    "apiGroup": "system.private.gdc.goog",
    "apiVersion": "v1alpha1",
    "name": "ntp-relay-fhr6t",
    "namespace": "gpc-system",
    "resource": "ntpservers",
    "subresource":  "status"
  },
"requestReceivedTimestamp": "2022-12-13T13:48:29.996912Z",
"requestURI": "/apis/system.private.gdc.goog/v1alpha1/namespaces/gpc-system/ntpservers/ntp-relay-fhr6t/status"
"responseStatus": {
    "code": 200,
    "metadata": {},
  },
"service_name": "apiserver",
"stage": "ResponseComplete",
"stageTimestamp": "2022-12-13T13:48:30.014578Z",
"userAgent": "root-admin-cm/v0.0.0 (linux/amd64) kubernetes/$Format",
"user_uid": "c01df74a-a983-44db-8fd3-e0dae87c0796",
"user_username": "system:serviceaccount:gpc-system:root-admin-controller-sa",
"verb": "patch",
"Time" : "1670939310014",
"tsNs": "1670939310014791527"
}