Copy page

Google

GKE Audit Logs

Ingests Kubernetes audit logs from Google Kubernetes Engine (GKE) clusters via Cloud Logging. This connector automatically filters and collects audit events from your GKE cluster's control plane.

Sync Type: Incremental

Requirements

Before setting up the GKE Audit Logs input, you need to:

1. Have a Google Cloud Platform (GCP) account with access to a GKE cluster.
2. Have the GKE cluster with audit logging enabled:
   • Admin Activity Logs (enabled by default)
   • Data Access Logs (must be explicitly enabled if needed)
3. Create a GCP service account with the necessary permissions.
4. Generate a JSON key for the service account.

Enabling GKE Audit Logging

To ensure your GKE cluster is properly configured for audit log collection:

1. Verify Admin Activity Logs are enabled (default):

   • Most GKE clusters have Admin Activity audit logging enabled by default
   • This captures administrative actions like cluster creation, workload deployments, etc.

2. Enable Data Access Logs (if needed):

   • Go to Google Cloud Console
   • Navigate to "IAM & Admin" > "Audit Logs"
   • Find the relevant services (e.g., Kubernetes Engine API)
   • Enable "Data Access" logging if you need to audit read-only operations

Details

The GKE Audit Logs input wraps the Google Cloud Logs connector and automatically:

• Filters logs to your specific GKE cluster using the cluster name and location
• Enables proto payload parsing to properly decode Kubernetes audit log entries (AuditLog protobuf format)
• Tracks state using the log entry timestamps to implement incremental synchronization
• Only fetches logs created after the last successful sync

The connector translates your GKE configuration into a Cloud Logs filter that targets:

• Resource type: k8s_cluster
• Cluster name: your specified cluster name
• Location: your cluster's region or zone

Incremental Sync

Monad tracks the timestamp of the last successfully processed audit log and only fetches newer events on subsequent runs.

Configuration

Settings

Setting	Type	Required	Description
Project ID	string	Yes	The GCP project ID that contains the GKE cluster.
Cluster Name	string	Yes	The name of the GKE cluster. Used to filter audit logs to this specific cluster.
Location	string	Yes	The GCP region or zone where the GKE cluster runs (e.g., us-central1 or us-central1-a).

Secrets

Secret	Type	Required	Description
Credentials JSON	string	Yes	GCP service account JSON key with roles/logging.viewer on the project.

Setting up the Service Account

1. Go to the Google Cloud Console.
2. Select your project from the project dropdown at the top of the page.
3. Navigate to "IAM & Admin" > "Service Accounts".
4. Click "Create Service Account".
5. Enter a name for the service account (e.g., "gke-audit-logs") and click "Create".
6. Assign the following role to the service account:
   • Logs Viewer (roles/logging.viewer)
7. Click "Continue" and then "Done".
8. Find the newly created service account in the list and click on it.
9. Go to the "Keys" tab and click "Add Key" > "Create new key".
10. Choose JSON as the key type and click "Create".
11. Save the downloaded JSON key file securely.

Setting up the Input

1. In the Monad UI, go to the "Inputs" section.
2. Click "Add Input" and select "GKE Audit Logs".
3. Configure the input settings:
   • Project ID: Your GCP project ID (e.g., my-gcp-project)
   • Cluster Name: The name of your GKE cluster (e.g., my-gke-cluster)
   • Location: The region or zone where your cluster runs (e.g., us-central1 or us-central1-a)
4. In the "Secrets" section, paste the contents of your service account JSON key file.
5. Test the connection to verify everything is configured correctly.

Rate Limits

GKE Audit Logs are subject to Google Cloud Logging API rate limits. The exact limits depend on your GCP billing account tier.

Limit Type	Limit	Notes
Read requests per minute	Up to 60	Per project
Data ingestion	Unlimited	Logs are retained according to your sink configuration

For more information on Cloud Logging quotas, see Google Cloud Logging Quotas and Limits.

Related Articles

• GKE Audit Logging Documentation
• Google Cloud Logging Documentation
• Logging Query Language
• Cloud Logging API Reference
• Kubernetes Audit Log Documentation