Overview
Kubernetes automates operational tasks of container management and includes built-in commands for deploying applications, rolling out changes to your applications, scaling your applications up and down to fit changing needs, monitoring your applications, and more, making it easier to manage applications.
Prerequisites
- Logsign 6.3.28+ versions support this integration.
Settings
Forwarding settings are completed as follows:
- Log in to the Google Kubernetes portal.
- If there is no project, the project needs to be created first. Click on "New Project" for this.
- Afterwards, IAM API permissions must be granted to the project.
- Click on Create Service Account and create a service account for the related project from the Service Account tab.
- Specify the Service Account details and click on Create and Continue button.
- Determine the permissions of the service account. Mostly viewer authorization is sufficient. If not, editor or owner options are tried.
- If the admin or user roles are to be determined, these are entered as optional, and then click the done button.
- Then go to the Service Accounts tab, click the 3 dots on the relevant service account, and enter the manage keys here.
- Select Create a new key from the Add Key button.
- Select JSON as the key type and press the create button. JSON file is created.
- The information contained in the generated json file is entered in the relevant places when adding a source in the Logsign interface.
Configure On Logsign Unified SecOps Platform
- Login to your Logsign Unified SecOps Platform UI.
- Click Settings > Data Collection > +Device.
- Define the settings as follows:
- Project Id: Define the Project ID from the downloaded JSON key file.
- Client Email: Define the Client Email from the downloaded JSON key file.
- Private Key: Define the Private Key from the downloaded JSON key file.
- Then you can check the source with "Check Connection" and add it.
Important Note: Audit and Kubernetes Engine logs are received with this integration.
Sample Log Examples
{ "protoPayload": { "@type": "type.googleapis.com/google.cloud.audit.AuditLog", "authenticationInfo": { "principalEmail": "xxx@xxx.com.tr" }, "requestMetadata": { "callerIp": "000.000.000.000", "callerSuppliedUserAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36,gzip(gfe),gzip(gfe)", "requestAttributes": {}, "destinationAttributes": {} }, "serviceName": "serviceusage.googleapis.com", "methodName": "google.api.serviceusage.v1.ServiceUsage.EnableService", "authorizationInfo": [ { "resource": "projectnumbers/000000000000/services/container.googleapis.com", "permission": "serviceusage.services.enable", "granted": true, "resourceAttributes": {} }, { "resource": "projectnumbers/0000000000/services/container.googleapis.com", "permission": "serviceusage.services.enable", "granted": true, "resourceAttributes": {} }, { "resource": "services/container.googleapis.com", "permission": "servicemanagement.services.bind", "granted": true, "resourceAttributes": {} } ], "resourceName": "projects/xxx-xx-xx/services/container.googleapis.com", "request": { "name": "projects/xxxxxxxxxx/services/container.googleapis.com", "@type": "type.googleapis.com/google.api.serviceusage.v1.EnableServiceRequest" } }, "insertId": "000aaa000aa", "resource": { "type": "audited_resource", "labels": { "method": "google.api.serviceusage.v1.ServiceUsage.EnableService", "project_id": "xxxxxxx", "service": "serviceusage.googleapis.com" } }, "timestamp": "2022-05-30T04:22:19.131591Z", "severity": "NOTICE", "logName": "projects/xxxxxxx/logs/cloudaudit.googleapis.com%2Factivity", "operation": { "id": "operations/acf.p2-000000000-a0000000-000-408e-0000-0000aaaa", "producer": "serviceusage.googleapis.com", "first": true }, "receiveTimestamp": "2022-05-30T04:22:20.429537955Z" }