solutions/core-landing-zone/mgmt-project/project-sink.yaml

# Copyright 2022 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
######
# Project sink for the Platform and Component logs of the Landing Zone Management Cluster
# Destination: Cloud Logging bucket hosted inside logging project
# AU-2 - Organization-defined auditable events
# AU-3, AU-3(1) - Sink defined at folder that will allow all the projects underneath the folder to send the logs to the logging bucket in the logging project
# AU-4(1), AU-6(4), AU-9(2) - Log sinks sending the logs to same project in same region having a logging bucket
# AU-12, AU-12(1) - Log Sinks defined in Log Router check each log entry against the inclusion filter and exclusion filter that determine which destinations that the log entry is sent to
apiVersion: logging.cnrm.cloud.google.com/v1beta1
kind: LoggingLogSink
metadata:
  name: mgmt-project-cluster-platform-and-component-log-sink
  namespace: logging
  annotations:
    config.kubernetes.io/depends-on: platform-and-component-log-bucket # kpt-set: logging.cnrm.cloud.google.com/namespaces/logging/LoggingLogBucket/${platform-and-component-log-bucket}
spec:
  projectRef:
    external: management-project-12345 # kpt-set: ${management-project-id}
  destination:
    # AU-3, AU-3(1), AU-4(1), AU-6(4), AU-9(2)
    loggingLogBucketRef:
      external: logging.googleapis.com/projects/${logging-project-id}/locations/northamerica-northeast1/buckets/${platform-and-component-log-bucket} # kpt-set: logging.googleapis.com/projects/${logging-project-id}/locations/northamerica-northeast1/buckets/${platform-and-component-log-bucket}
  # The following setting is required
  # You must set unique_writer_identity to true if you wish to publish logs across projects
  uniqueWriterIdentity: true
  description: Project sink for Platform and Component logs of the Landing Zone Management Cluster
  # the log sink must be enabled (disabled: false) to meet the listed security controls
  disabled: false
  # AU-2, AU-12, AU-12(1)
  # No inclusion filter. Includes all Platform and Component logs
  # Google Cloud platform logs are service-specific logs
  # For a list of all supported Google Cloud Logging API Services visit https://cloud.google.com/logging/docs/api/platform-logs
  # Logs generated from resources such as Cloud DNS, Cloud NAT, Firewall Rules, VPC Flow, and HTTP(S) Load Balancer must be enabled on the respective resource as they are not enabled by default.
  # Excludes: Cloud Audit, Access Transparency, and Data Access Logs
  exclusions:
    - description: Exclude Security logs
      disabled: false
      filter: |-
        log_id("cloudaudit.googleapis.com/activity") OR log_id("externalaudit.googleapis.com/activity")
        OR log_id("cloudaudit.googleapis.com/data_access") OR log_id("externalaudit.googleapis.com/data_access")
        OR log_id("cloudaudit.googleapis.com/system_event") OR log_id("externalaudit.googleapis.com/system_event")
        OR log_id("cloudaudit.googleapis.com/policy") OR log_id("externalaudit.googleapis.com/policy")
        OR log_id("cloudaudit.googleapis.com/access_transparency") OR log_id("externalaudit.googleapis.com/access_transparency")
      name: exclude-security-logs
    # filter to exclude excessive logs
    - description: Exclude Log Noise
      disabled: false
      filter: |-
        log_id("stderr") AND (severity="INFO" OR severity="NOTICE" OR severity="WARNING")
      name: exclude-log-noise
    # excessive GKE logs are being generated by the otel-collector and krmapihosting-metrics-agent containers
    # these logs will be temporarily excluded from being sinked to the platform-and-component-log bucket in the logging project in order to cut costs
    - description: Exclude excesive GKE container logs (issue being investigated)
      disabled: false
      filter: |-
        severity=ERROR
        resource.type = ("k8s_container" OR "k8s_pod")
        resource.labels.container_name = (
        "otel-collector" OR
        "krmapihosting-metrics-agent")
      name: exclude-gke-logs