ai
Crossplane Composition Audit Trail Logging —
Crossplane Audit Trail
Crossplane Composition Audit Trail Logging Kubernetes CRD Provider Claim XRD ELK Stack Falco OPA Gatekeeper GitOps Compliance
| Component | Role | Data Source | Output |
|---|---|---|---|
| K8s Audit Log | API Request Logging | kube-apiserver | JSON Log File |
| Filebeat | Log Collection | Audit Log File | → Logstash/ES |
| Logstash | Log Processing | Filebeat | → Elasticsearch |
| Elasticsearch | Log Storage + Search | Logstash | Index |
| Kibana | Dashboard + Alert | Elasticsearch | Visualization |
| Falco | Runtime Security | Syscalls + K8s API | Alert |
เคล็ดลับ
- GitOps: ตรวจจับ Manual Changes นอก GitOps ด้วย Audit Log
- Falco: ใช้ Falco ตรวจ Runtime Security ของ Crossplane
- Retention: เก็บ Audit Log 90 วัน+ สำหรับ Compliance
- RBAC: ตั้ง RBAC Least Privilege สำหรับ Crossplane
- Alert: ตั้ง Alert Manual Deletion Credential Change ทันที
Crossplane คืออะไร
Infrastructure as Code Kubernetes CRD Provider AWS GCP Azure Composition Claim XRD kubectl apply GitOps Flux ArgoCD Open Source
