Copy page

System Logs

Google GKE Audit Logs

Ingests Kubernetes audit logs from Google Kubernetes Engine (GKE) clusters via Cloud Logging. This connector automatically filters and collects audit events from your GKE cluster's control plane.

Sync Type: Incremental

Requirements

Before setting up the GKE Audit Logs input, you need to:

1. Have a Google Cloud Platform (GCP) account with access to a GKE cluster.
2. Have the GKE cluster with audit logging enabled:
   • Admin Activity Logs (enabled by default)
   • Data Access Logs (must be explicitly enabled if needed)
3. Create a GCP service account with the necessary permissions.
4. Generate a JSON key for the service account.

Enabling GKE Audit Logging

To ensure your GKE cluster is properly configured for audit log collection:

1. Verify Admin Activity Logs are enabled (default):

   • Most GKE clusters have Admin Activity audit logging enabled by default
   • This captures administrative actions like cluster creation, workload deployments, etc.

2. Enable Data Access Logs (if needed):

   • Go to Google Cloud Console
   • Navigate to "IAM & Admin" > "Audit Logs"
   • Find the relevant services (e.g., Kubernetes Engine API)
   • Enable "Data Access" logging if you need to audit read-only operations

Details

The GKE Audit Logs input wraps the Google Cloud Logs connector and automatically:

• Filters logs to your specific GKE cluster using the cluster name and location; this matches every k8s_cluster log name for the cluster, so non-audit logs such as Kubernetes events are ingested too
• Enables proto payload parsing to properly decode Kubernetes audit log entries (AuditLog protobuf format)
• Tracks state using each entry's receive time (receiveTimestamp) to implement incremental synchronization
• Only fetches entries received after the last successful sync; on the first run it starts about 2 minutes behind the current time and does not read history (there is no backfill setting)

The connector translates your GKE configuration into a Cloud Logs filter that targets:

• Resource type: k8s_cluster
• Cluster name: your specified cluster name
• Location: your cluster's region or zone

Incremental Sync

Monad tracks each entry's receive time (receiveTimestamp) and only fetches newer entries on subsequent runs. To account for Cloud Logging's ingestion latency, reads trail the current time by about 2 minutes so late-arriving entries settle before they are read; records are therefore delivered roughly 2 minutes after Google ingests them.

Record format

Records use the Cloud Logs connector's encoding: snake_case keys, timestamp as {seconds, nanos}, numeric severity, and the decoded Kubernetes audit payload under Payload.ProtoPayload.value. See the Cloud Logs sample record for the full shape.

Configuration

Settings

Setting	Type	Required	Default	Description
project_id	string	Yes	-	The GCP project ID that contains the GKE cluster.
cluster_name	string	Yes	-	The name of the GKE cluster. Used to filter audit logs to this specific cluster.
location	string	Yes	-	The GCP region or zone where the GKE cluster runs, e.g. us-central1 or us-central1-a.

Secrets

Secret	Type	Required	Description
credentials_json	secret	No	JSON credentials to authenticate with Google Cloud (required for service account auth).

Setting up the Service Account

1. Go to the Google Cloud Console.
2. Select your project from the project dropdown at the top of the page.
3. Navigate to "IAM & Admin" > "Service Accounts".
4. Click "Create Service Account".
5. Enter a name for the service account (e.g., "gke-audit-logs") and click "Create".
6. Assign the following role to the service account:
   • Logs Viewer (roles/logging.viewer)
   • If you enabled Data Access logs, also grant Private Logs Viewer (roles/logging.privateLogViewer); without it Data Access entries are silently absent.
7. Click "Continue" and then "Done".
8. Find the newly created service account in the list and click on it.
9. Go to the "Keys" tab and click "Add Key" > "Create new key".
10. Choose JSON as the key type and click "Create".
11. Save the downloaded JSON key file securely.

Setting up the Input

1. In the Monad UI, go to the "Inputs" section.
2. Click "Add Input" and select "GKE Audit Logs".
3. Configure the input settings:
   • Project ID: Your GCP project ID (e.g., my-gcp-project)
   • Cluster Name: The name of your GKE cluster (e.g., my-gke-cluster)
   • Location: The region or zone where your cluster runs (e.g., us-central1 or us-central1-a)
4. In the "Secrets" section, paste the contents of your service account JSON key file.
5. Test the connection to verify everything is configured correctly.

Rate Limits

This connector reads from the Cloud Logging API, which returns up to 60,000 log entries per minute per project; beyond that, entries can lag or be dropped. For high-volume collection, route logs through Pub/Sub instead (see the callout at the top of this page). See Cloud Logging quotas and limits for details.

Related Articles

• GKE Audit Logging Documentation
• Google Cloud Logging Documentation
• Logging Query Language
• Cloud Logging API Reference
• Kubernetes Audit Log Documentation

Sync frequency

By default this input polls approximately every 10 seconds, with each sync beginning after the previous one completes. A cron schedule configured on the pipeline overrides this cadence. See Input Sync Frequency for details.