主页 / server / 问题 / 1138596
Accepted
Michael Cab
Asked: 2023-07-22 22:33:26 +0800 CST

跟踪 pod 中的 kubernetes 用户活动

  • 772

我想跟踪 k8s 集群中的用户活动。例如，我想获取在 pod 中执行命令的用户的 k8s 用户名。有一个工具叫Tetragon。它可以使用k8s api。以下日志是 k8s 集群上 Tetragon 的示例输出：

    {
  "process_exec": {
    "process": {
      "exec_id": "bWluaWt1YmU6NzAyMDQ2ODIyNTEwNDg6MTE5MDk1MQ==",
      "pid": 1190951,
      "uid": 0,
      "cwd": "/",
      "binary": "/bin/sh",
      "arguments": "-c \"sleep 60m\"",
      "flags": "execve rootcwd clone",
      "start_time": "2023-07-22T13:37:01.382355175Z",
      "auid": 4294967295,
      "pod": {
        "namespace": "default",
        "name": "alpine-59dcb54bd-l7dtv",
        "container": {
          "id": "docker://767327faa6bc703188e434b74e80ed29f14973556b4411060674056cf9b305d6",
          "name": "alpine",
          "image": {
            "id": "docker-pullable://alpine@sha256:82d1e9d7ed48a7523bdebc18cf6290bdb97b82302a8a9c27d4fe885949ea94d1",
            "name": "alpine:latest"
          },
          "start_time": "2023-07-22T13:37:01Z",
          "pid": 1
        },
        "pod_labels": {
          "pod-template-hash": "59dcb54bd",
          "run": "alpine"
        }
      },
      "docker": "767327faa6bc703188e434b74e80ed2",
      "parent_exec_id": "bWluaWt1YmU6NzAyMDQ1NTgzNDYxOTA6MTE5MDkzMQ==",
      "refcnt": 1,
      "tid": 1190951
    },
    "parent": {
      "exec_id": "bWluaWt1YmU6NzAyMDQ1NTgzNDYxOTA6MTE5MDkzMQ==",
      "pid": 1190931,
      "uid": 0,
      "cwd": "/run/containerd/io.containerd.runtime.v2.task/moby/767327faa6bc703188e434b74e80ed29f14973556b4411060674056cf9b305d6",
      "binary": "/usr/bin/containerd-shim-runc-v2",
      "arguments": "-namespace moby -id 767327faa6bc703188e434b74e80ed29f14973556b4411060674056cf9b305d6 -address /run/containerd/containerd.sock",
      "flags": "execve clone",
      "start_time": "2023-07-22T13:37:01.258449828Z",
      "auid": 4294967295,
      "parent_exec_id": "bWluaWt1YmU6NzAyMDQ1NTAyNzk4MDM6MTE5MDkyNA==",
      "tid": 1190931
    }
  },
  "node_name": "minikube",
  "time": "2023-07-22T13:37:01.382358135Z"
}

现在我想让用户的 k8s 用户名执行此命令。例如我想在上面的 json 中有一个字段，例如：

username: minikube-user

有人有想法吗？

logging

1 个回答

  1. Best Answer

    这是与此处类似的问题https://stackoverflow.com/questions/76699854/log-k8s-users-that-execute-commands-in-pods。

    本质上，您需要做的是将 k8s 审核日志与有关执行的 Tetragon 日志关联起来。使用 k8s 元数据 Tetragon 添加事件（pod 名称、容器 ID 等）和日期，您应该能够检索谁在 k8s 用户级别执行了操作。

    您在示例中显示的事件部分：

    "pod": {
  "namespace": "default",
  "name": "alpine-59dcb54bd-l7dtv",
  "container": {
    "id": "docker://767327faa6bc703188e434b74e80ed29f14973556b4411060674056cf9b305d6",
    "name": "alpine",
    "image": {
      "id": "docker-pullable://alpine@sha256:82d1e9d7ed48a7523bdebc18cf6290bdb97b82302a8a9c27d4fe885949ea94d1",
      "name": "alpine:latest"
    },
    "start_time": "2023-07-22T13:37:01Z",
    "pid": 1
  },
  "pod_labels": {
    "pod-template-hash": "59dcb54bd",
    "run": "alpine"
}

    应该为您提供足够的上下文来浏览和关联 k8s 审核日志。

    • 0

相关问题