| 用途 | 容器平台控制面溯源 |
|---|---|
| 关键字段 | user.username / verb / objectRef / requestURI / sourceIPs |
检索
检索
jq 'select(.verb=="create") | {t:.requestReceivedTimestamp, u:.user.username, r:.objectRef.resource, ip:.sourceIPs}' audit.log | head -30关注 System 账号之外的普通账号对 secrets、rbac 对象的读取与创建。