Google Kubernetes Engine (GKE)
| methodName | Description | Log type | Sample | Rule |
|---|---|---|---|---|
| any | Catch-all entry for container.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation. | activity | N | N |
| google. | Creates a cluster, consisting of the specified number and type of Google Compute Engine instances. | activity | Y | N |
| google. | Deletes the cluster, including the Kubernetes endpoint and all worker nodes. | activity | Y | N |
| google. | Updates the settings for a specific cluster. | activity | N | N |
| google. | Sets master auth materials. Currently supports changing the admin password or a specific cluster, either via password generation or explicitly setting the password. | activity | N | N |
| google. | Enables/Disables Network Policy for a cluster. | activity | N | N |
| google. | Creates a node pool for a cluster. | activity | N | N |
| google. | Deletes a node pool from a cluster. | activity | N | N |
| google. | Read GKE cluster configuration. | data_access | Y | N |
| google. | Read a GKE cluster operation. | data_access | Y | N |
| google. | List GKE clusters in a project and location. | data_access | Y | N |
any: container.googleapis.com (any method)
#Description
Catch-all entry for container.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.
google.container.ClusterManager.CreateCluster: Create cluster
#Description
Creates a cluster, consisting of the specified number and type of Google Compute Engine instances.
Example Audit Log Entry #
{
"insertId": "50rah6d82nr",
"logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
"operation": {
"id": "operation-1782743490978-c216f4b5-62b5-45d5-9ecc-a651916f869f",
"last": true,
"producer": "container.googleapis.com"
},
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"metadata": {
"@type": "type.googleapis.com/google.cloud.audit.GkeRequestMetadata",
"operationType": "CREATE_CLUSTER",
"requestID": "0xa340b8edddf296cb"
},
"methodName": "google.container.v1.ClusterManager.CreateCluster",
"policyViolationInfo": {
"orgPolicyViolationInfo": {}
},
"resourceLocation": {
"currentLocations": [
"us-central1-a"
]
},
"resourceName": "projects/example-project-id/zones/us-central1-a/clusters/dwgke-dw743447",
"serviceName": "container.googleapis.com",
"status": {}
},
"receiveTimestamp": "2026-06-29T14:35:22.334313131Z",
"resource": {
"labels": {
"cluster_name": "dwgke-dw743447",
"location": "us-central1-a",
"project_id": "example-project-id"
},
"type": "gke_cluster"
},
"severity": "NOTICE",
"timestamp": "2026-06-29T14:35:21.661007101Z"
}
References #
google.container.ClusterManager.DeleteCluster: Delete cluster
#Description
Deletes the cluster, including the Kubernetes endpoint and all worker nodes.
Example Audit Log Entry #
{
"insertId": "12umtrbdcj73",
"logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
"operation": {
"first": true,
"id": "operation-1782744010254-a2f38d24-3e04-4df7-a0d1-e082de95a876",
"producer": "container.googleapis.com"
},
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"authenticationInfo": {
"oauthInfo": {
"oauthClientId": "32555940559.apps.googleusercontent.com"
},
"principalEmail": "user@example.com",
"principalSubject": "user:user@example.com"
},
"authorizationInfo": [
{
"granted": true,
"permission": "container.clusters.delete",
"permissionType": "ADMIN_WRITE",
"resource": "projects/example-project-id/zones/us-central1-a/clusters/dwgke-dw743447",
"resourceAttributes": {
"name": "projects/example-project-id/zones/us-central1-a/clusters/dwgke-dw743447",
"service": "container.googleapis.com",
"type": "container.googleapis.com/Cluster"
}
}
],
"metadata": {
"@type": "type.googleapis.com/google.cloud.audit.GkeRequestMetadata",
"requestID": "0x2ae8d1483ad898dc"
},
"methodName": "google.container.v1.ClusterManager.DeleteCluster",
"policyViolationInfo": {
"orgPolicyViolationInfo": {}
},
"request": {
"@type": "type.googleapis.com/google.container.v1alpha1.DeleteClusterRequest",
"name": "projects/example-project-id/locations/us-central1-a/clusters/dwgke-dw743447"
},
"requestMetadata": {
"callerIp": "203.0.113.10",
"callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.container.clusters.delete invocation-id/4270211657d94fc683055471145bf4ea environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/False python/3.14.5 term/tmux-256color (Linux 6.1.0-41-amd64),gzip(gfe)",
"destinationAttributes": {},
"requestAttributes": {
"auth": {},
"time": "2026-06-29T14:40:10.101886456Z"
}
},
"resourceLocation": {
"currentLocations": [
"us-central1-a"
]
},
"resourceName": "projects/example-project-id/zones/us-central1-a/clusters/dwgke-dw743447",
"response": {
"@type": "type.googleapis.com/google.container.v1alpha1.Operation",
"name": "operation-1782744010254-a2f38d24-3e04-4df7-a0d1-e082de95a876",
"operationType": "DELETE_CLUSTER",
"selfLink": "https://container.googleapis.com/v1alpha1/projects/000000000000/zones/us-central1-a/operations/operation-1782744010254-a2f38d24-3e04-4df7-a0d1-e082de95a876",
"startTime": "2026-06-29T14:40:10.254171619Z",
"status": "RUNNING",
"targetLink": "https://container.googleapis.com/v1alpha1/projects/000000000000/zones/us-central1-a/clusters/dwgke-dw743447"
},
"serviceName": "container.googleapis.com",
"status": {}
},
"receiveTimestamp": "2026-06-29T14:40:10.685356588Z",
"resource": {
"labels": {
"cluster_name": "dwgke-dw743447",
"location": "us-central1-a",
"project_id": "example-project-id"
},
"type": "gke_cluster"
},
"severity": "NOTICE",
"timestamp": "2026-06-29T14:40:10.418082165Z"
}
google.container.ClusterManager.UpdateCluster: Update cluster
#Description
Updates the settings for a specific cluster.
google.container.ClusterManager.SetMasterAuth: Set master auth
#Description
Sets master auth materials. Currently supports changing the admin password or a specific cluster, either via password generation or explicitly setting the password.
google.container.ClusterManager.SetNetworkPolicy: Set network policy
#Description
Enables/Disables Network Policy for a cluster.
google.container.ClusterManager.CreateNodePool: Create node pool
#Description
Creates a node pool for a cluster.
google.container.ClusterManager.DeleteNodePool: Delete node pool
#Description
Deletes a node pool from a cluster.
google.container.ClusterManager.GetCluster: GetCluster
#Description
Read GKE cluster configuration.
Data Access audit logs are disabled by default.Example Audit Log Entry #
{
"insertId": "1vfq5u1d89lg",
"logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"authenticationInfo": {
"oauthInfo": {
"oauthClientId": "110162197178770594910"
},
"principalEmail": "service-000000000000@container-engine-robot.iam.gserviceaccount.com",
"principalSubject": "serviceAccount:service-000000000000@container-engine-robot.iam.gserviceaccount.com"
},
"authorizationInfo": [
{
"granted": true,
"permission": "container.clusters.get",
"permissionType": "ADMIN_READ",
"resource": "projects/example-project-id/zones/us-central1-a/clusters/dwgke-dw743447",
"resourceAttributes": {
"name": "projects/example-project-id/zones/us-central1-a/clusters/dwgke-dw743447",
"service": "container.googleapis.com",
"type": "container.googleapis.com/Cluster"
}
}
],
"metadata": {
"@type": "type.googleapis.com/google.cloud.audit.GkeRequestMetadata",
"requestID": "0xf37256246e92c21"
},
"methodName": "google.container.v1beta1.ClusterManager.GetCluster",
"policyViolationInfo": {
"orgPolicyViolationInfo": {}
},
"request": {
"@type": "type.googleapis.com/google.container.v1alpha1.GetClusterRequest",
"name": "projects/example-project-id/locations/us-central1-a/clusters/dwgke-dw743447"
},
"requestMetadata": {
"callerIp": "203.0.113.10",
"callerSuppliedUserAgent": "google-api-go-client/0.5 cluster-autoscaler,gzip(gfe)",
"destinationAttributes": {},
"requestAttributes": {
"auth": {},
"time": "2026-06-29T14:39:56.211872459Z"
}
},
"resourceLocation": {
"currentLocations": [
"us-central1-a"
]
},
"resourceName": "projects/example-project-id/zones/us-central1-a/clusters/dwgke-dw743447",
"serviceName": "container.googleapis.com",
"status": {}
},
"receiveTimestamp": "2026-06-29T14:39:56.686040517Z",
"resource": {
"labels": {
"cluster_name": "dwgke-dw743447",
"location": "us-central1-a",
"project_id": "example-project-id"
},
"type": "gke_cluster"
},
"severity": "INFO",
"timestamp": "2026-06-29T14:39:56.218111Z"
}
google.container.ClusterManager.GetOperation: GetOperation
#Description
Read a GKE cluster operation.
Data Access audit logs are disabled by default.Example Audit Log Entry #
{
"insertId": "33m2gjc5rk",
"logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"authenticationInfo": {
"oauthInfo": {
"oauthClientId": "32555940559.apps.googleusercontent.com"
},
"principalEmail": "user@example.com",
"principalSubject": "user:user@example.com"
},
"authorizationInfo": [
{
"granted": true,
"permission": "container.operations.get",
"permissionType": "ADMIN_READ",
"resource": "projects/example-project-id/zones/us-central1-a/operations/operation-1782744010254-a2f38d24-3e04-4df7-a0d1-e082de95a876",
"resourceAttributes": {
"name": "projects/example-project-id/zones/us-central1-a/operations/operation-1782744010254-a2f38d24-3e04-4df7-a0d1-e082de95a876",
"service": "container.googleapis.com",
"type": "container.googleapis.com/Operation"
}
}
],
"metadata": {
"@type": "type.googleapis.com/google.cloud.audit.GkeRequestMetadata",
"requestID": "0x5c944576e25ee843"
},
"methodName": "google.container.v1.ClusterManager.GetOperation",
"policyViolationInfo": {
"orgPolicyViolationInfo": {}
},
"request": {
"@type": "type.googleapis.com/google.container.v1alpha1.GetOperationRequest",
"name": "projects/example-project-id/locations/us-central1-a/operations/operation-1782744010254-a2f38d24-3e04-4df7-a0d1-e082de95a876"
},
"requestMetadata": {
"callerIp": "203.0.113.10",
"callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.container.clusters.delete invocation-id/4270211657d94fc683055471145bf4ea environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/False python/3.14.5 term/tmux-256color (Linux 6.1.0-41-amd64),gzip(gfe)",
"destinationAttributes": {},
"requestAttributes": {
"auth": {},
"time": "2026-06-29T14:44:31.472369176Z"
}
},
"resourceLocation": {
"currentLocations": [
"us-central1-a"
]
},
"resourceName": "projects/example-project-id/zones/us-central1-a/operations/operation-1782744010254-a2f38d24-3e04-4df7-a0d1-e082de95a876",
"serviceName": "container.googleapis.com",
"status": {}
},
"receiveTimestamp": "2026-06-29T14:44:31.664633048Z",
"resource": {
"labels": {
"cluster_name": "",
"location": "us-central1-a",
"project_id": "example-project-id"
},
"type": "gke_cluster"
},
"severity": "INFO",
"timestamp": "2026-06-29T14:44:31.472406426Z"
}
google.container.ClusterManager.ListClusters: ListClusters
#Description
List GKE clusters in a project and location.
Data Access audit logs are disabled by default.Example Audit Log Entry #
{
"insertId": "dvhvsgd2wxg",
"logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"authenticationInfo": {
"oauthInfo": {
"oauthClientId": "32555940559.apps.googleusercontent.com"
},
"principalEmail": "user@example.com",
"principalSubject": "user:user@example.com"
},
"authorizationInfo": [
{
"granted": true,
"permission": "container.clusters.list",
"permissionType": "ADMIN_READ",
"resource": "projects/example-project-id",
"resourceAttributes": {
"name": "projects/example-project-id",
"service": "cloudresourcemanager.googleapis.com",
"type": "cloudresourcemanager.googleapis.com/Project"
}
}
],
"metadata": {
"@type": "type.googleapis.com/google.cloud.audit.GkeRequestMetadata",
"requestID": "0x1e644c57b0be394c"
},
"methodName": "google.container.v1alpha1.ClusterManager.ListClusters",
"policyViolationInfo": {
"orgPolicyViolationInfo": {}
},
"request": {
"@type": "type.googleapis.com/google.container.v1.ListClustersRequest",
"parent": "projects/example-project-id/locations/-"
},
"requestMetadata": {
"callerIp": "203.0.113.10",
"callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.container.clusters.list invocation-id/5529314701674c2cb621f23701706c3b environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color (Linux 6.1.0-41-amd64),gzip(gfe)",
"destinationAttributes": {},
"requestAttributes": {
"auth": {},
"time": "2026-06-29T13:18:09.637354628Z"
}
},
"resourceLocation": {
"currentLocations": [
""
]
},
"resourceName": "projects/example-project-id/locations/-",
"serviceName": "container.googleapis.com",
"status": {}
},
"receiveTimestamp": "2026-06-29T13:18:10.122096146Z",
"resource": {
"labels": {
"cluster_name": "",
"location": "",
"project_id": "example-project-id"
},
"type": "gke_cluster"
},
"severity": "INFO",
"timestamp": "2026-06-29T13:18:09.944855125Z"
}