solutions/legacy/logging/core-env/folder-sinks.yaml

# Copyright 2022 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
######
# Folder sink for Platform and Component logs of Services Resources
# Destination: Cloud Logging bucket hosted inside logging project
apiVersion: logging.cnrm.cloud.google.com/v1beta1
kind: LoggingLogSink
metadata:
  name: platform-and-component-services-log-sink
  namespace: logging
  annotations:
    config.kubernetes.io/depends-on: platform-and-component-log-bucket # kpt-set: logging.cnrm.cloud.google.com/namespaces/logging/LoggingLogBucket/${platform-and-component-log-bucket}
spec:
  folderRef:
    name: services
    namespace: hierarchy
  includeChildren: true
  destination:
    loggingLogBucketRef:
      # destination.loggingLogBucketRef
      # Only `external` field is supported to configure the reference.
      external: platform-and-component-log-bucket # kpt-set: logging.googleapis.com/projects/${logging-project-id}/locations/northamerica-northeast1/buckets/${platform-and-component-log-bucket}
  description: Folder sink for Platform and Component logs of services Resources
  # AU-2, AU-12(A), AU-12(C)
  # No inclusion filter. Includes all Platform and Component logs
  # Google Cloud platform logs are service-specific logs
  # For a list of all supported Google Cloud Logging API Services visit https://cloud.google.com/logging/docs/api/platform-logs
  # Logs generated from resources such as Cloud DNS, Cloud NAT, Firewall Rules, VPC Flow, and HTTP(S) Load Balancer must be enabled on the respective resource as they are not enabled by default.
  # Excludes: Cloud Audit, Access Transparency, and Data Access Logs
  exclusions:
    - description: Exclude Security logs
      disabled: false
      filter: |-
        LOG_ID("cloudaudit.googleapis.com/activity") OR LOG_ID("externalaudit.googleapis.com/activity")
        OR LOG_ID("cloudaudit.googleapis.com/data_access") OR LOG_ID("externalaudit.googleapis.com/data_access")
        OR LOG_ID("cloudaudit.googleapis.com/system_event") OR LOG_ID("externalaudit.googleapis.com/system_event")
        OR LOG_ID("cloudaudit.googleapis.com/policy") OR LOG_ID("externalaudit.googleapis.com/policy")
        OR LOG_ID("cloudaudit.googleapis.com/access_transparency") OR LOG_ID("externalaudit.googleapis.com/access_transparency")
      name: exclude-security-logs
---
######
# Folder sink for Platform and Component logs of Services Resources
# Destination: Cloud Logging bucket hosted inside logging project
apiVersion: logging.cnrm.cloud.google.com/v1beta1
kind: LoggingLogSink
metadata:
  name: platform-and-component-services-infra-log-sink
  namespace: logging
  annotations:
    config.kubernetes.io/depends-on: platform-and-component-log-bucket # kpt-set: logging.cnrm.cloud.google.com/namespaces/logging/LoggingLogBucket/${platform-and-component-log-bucket}
spec:
  folderRef:
    name: services-infrastructure
    namespace: hierarchy
  includeChildren: true
  destination:
    loggingLogBucketRef:
      # destination.loggingLogBucketRef
      # Only `external` field is supported to configure the reference.
      external: platform-and-component-log-bucket # kpt-set: logging.googleapis.com/projects/${logging-project-id}/locations/northamerica-northeast1/buckets/${platform-and-component-log-bucket}
  description: Folder sink for Platform and Component logs of services Resources
  # AU-2, AU-12(A), AU-12(C)
  # No inclusion filter. Includes all Platform and Component logs
  # Google Cloud platform logs are service-specific logs
  # For a list of all supported Google Cloud Logging API Services visit https://cloud.google.com/logging/docs/api/platform-logs
  # Logs generated from resources such as Cloud DNS, Cloud NAT, Firewall Rules, VPC Flow, and HTTP(S) Load Balancer must be enabled on the respective resource as they are not enabled by default.
  # Excludes: Cloud Audit, Access Transparency, and Data Access Logs
  exclusions:
    - description: Exclude Security logs
      disabled: false
      filter: |-
        LOG_ID("cloudaudit.googleapis.com/activity") OR LOG_ID("externalaudit.googleapis.com/activity")
        OR LOG_ID("cloudaudit.googleapis.com/data_access") OR LOG_ID("externalaudit.googleapis.com/data_access")
        OR LOG_ID("cloudaudit.googleapis.com/system_event") OR LOG_ID("externalaudit.googleapis.com/system_event")
        OR LOG_ID("cloudaudit.googleapis.com/policy") OR LOG_ID("externalaudit.googleapis.com/policy")
        OR LOG_ID("cloudaudit.googleapis.com/access_transparency") OR LOG_ID("externalaudit.googleapis.com/access_transparency")
      name: exclude-security-logs