Overview

The GKE integration ingests GKE control plane logs that are written to Cloud Logging:

  • kube-apiserver — Kubernetes API requests
  • kube-audit — admission and authorization decisions
  • kube-controller-manager and kube-scheduler events
  • GKE security posture and binary authorization events

Prerequisites

  • A GKE cluster with control plane logging enabled and routed to Cloud Logging.
  • A service account with the Logs Viewer role on the cluster's project.

Step 1: Enable GKE control plane logging

  1. Open the Google Cloud Console → Kubernetes Engine → Clusters and select your cluster.
  2. Click the pencil icon next to Logging under Features.
  3. Enable the components you need:
    • API server
    • Scheduler
    • Controller Manager
  4. Click Save changes.

Step 2: Create a service account

  1. Go to IAM & Admin → Service Accounts → Create service account.
  2. Name it atatus-gke and click Create and continue.
  3. Grant the role Logs Viewer (roles/logging.viewer). For Data Access logs, also grant Private Logs Viewer (roles/logging.privateLogViewer).
  4. Click Done.
  5. Open the service account → Keys tab → Add Key → Create new key → JSON and download the file.

Step 3: Connect GKE in Atatus

  1. In Atatus, go to Security → Cloud SIEM → Integrations.
  2. Locate the GCP Kubernetes (GKE) card and click Connect.
  3. Fill in the form:
Field Description Example
Service Account JSON Paste the entire JSON key from Step 2. { "type": "service_account", ... }
GCP Project ID Project containing the cluster. my-project-123
Cluster Name GKE cluster name. prod-gke-cluster
Poll Interval (minutes) How often to fetch new entries. 5
Enabled Turn collection on. true
  1. Click Connect.

Verification

  • The GCP Kubernetes (GKE) card shows Configured.
  • Control plane events appear in Security → Cloud SIEM → Audit Logs → Events with source gke.