Auditing

The auditing function of the platform provides you with all the time-ordered operation records related to users and system security. It can assist in analyzing specific reasons and quickly resolving issues when problems occur in clusters, custom applications, etc.

Through auditing, you can clearly understand the changes that have occurred in the Kubernetes cluster, including but not limited to:

• What changes events occurred in the cluster during the current or past time period.

• Who performed these changes, whether it was a system component or a user, and which system component/user it was.

• What are the details of important change events, such as which parameters in the POD were updated.

• What was the result of the event, success or failure.

• Where did the operator come from, inside or outside the cluster.

• User operation records, whether they were updates, deletions, or management operations, and the results of the operations.

Prerequisites

Your account has the relevant permissions for platform management or platform auditing.

Procedure

1. In the left navigation bar, click Auditing.

2. Click the tab to switch the auditing scope, which can be User Operations or System Operations.

   • User Operations: You can query the operation records of users who have logged in to the platform.

   • System Operations: You can query system operation records, and the operator starts with system:.

3. Refer to the following query condition instructions to configure the query conditions for filtering auditing events.

   Query Condition	Description
   Operator	The username or system account name of the account that performed the operation, default is All.
   Actions	Type of operation to be executed, optional: create, update, delete, manage, rollback, stop, etc., default is All.
   Clusters	Cluster to which the operated resource belongs, default is All.
   Resource Type	Type of the operated resource, default is All.
   Resource Name	Name of the operated resource. Can be searched by fuzzy search according to the resource name.

4. Click Search.

   Tip：

   • Click the drop-down box of Time Range to set the time range for auditing. The default is Last 30 Minutes, and you can select a preset time range or customize a time range.

   • Click to refresh the search results.

   • Click to export the search results as a .csv file.

   Parameter	Description
   Operator	Username or system account name of the operator.
   Actions	Type of operation to be executed, such as: create, update, delete, manage, rollback, stop, etc.
   Resource Name/Type	The name and type of the resource being operated on.
   Clusters	The cluster to which the operated resource belongs.
   Namespaces	The namespace to which the operated resource belongs.
   Client IP	The IP address of the client used to log in to execute the operation.
   Operation Result	The result of the operation, determined by the API return code. When the API return code is 2xx, the operation is successful; otherwise, the operation fails.
   Operation Time	The time when the operator performs the operation.
   Details	Click the Details button on the right side of the audit record to view the detailed information of the audit record in the JSON (read-only) area of the Audit Details dialog box.