{"stage":"ResponseComplete","apiVersion":"audit.k8s.io/v1","objectRef":{"name":"istio-system","apiVersion":"v1","apiGroup":"resourcemanager.gdc.goog","resourceVersion":"7812139","resource":"projects","uid":"7d3a3bb1-a0be-4c5c-980b-f9cd3632f6e3","namespace":"gpc-system"},"requestReceivedTimestamp":"2022-12-22T15:46:41.028873Z","sourceIPs":["10.253.128.178"],"annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"fleet-admin-common-controller\" of ClusterRole \"fleet-admin-common-controllers-role\" to ServiceAccount \"fleet-admin-controller/gpc-system\"","mutation.webhook.admission.k8s.io/round_0_index_5":"{\"configuration\":\"gatekeeper-mutating-webhook-configuration\",\"webhook\":\"mutation.gatekeeper.sh\",\"mutated\":false}"},"_gdch_cluster":"root-admin","_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-t4rld","user":{"uid":"da8e839f-eca4-4a96-9058-94fa4202824f","extra":{"authentication.kubernetes.io/pod-uid":["09335650-82b0-451c-83e2-f8157e9d518c"],"authentication.kubernetes.io/pod-name":["fleet-admin-controller-75dbdf7659-ccfrn"]},"groups":["system:serviceaccounts","system:serviceaccounts:gpc-system","system:authenticated"],"username":"system:serviceaccount:gpc-system:fleet-admin-controller"},"stageTimestamp":"2022-12-22T15:46:41.119767Z","kind":"Event","verb":"update","requestURI":"/apis/resourcemanager.gdc.goog/v1/namespaces/gpc-system/projects/istio-system","responseStatus":{"metadata":{},"code":200},"userAgent":"fleet-admin-cm/v0.0.0 (linux/amd64) kubernetes/$Format","auditID":"5aeaeab6-7371-4b63-8355-b4469e1440bb","level":"Metadata","_gdch_service_name":"apiserver","_gdch_tenant_id":"infra-obs"}
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-29 UTC."],[[["\u003cp\u003eThe audit logs for root and organization workloads are sourced from Kubernetes audit logs, providing detailed information on actions and changes within the system.\u003c/p\u003e\n"],["\u003cp\u003eThe KRM API Management Plane Audit Logs include logs for Project operations, detailing information about user or service identities, target resources, performed actions, timestamps, sources, and outcomes.\u003c/p\u003e\n"],["\u003cp\u003eKRM API Management Plane Audit Logs also cover Project RBAC, including logs for ProjectRole and ProjectRoleBinding operations, similar to the projects, they contain information on the user identity, targeted resources, actions, and source.\u003c/p\u003e\n"],["\u003cp\u003eThe different fields within each log entry provide a comprehensive overview of the audited events, such as the identity of the user or service performing the action (\u003ccode\u003eusername\u003c/code\u003e), the API target (\u003ccode\u003erequestURI\u003c/code\u003e), the action performed (\u003ccode\u003everb\u003c/code\u003e), and the event timestamp (\u003ccode\u003erequestReceivedTimestamp\u003c/code\u003e).\u003c/p\u003e\n"],["\u003cp\u003eEach log entry includes an example of what can be expected within it, including the format and potential data points, which gives a better picture of how the logs are presented.\u003c/p\u003e\n"]]],[],null,["# Resource Manager (RM)\n\nKRM API Management Plane Audit Logs (Project)\n---------------------------------------------\n\n**Example log** \n\n {\n \"stage\": \"ResponseComplete\",\n \"apiVersion\": \"audit.k8s.io/v1\",\n \"objectRef\": {\n \"name\": \"istio-system\",\n \"apiVersion\": \"v1\",\n \"apiGroup\": \"resourcemanager.gdc.goog\",\n \"resourceVersion\": \"7812139\",\n \"resource\": \"projects\",\n \"uid\": \"7d3a3bb1-a0be-4c5c-980b-f9cd3632f6e3\",\n \"namespace\": \"gpc-system\"\n },\n \"requestReceivedTimestamp\": \"2022-12-22T15:46:41.028873Z\",\n \"sourceIPs\": [\n \"10.253.128.178\"\n ],\n \"annotations\": {\n \"authorization.k8s.io/decision\": \"allow\",\n \"authorization.k8s.io/reason\": \"RBAC: allowed by ClusterRoleBinding \\\"fleet-admin-common-controller\\\" of ClusterRole \\\"fleet-admin-common-controllers-role\\\" to ServiceAccount \\\"fleet-admin-controller/gpc-system\\\"\",\n \"mutation.webhook.admission.k8s.io/round_0_index_5\": \"{\\\"configuration\\\":\\\"gatekeeper-mutating-webhook-configuration\\\",\\\"webhook\\\":\\\"mutation.gatekeeper.sh\\\",\\\"mutated\\\":false}\"\n },\n \"_gdch_cluster\": \"root-admin\",\n \"_gdch_fluentbit_pod\": \"anthos-audit-logs-forwarder-t4rld\",\n \"user\": {\n \"uid\": \"da8e839f-eca4-4a96-9058-94fa4202824f\",\n \"extra\": {\n \"authentication.kubernetes.io/pod-uid\": [\n \"09335650-82b0-451c-83e2-f8157e9d518c\"\n ],\n \"authentication.kubernetes.io/pod-name\": [\n \"fleet-admin-controller-75dbdf7659-ccfrn\"\n ]\n },\n \"groups\": [\n \"system:serviceaccounts\",\n \"system:serviceaccounts:gpc-system\",\n \"system:authenticated\"\n ],\n \"username\": \"system:serviceaccount:gpc-system:fleet-admin-controller\"\n },\n \"stageTimestamp\": \"2022-12-22T15:46:41.119767Z\",\n \"kind\": \"Event\",\n \"verb\": \"update\",\n \"requestURI\": \"/apis/resourcemanager.gdc.goog/v1/namespaces/gpc-system/projects/istio-system\",\n \"responseStatus\": {\n \"metadata\": {},\n \"code\": 200\n },\n \"userAgent\": \"fleet-admin-cm/v0.0.0 (linux/amd64) kubernetes/$Format\",\n \"auditID\": \"5aeaeab6-7371-4b63-8355-b4469e1440bb\",\n \"level\": \"Metadata\",\n \"_gdch_service_name\": \"apiserver\",\n \"_gdch_tenant_id\": \"infra-obs\"\n }"]]
