# GKE Audit Logs

Ingests Kubernetes audit logs from Google Kubernetes Engine (GKE) clusters via Cloud Logging. This connector automatically filters and collects audit events from your GKE cluster's control plane.

**Sync Type: Incremental**

## Requirements

Before setting up the GKE Audit Logs input, you need to:

1. Have a Google Cloud Platform (GCP) account with access to a GKE cluster.
2. Have the GKE cluster with audit logging enabled:
   - **Admin Activity Logs** (enabled by default)
   - **Data Access Logs** (must be explicitly enabled if needed)
3. Create a GCP service account with the necessary permissions.
4. Generate a JSON key for the service account.

## Enabling GKE Audit Logging

To ensure your GKE cluster is properly configured for audit log collection:

1. **Verify Admin Activity Logs are enabled** (default):
   - Most GKE clusters have Admin Activity audit logging enabled by default
   - This captures administrative actions like cluster creation, workload deployments, etc.

2. **Enable Data Access Logs (if needed)**:
   - Go to [Google Cloud Console](https://console.cloud.google.com/)
   - Navigate to "IAM & Admin" > "Audit Logs"
   - Find the relevant services (e.g., Kubernetes Engine API)
   - Enable "Data Access" logging if you need to audit read-only operations

## Details

The GKE Audit Logs input wraps the Google Cloud Logs connector and automatically:

- Filters logs to your specific GKE cluster using the cluster name and location
- Enables proto payload parsing to properly decode Kubernetes audit log entries (AuditLog protobuf format)
- Tracks state using the log entry timestamps to implement incremental synchronization
- Only fetches logs created after the last successful sync

The connector translates your GKE configuration into a Cloud Logs filter that targets:
- Resource type: `k8s_cluster`
- Cluster name: your specified cluster name
- Location: your cluster's region or zone

### Incremental Sync

Monad tracks the timestamp of the last successfully processed audit log and only fetches newer events on subsequent runs.

## Configuration

### Settings

| Setting | Type | Required | Description |
|---------|------|----------|-------------|
| Project ID | string | Yes | The GCP project ID that contains the GKE cluster. |
| Cluster Name | string | Yes | The name of the GKE cluster. Used to filter audit logs to this specific cluster. |
| Location | string | Yes | The GCP region or zone where the GKE cluster runs (e.g., `us-central1` or `us-central1-a`). |

### Secrets

| Secret | Type | Required | Description |
|--------|------|----------|-------------|
| Credentials JSON | string | Yes | GCP service account JSON key with `roles/logging.viewer` on the project. |

## Setting up the Service Account

1. Go to the [Google Cloud Console](https://console.cloud.google.com/).
2. Select your project from the project dropdown at the top of the page.
3. Navigate to "IAM & Admin" > "Service Accounts".
4. Click "Create Service Account".
5. Enter a name for the service account (e.g., "gke-audit-logs") and click "Create".
6. Assign the following role to the service account:
   - **Logs Viewer** (`roles/logging.viewer`)
7. Click "Continue" and then "Done".
8. Find the newly created service account in the list and click on it.
9. Go to the "Keys" tab and click "Add Key" > "Create new key".
10. Choose JSON as the key type and click "Create".
11. Save the downloaded JSON key file securely.

## Setting up the Input

1. In the Monad UI, go to the "Inputs" section.
2. Click "Add Input" and select "GKE Audit Logs".
3. Configure the input settings:
   - **Project ID**: Your GCP project ID (e.g., `my-gcp-project`)
   - **Cluster Name**: The name of your GKE cluster (e.g., `my-gke-cluster`)
   - **Location**: The region or zone where your cluster runs (e.g., `us-central1` or `us-central1-a`)
4. In the "Secrets" section, paste the contents of your service account JSON key file.
5. Test the connection to verify everything is configured correctly.

## Rate Limits

GKE Audit Logs are subject to Google Cloud Logging API rate limits. The exact limits depend on your GCP billing account tier.

| Limit Type | Limit | Notes |
|-----------|-------|-------|
| Read requests per minute | Up to 60 | Per project |
| Data ingestion | Unlimited | Logs are retained according to your sink configuration |

For more information on Cloud Logging quotas, see [Google Cloud Logging Quotas and Limits](https://cloud.google.com/logging/quotas).

## Related Articles

- [GKE Audit Logging Documentation](https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging)
- [Google Cloud Logging Documentation](https://cloud.google.com/logging/docs)
- [Logging Query Language](https://cloud.google.com/logging/docs/view/logging-query-language)
- [Cloud Logging API Reference](https://cloud.google.com/logging/docs/reference/v2/rest)
- [Kubernetes Audit Log Documentation](https://kubernetes.io/docs/tasks/debug-application-cluster/audit/)