Cluster logging 6.1.5 on OCP 4.17 with GCP CSV and Pods: ``` [root@rdr-man-417log-bastion-0 ~]# oc get csv -n openshift-logging NAME DISPLAY VERSION REPLACES PHASE cluster-logging.v6.1.5 Red Hat OpenShift Logging 6.1.5 cluster-logging.v6.1.4 Succeeded loki-operator.v6.1.5 Loki Operator 6.1.5 loki-operator.v6.1.4 Succeeded [root@rdr-man-417log-bastion-0 ~]# [root@rdr-man-417log-bastion-0 ~]# oc get pods -n openshift-logging NAME READY STATUS RESTARTS AGE cluster-logging-operator-54495875c6-5zlrt 1/1 Running 0 64m instance-fbgvq 1/1 Running 0 6s instance-nf8zr 1/1 Running 0 6s instance-rcz59 1/1 Running 0 6s instance-z5zd9 1/1 Running 0 6s instance-zhpr5 1/1 Running 0 6s lokistack-cauvp-compactor-0 1/1 Running 0 62m lokistack-cauvp-distributor-69d897b8b-84vvl 1/1 Running 0 62m lokistack-cauvp-gateway-77b4cf84cd-f6vkc 2/2 Running 0 62m lokistack-cauvp-gateway-77b4cf84cd-ggzf2 2/2 Running 0 62m lokistack-cauvp-index-gateway-0 1/1 Running 0 62m lokistack-cauvp-ingester-0 1/1 Running 0 62m lokistack-cauvp-querier-694767cdff-m2wfg 1/1 Running 0 62m lokistack-cauvp-query-frontend-765577645c-rwgnj 1/1 Running 0 62m lokistack-cauvp-ruler-0 1/1 Running 0 62m ``` Cluster logging: Application logs: ``` { "insertId": "1fw7jtg1119prz", "jsonPayload": { "@timestamp": "2025-04-16T11:25:50.017519941Z", "hostname": "worker-1", "kubernetes": { "annotations": { "k8s.ovn.org/pod-networks": "{\"default\":{\"ip_addresses\":[\"10.131.0.209/23\"],\"mac_address\":\"0a:58:0a:83:00:d1\",\"gateway_ips\":[\"10.131.0.1\"],\"routes\":[{\"dest\":\"10.128.0.0/14\",\"nextHop\":\"10.131.0.1\"},{\"dest\":\"172.30.0.0/16\",\"nextHop\":\"10.131.0.1\"},{\"dest\":\"169.254.0.5/32\",\"nextHop\":\"10.131.0.1\"},{\"dest\":\"100.64.0.0/16\",\"nextHop\":\"10.131.0.1\"}],\"ip_address\":\"10.131.0.209/23\",\"gateway_ip\":\"10.131.0.1\",\"role\":\"primary\"}}", "k8s.v1.cni.cncf.io/network-status": "[{\n \"name\": \"ovn-kubernetes\",\n \"interface\": \"eth0\",\n \"ips\": [\n \"10.131.0.209\"\n ],\n \"mac\": \"0a:58:0a:83:00:d1\",\n \"default\": true,\n \"dns\": {}\n}]", "openshift.io/scc": "restricted-v2", "seccomp.security.alpha.kubernetes.io/pod": "runtime/default" }, "container_id": "cri-o://b0eb4465735ba3a0b94cc3358d15e3e9d5e21a225d4173f94a0e3e67369e20e2", "container_image": "quay.io/pravin_dsilva/centos:logtest", "container_image_id": "quay.io/pravin_dsilva/centos@sha256:38b54ceb7e1963086aa531fb5462b271939c2bb7a3868bfe67a9a0721a910912", "container_iostream": "stdout", "container_name": "centos-logtest", "labels": { "run": "centos-logtest", "test": "centos-logtest" }, "namespace_id": "5ff1c951-ba64-4e3f-be3e-d57653eb21ca", "namespace_labels": { "kubernetes_io_metadata_name": "test-logging", "pod-security_kubernetes_io_audit": "restricted", "pod-security_kubernetes_io_audit-version": "latest", "pod-security_kubernetes_io_warn": "restricted", "pod-security_kubernetes_io_warn-version": "latest" }, "namespace_name": "test-logging", "pod_id": "e2733665-3ee5-4ab6-a6eb-ba974c487acd", "pod_ip": "10.131.0.209", "pod_name": "centos-logtest-mncq9", "pod_owner": "ReplicationController/centos-logtest" }, "log_source": "container", "log_type": "application", "message": "{\"message\": \"MERGE_JSON_LOG=true\", \"level\": \"debug\",\"Layer1\": \"layer1 0\", \"layer2\": {\"name\":\"Layer2 1\", \"tips\":\"Decide by PRESERVE_JSON_LOG\"}, \"StringNumber\":\"10\", \"Number\": 10,\"foo.bar\":\"Dot Item\",\"{foobar}\":\"Brace Item\",\"[foobar]\":\"Bracket Item\", \"foo:bar\":\"Colon Item\",\"foo bar\":\"Space Item\" }", "openshift": { "cluster_id": "d0057771-8074-494e-aee9-f33601c7f37c", "labels": { "label": "6.1_417-app" }, "sequence": 1.744802750117977e+18 } }, "logName": "projects/hidden-bond-335716/logs/aosqe-logging-app", "receiveTimestamp": "2025-04-16T11:25:51.136269889Z", "resource": { "labels": { "cluster_name": "", "location": "", "node_name": "worker-1", "project_id": "hidden-bond-335716" }, "type": "k8s_node" }, "timestamp": "2025-04-16T11:25:51.136269889Z" }, { "insertId": "1ml380lfz6ruhj", "jsonPayload": { "@timestamp": "2025-04-16T11:25:49.016257583Z", "hostname": "worker-1", "kubernetes": { "annotations": { "k8s.ovn.org/pod-networks": "{\"default\":{\"ip_addresses\":[\"10.131.0.209/23\"],\"mac_address\":\"0a:58:0a:83:00:d1\",\"gateway_ips\":[\"10.131.0.1\"],\"routes\":[{\"dest\":\"10.128.0.0/14\",\"nextHop\":\"10.131.0.1\"},{\"dest\":\"172.30.0.0/16\",\"nextHop\":\"10.131.0.1\"},{\"dest\":\"169.254.0.5/32\",\"nextHop\":\"10.131.0.1\"},{\"dest\":\"100.64.0.0/16\",\"nextHop\":\"10.131.0.1\"}],\"ip_address\":\"10.131.0.209/23\",\"gateway_ip\":\"10.131.0.1\",\"role\":\"primary\"}}", "k8s.v1.cni.cncf.io/network-status": "[{\n \"name\": \"ovn-kubernetes\",\n \"interface\": \"eth0\",\n \"ips\": [\n \"10.131.0.209\"\n ],\n \"mac\": \"0a:58:0a:83:00:d1\",\n \"default\": true,\n \"dns\": {}\n}]", "openshift.io/scc": "restricted-v2", "seccomp.security.alpha.kubernetes.io/pod": "runtime/default" }, "container_id": "cri-o://b0eb4465735ba3a0b94cc3358d15e3e9d5e21a225d4173f94a0e3e67369e20e2", "container_image": "quay.io/pravin_dsilva/centos:logtest", "container_image_id": "quay.io/pravin_dsilva/centos@sha256:38b54ceb7e1963086aa531fb5462b271939c2bb7a3868bfe67a9a0721a910912", "container_iostream": "stdout", "container_name": "centos-logtest", "labels": { "run": "centos-logtest", "test": "centos-logtest" }, "namespace_id": "5ff1c951-ba64-4e3f-be3e-d57653eb21ca", "namespace_labels": { "kubernetes_io_metadata_name": "test-logging", "pod-security_kubernetes_io_audit": "restricted", "pod-security_kubernetes_io_audit-version": "latest", "pod-security_kubernetes_io_warn": "restricted", "pod-security_kubernetes_io_warn-version": "latest" }, "namespace_name": "test-logging", "pod_id": "e2733665-3ee5-4ab6-a6eb-ba974c487acd", "pod_ip": "10.131.0.209", "pod_name": "centos-logtest-mncq9", "pod_owner": "ReplicationController/centos-logtest" }, "log_source": "container", "log_type": "application", "message": "{\"message\": \"MERGE_JSON_LOG=true\", \"level\": \"debug\",\"Layer1\": \"layer1 0\", \"layer2\": {\"name\":\"Layer2 1\", \"tips\":\"Decide by PRESERVE_JSON_LOG\"}, \"StringNumber\":\"10\", \"Number\": 10,\"foo.bar\":\"Dot Item\",\"{foobar}\":\"Brace Item\",\"[foobar]\":\"Bracket Item\", \"foo:bar\":\"Colon Item\",\"foo bar\":\"Space Item\" }", "openshift": { "cluster_id": "d0057771-8074-494e-aee9-f33601c7f37c", "labels": { "label": "6.1_417-app" }, "sequence": 1.7448027490847882e+18 } }, "logName": "projects/hidden-bond-335716/logs/aosqe-logging-app", "receiveTimestamp": "2025-04-16T11:25:50.105182377Z", "resource": { "labels": { "cluster_name": "", "location": "", "node_name": "worker-1", "project_id": "hidden-bond-335716" }, "type": "k8s_node" }, "timestamp": "2025-04-16T11:25:50.105182377Z" }, { "insertId": "23f8nfsmrwww", "jsonPayload": { "@timestamp": "2025-04-16T11:25:48.014968363Z", "hostname": "worker-1", "kubernetes": { "annotations": { "k8s.ovn.org/pod-networks": "{\"default\":{\"ip_addresses\":[\"10.131.0.209/23\"],\"mac_address\":\"0a:58:0a:83:00:d1\",\"gateway_ips\":[\"10.131.0.1\"],\"routes\":[{\"dest\":\"10.128.0.0/14\",\"nextHop\":\"10.131.0.1\"},{\"dest\":\"172.30.0.0/16\",\"nextHop\":\"10.131.0.1\"},{\"dest\":\"169.254.0.5/32\",\"nextHop\":\"10.131.0.1\"},{\"dest\":\"100.64.0.0/16\",\"nextHop\":\"10.131.0.1\"}],\"ip_address\":\"10.131.0.209/23\",\"gateway_ip\":\"10.131.0.1\",\"role\":\"primary\"}}", "k8s.v1.cni.cncf.io/network-status": "[{\n \"name\": \"ovn-kubernetes\",\n \"interface\": \"eth0\",\n \"ips\": [\n \"10.131.0.209\"\n ],\n \"mac\": \"0a:58:0a:83:00:d1\",\n \"default\": true,\n \"dns\": {}\n}]", "openshift.io/scc": "restricted-v2", "seccomp.security.alpha.kubernetes.io/pod": "runtime/default" }, "container_id": "cri-o://b0eb4465735ba3a0b94cc3358d15e3e9d5e21a225d4173f94a0e3e67369e20e2", "container_image": "quay.io/pravin_dsilva/centos:logtest", "container_image_id": "quay.io/pravin_dsilva/centos@sha256:38b54ceb7e1963086aa531fb5462b271939c2bb7a3868bfe67a9a0721a910912", "container_iostream": "stdout", "container_name": "centos-logtest", "labels": { "run": "centos-logtest", "test": "centos-logtest" }, "namespace_id": "5ff1c951-ba64-4e3f-be3e-d57653eb21ca", "namespace_labels": { "kubernetes_io_metadata_name": "test-logging", "pod-security_kubernetes_io_audit": "restricted", "pod-security_kubernetes_io_audit-version": "latest", "pod-security_kubernetes_io_warn": "restricted", "pod-security_kubernetes_io_warn-version": "latest" }, "namespace_name": "test-logging", "pod_id": "e2733665-3ee5-4ab6-a6eb-ba974c487acd", "pod_ip": "10.131.0.209", "pod_name": "centos-logtest-mncq9", "pod_owner": "ReplicationController/centos-logtest" }, "log_source": "container", "log_type": "application", "message": "{\"message\": \"MERGE_JSON_LOG=true\", \"level\": \"debug\",\"Layer1\": \"layer1 0\", \"layer2\": {\"name\":\"Layer2 1\", \"tips\":\"Decide by PRESERVE_JSON_LOG\"}, \"StringNumber\":\"10\", \"Number\": 10,\"foo.bar\":\"Dot Item\",\"{foobar}\":\"Brace Item\",\"[foobar]\":\"Bracket Item\", \"foo:bar\":\"Colon Item\",\"foo bar\":\"Space Item\" }", "openshift": { "cluster_id": "d0057771-8074-494e-aee9-f33601c7f37c", "labels": { "label": "6.1_417-app" }, "sequence": 1.744802748053161e+18 } }, "logName": "projects/hidden-bond-335716/logs/aosqe-logging-app", "receiveTimestamp": "2025-04-16T11:25:49.071782796Z", "resource": { "labels": { "cluster_name": "", "location": "", "node_name": "worker-1", "project_id": "hidden-bond-335716" }, "type": "k8s_node" }, "timestamp": "2025-04-16T11:25:49.071782796Z" } ] ``` Infrastructure logs: ``` { "insertId": "17lzct5fzd4uya", "jsonPayload": { "@timestamp": "2025-04-16T11:27:03.696957364Z", "hostname": "master-2", "kubernetes": { "annotations": { "cluster-autoscaler.kubernetes.io/safe-to-evict": "true", "k8s.ovn.org/pod-networks": "{\"default\":{\"ip_addresses\":[\"10.130.1.26/23\"],\"mac_address\":\"0a:58:0a:82:01:1a\",\"gateway_ips\":[\"10.130.0.1\"],\"routes\":[{\"dest\":\"10.128.0.0/14\",\"nextHop\":\"10.130.0.1\"},{\"dest\":\"172.30.0.0/16\",\"nextHop\":\"10.130.0.1\"},{\"dest\":\"169.254.0.5/32\",\"nextHop\":\"10.130.0.1\"},{\"dest\":\"100.64.0.0/16\",\"nextHop\":\"10.130.0.1\"}],\"ip_address\":\"10.130.1.26/23\",\"gateway_ip\":\"10.130.0.1\",\"role\":\"primary\"}}", "k8s.v1.cni.cncf.io/network-status": "[{\n \"name\": \"ovn-kubernetes\",\n \"interface\": \"eth0\",\n \"ips\": [\n \"10.130.1.26\"\n ],\n \"mac\": \"0a:58:0a:82:01:1a\",\n \"default\": true,\n \"dns\": {}\n}]", "openshift.io/scc": "restricted-v2", "operatorframework.io/managed-by": "marketplace-operator", "seccomp.security.alpha.kubernetes.io/pod": "runtime/default" }, "container_id": "cri-o://f27a77577fd4a29967d69f56ea94519f4311bd1bcc8419ae66e27c57cb7108eb", "container_image": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:eb0fadb9a59e86e4b26c1e9c5f646a976fdcf68772b9d533406c2bbddc23dcc4", "container_image_id": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:eb0fadb9a59e86e4b26c1e9c5f646a976fdcf68772b9d533406c2bbddc23dcc4", "container_iostream": "stderr", "container_name": "registry-server", "labels": { "catalogsource_operators_coreos_com_update": "", "olm_catalogSource": "community-operators", "olm_managed": "true", "olm_pod-spec-hash": "8uzqQAWXJlfIhDmHHBXxGMfq2ISqu2LgWSWU96" }, "namespace_id": "b48cf71f-9abe-4b6d-9a9f-f7f9e7311bdc", "namespace_labels": { "kubernetes_io_metadata_name": "openshift-marketplace", "olm_operatorgroup_uid_990bb0f0-956b-4206-a933-bee4b2a24816": "", "openshift_io_cluster-monitoring": "true", "pod-security_kubernetes_io_audit": "baseline", "pod-security_kubernetes_io_audit-version": "latest", "pod-security_kubernetes_io_enforce": "baseline", "pod-security_kubernetes_io_enforce-version": "latest", "pod-security_kubernetes_io_warn": "baseline", "pod-security_kubernetes_io_warn-version": "latest" }, "namespace_name": "openshift-marketplace", "pod_id": "987334c5-c428-4b64-a3a6-bf157fb94670", "pod_ip": "10.130.1.26", "pod_name": "community-operators-6hgn8", "pod_owner": "CatalogSource/community-operators" }, "log_source": "container", "log_type": "infrastructure", "message": "time=\"2025-04-16T11:27:03Z\" level=info msg=\"finished call\" :authority=\"[localhost:50051]\" content-type=\"[application/grpc]\" grpc.code=OK grpc.component=server grpc.method=Check grpc.method_type=unary grpc.request.deadline=\"2025-04-16T11:27:04Z\" grpc.service=grpc.health.v1.Health grpc.start_time=\"2025-04-16T11:27:03Z\" grpc.time_ms=0.334 peer.address=\"127.0.0.1:35246\" protocol=grpc user-agent=\"[grpc_health_probe grpc-go/1.63.2]\"", "openshift": { "cluster_id": "d0057771-8074-494e-aee9-f33601c7f37c", "labels": { "label": "6.1_417-infra" }, "sequence": 1.7448028334392584e+18 } }, "logName": "projects/hidden-bond-335716/logs/aosqe-logging-infra", "receiveTimestamp": "2025-04-16T11:27:14.470994515Z", "resource": { "labels": { "cluster_name": "", "location": "", "node_name": "master-2", "project_id": "hidden-bond-335716" }, "type": "k8s_node" }, "severity": "INFO", "timestamp": "2025-04-16T11:27:14.470994515Z" }, { "insertId": "17lzct5fzd4uy9", "jsonPayload": { "@timestamp": "2025-04-16T11:27:03.696804342Z", "hostname": "master-2", "kubernetes": { "annotations": { "cluster-autoscaler.kubernetes.io/safe-to-evict": "true", "k8s.ovn.org/pod-networks": "{\"default\":{\"ip_addresses\":[\"10.130.1.26/23\"],\"mac_address\":\"0a:58:0a:82:01:1a\",\"gateway_ips\":[\"10.130.0.1\"],\"routes\":[{\"dest\":\"10.128.0.0/14\",\"nextHop\":\"10.130.0.1\"},{\"dest\":\"172.30.0.0/16\",\"nextHop\":\"10.130.0.1\"},{\"dest\":\"169.254.0.5/32\",\"nextHop\":\"10.130.0.1\"},{\"dest\":\"100.64.0.0/16\",\"nextHop\":\"10.130.0.1\"}],\"ip_address\":\"10.130.1.26/23\",\"gateway_ip\":\"10.130.0.1\",\"role\":\"primary\"}}", "k8s.v1.cni.cncf.io/network-status": "[{\n \"name\": \"ovn-kubernetes\",\n \"interface\": \"eth0\",\n \"ips\": [\n \"10.130.1.26\"\n ],\n \"mac\": \"0a:58:0a:82:01:1a\",\n \"default\": true,\n \"dns\": {}\n}]", "openshift.io/scc": "restricted-v2", "operatorframework.io/managed-by": "marketplace-operator", "seccomp.security.alpha.kubernetes.io/pod": "runtime/default" }, "container_id": "cri-o://f27a77577fd4a29967d69f56ea94519f4311bd1bcc8419ae66e27c57cb7108eb", "container_image": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:eb0fadb9a59e86e4b26c1e9c5f646a976fdcf68772b9d533406c2bbddc23dcc4", "container_image_id": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:eb0fadb9a59e86e4b26c1e9c5f646a976fdcf68772b9d533406c2bbddc23dcc4", "container_iostream": "stderr", "container_name": "registry-server", "labels": { "catalogsource_operators_coreos_com_update": "", "olm_catalogSource": "community-operators", "olm_managed": "true", "olm_pod-spec-hash": "8uzqQAWXJlfIhDmHHBXxGMfq2ISqu2LgWSWU96" }, "namespace_id": "b48cf71f-9abe-4b6d-9a9f-f7f9e7311bdc", "namespace_labels": { "kubernetes_io_metadata_name": "openshift-marketplace", "olm_operatorgroup_uid_990bb0f0-956b-4206-a933-bee4b2a24816": "", "openshift_io_cluster-monitoring": "true", "pod-security_kubernetes_io_audit": "baseline", "pod-security_kubernetes_io_audit-version": "latest", "pod-security_kubernetes_io_enforce": "baseline", "pod-security_kubernetes_io_enforce-version": "latest", "pod-security_kubernetes_io_warn": "baseline", "pod-security_kubernetes_io_warn-version": "latest" }, "namespace_name": "openshift-marketplace", "pod_id": "987334c5-c428-4b64-a3a6-bf157fb94670", "pod_ip": "10.130.1.26", "pod_name": "community-operators-6hgn8", "pod_owner": "CatalogSource/community-operators" }, "log_source": "container", "log_type": "infrastructure", "message": "time=\"2025-04-16T11:27:03Z\" level=info msg=\"started call\" :authority=\"[localhost:50051]\" content-type=\"[application/grpc]\" grpc.component=server grpc.method=Check grpc.method_type=unary grpc.request.deadline=\"2025-04-16T11:27:04Z\" grpc.service=grpc.health.v1.Health grpc.start_time=\"2025-04-16T11:27:03Z\" grpc.time_ms=0.086 peer.address=\"127.0.0.1:35246\" protocol=grpc user-agent=\"[grpc_health_probe grpc-go/1.63.2]\"", "openshift": { "cluster_id": "d0057771-8074-494e-aee9-f33601c7f37c", "labels": { "label": "6.1_417-infra" }, "sequence": 1.7448028334392218e+18 } }, "logName": "projects/hidden-bond-335716/logs/aosqe-logging-infra", "receiveTimestamp": "2025-04-16T11:27:14.470994515Z", "resource": { "labels": { "cluster_name": "", "location": "", "node_name": "master-2", "project_id": "hidden-bond-335716" }, "type": "k8s_node" }, "severity": "INFO", "timestamp": "2025-04-16T11:27:14.470994515Z" } ] ``` Audit logs: ``` { "insertId": "y6hhz4fy5klab", "jsonPayload": { "@timestamp": "2025-04-16T11:28:26.197992046Z", "annotations": { "authorization.k8s.io/decision": "allow", "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"system:openshift:operator:kube-storage-version-migrator-operator\" of ClusterRole \"cluster-admin\" to ServiceAccount \"kube-storage-version-migrator-operator/openshift-kube-storage-version-migrator-operator\"" }, "apiVersion": "audit.k8s.io/v1", "auditID": "07f1d91b-447b-40b3-bbe4-956d89352a13", "hostname": "master-2", "k8s_audit_level": "Metadata", "kind": "Event", "log_source": "kubeAPI", "log_type": "audit", "objectRef": { "apiVersion": "v1", "namespace": "openshift-kube-storage-version-migrator", "resource": "secrets" }, "openshift": { "cluster_id": "d0057771-8074-494e-aee9-f33601c7f37c", "labels": { "label": "6.1_417-audit" }, "sequence": 1.744802906198621e+18 }, "requestReceivedTimestamp": "2025-04-16T11:19:28.192022Z", "requestURI": "/api/v1/namespaces/openshift-kube-storage-version-migrator/secrets?allowWatchBookmarks=true&resourceVersion=240622&timeout=8m58s&timeoutSeconds=538&watch=true", "responseStatus": { "code": 200, "metadata": {} }, "sourceIPs": [ "10.20.183.166" ], "stage": "ResponseComplete", "stageTimestamp": "2025-04-16T11:28:26.193868Z", "user": { "extra": { "authentication.kubernetes.io/credential-id": [ "JTI=4de0b269-fe8e-444e-8b78-1314d1ff3b81" ], "authentication.kubernetes.io/node-name": [ "master-1" ], "authentication.kubernetes.io/node-uid": [ "032c43cd-67ac-41ee-8dc9-e5effb3f8a66" ], "authentication.kubernetes.io/pod-name": [ "kube-storage-version-migrator-operator-8567b9cf87-hhxn8" ], "authentication.kubernetes.io/pod-uid": [ "82ed68f2-f74a-433d-9334-f54c0cb475b7" ] }, "groups": [ "system:serviceaccounts", "system:serviceaccounts:openshift-kube-storage-version-migrator-operator", "system:authenticated" ], "uid": "38014573-a1b1-4646-b417-25208c6cdc30", "username": "system:serviceaccount:openshift-kube-storage-version-migrator-operator:kube-storage-version-migrator-operator" }, "userAgent": "cluster-kube-storage-version-migrator-operator/v0.0.0 (linux/ppc64le) kubernetes/$Format", "verb": "watch" }, "logName": "projects/hidden-bond-335716/logs/aosqe-logging-audit", "receiveTimestamp": "2025-04-16T11:28:27.042033538Z", "resource": { "labels": { "cluster_name": "", "location": "", "node_name": "master-2", "project_id": "hidden-bond-335716" }, "type": "k8s_node" }, "timestamp": "2025-04-16T11:28:27.042033538Z" }, { "insertId": "y6hhz4fy5klaa", "jsonPayload": { "@timestamp": "2025-04-16T11:28:26.130254458Z", "annotations": { "authorization.k8s.io/decision": "allow", "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"metadata-reader-openshift-logging-logcollector\" of ClusterRole \"metadata-reader\" to ServiceAccount \"logcollector/openshift-logging\"" }, "apiVersion": "audit.k8s.io/v1", "auditID": "09d9452d-cf30-4a5b-bbb5-c3856e35a4a4", "hostname": "master-2", "k8s_audit_level": "Metadata", "kind": "Event", "log_source": "kubeAPI", "log_type": "audit", "objectRef": { "apiVersion": "v1", "resource": "pods" }, "openshift": { "cluster_id": "d0057771-8074-494e-aee9-f33601c7f37c", "labels": { "label": "6.1_417-audit" }, "sequence": 1.7448029061312947e+18 }, "requestReceivedTimestamp": "2025-04-16T11:28:26.085283Z", "requestURI": "/api/v1/pods?&watch=true&timeoutSeconds=290&fieldSelector=spec.nodeName%3Dmaster-1&labelSelector=vector.dev%2Fexclude%21%3Dtrue&allowWatchBookmarks=true&resourceVersion=243792", "responseStatus": { "code": 200, "metadata": {} }, "sourceIPs": [ "10.20.183.166" ], "stage": "ResponseStarted", "stageTimestamp": "2025-04-16T11:28:26.087248Z", "user": { "extra": { "authentication.kubernetes.io/credential-id": [ "JTI=c78d2384-a607-4030-914c-7c5635be6b87" ], "authentication.kubernetes.io/node-name": [ "master-1" ], "authentication.kubernetes.io/node-uid": [ "032c43cd-67ac-41ee-8dc9-e5effb3f8a66" ], "authentication.kubernetes.io/pod-name": [ "instance-nf8zr" ], "authentication.kubernetes.io/pod-uid": [ "f9236320-8d77-44c2-938e-e92a9520bb5b" ] }, "groups": [ "system:serviceaccounts", "system:serviceaccounts:openshift-logging", "system:authenticated" ], "uid": "d78eebf9-f5ff-4f54-9104-11a609281136", "username": "system:serviceaccount:openshift-logging:logcollector" }, "verb": "watch" }, "logName": "projects/hidden-bond-335716/logs/aosqe-logging-audit", "receiveTimestamp": "2025-04-16T11:28:27.042033538Z", "resource": { "labels": { "cluster_name": "", "location": "", "node_name": "master-2", "project_id": "hidden-bond-335716" }, "type": "k8s_node" }, "timestamp": "2025-04-16T11:28:27.042033538Z" } ] ```