檢視次數:

GKE 審計日誌可透過雲端 Pub/Sub 獲得。使用 k8saudit-gke Falco 插件。

開始之前

  • Falco 使用 k8saudit-gke 和 json 插件構建。
  • GKE 叢集已啟動 Pub/Sub 存取範圍。
  • 工作負載身份已啟動於叢集上。
注意
注意
GKE 不支援在建立後修改節點群組的存取範圍。如有需要，請建立具有 Pub/Sub 存取權限的新節點群組。

步驟

  1. 建立 GCP 資源。
    # Variables
PROJECT_ID="${your gcp project id}"
TOPIC="${your pub/sub topic}" # example: trendmicro-container-security-audit-log-topic
SUBSCRIPTION="${your pub/sub subscription}" # example: trendmicro-container-security-audit-log-ns4rhmfdse
CLUSTER_NAME="${your gke cluster name}"
SINK_NAME="${your sink name}" # example: trendmicro-container-security-audit-log-sink
SERVICE_ACCOUNT="${your service account name}" # example: trendmicro-audit-sa

# Create Pub/Sub topic and subscription
gcloud pubsub topics create "$TOPIC" --project="$PROJECT_ID"
gcloud pubsub subscriptions create "$SUBSCRIPTION" --topic="$TOPIC" --project="$PROJECT_ID"

# Create service account
gcloud iam service-accounts create "$SERVICE_ACCOUNT" \
  --project="$PROJECT_ID" \
  --display-name="Trendmicro Container Security Audit Log Service Account"

# Grant permissions
gcloud projects add-iam-policy-binding "$PROJECT_ID" \
  --member="serviceAccount:${SERVICE_ACCOUNT}@${PROJECT_ID}.iam.gserviceaccount.com" \
  --role="roles/pubsub.subscriber"

# Bind Workload Identity
gcloud iam service-accounts add-iam-policy-binding \
  "${SERVICE_ACCOUNT}@${PROJECT_ID}.iam.gserviceaccount.com" \
  --project="$PROJECT_ID" \
  --role="roles/iam.workloadIdentityUser" \
  --member="serviceAccount:${PROJECT_ID}.svc.id.goog[trendmicro-system/audit-log-collector-trendmicro-container-security]"

# Create log sink
gcloud logging sinks create "$SINK_NAME" \
  "pubsub.googleapis.com/projects/$PROJECT_ID/topics/$TOPIC" \
  --log-filter="resource.type=\"k8s_cluster\" AND protoPayload.@type=\"type.googleapis.com/google.cloud.audit.AuditLog\" AND resource.labels.cluster_name=\"$CLUSTER_NAME\"" \
  --project="$PROJECT_ID"

# Grant sink writer permissions
WRITER_IDENTITY=$(gcloud logging sinks describe "$SINK_NAME" --project="$PROJECT_ID" --format="value(writerIdentity)")
gcloud pubsub topics add-iam-policy-binding "$TOPIC" \
  --project="$PROJECT_ID" \
  --member="$WRITER_IDENTITY" \
  --role="roles/pubsub.publisher"
  2. 更新 overrides.yaml 以啟用稽核日誌收集。
    visionOne:
    bootstrapToken: ...
    endpoint: ...
    exclusion:
        namespaces: [kube-system]
    ...
auditLogCollection:
    enabled: true
    provider: gke
    gke:
        gcpProjectId: "${gcp project id from step 1}"
        pubSubSubscription: "${pub sub subscription name from step 1}"
        serviceAccount: "${service account name from step 1}"