<p>I'm running a Kubernetes cluster on Google Cloud, and I'm trying to figure out a way to see all SSH access to the pods, whether it was done using the google cluster management tools, or via kubectl.</p>

<p>I want to be able to see which user account made the access, and ideally what commands they ran. I have stackdriver logging running on all instances which I think may already be recording these actions, but looking at the giant wall of logs, I can't figure out how to tell which of these were generated by someone sshing in.</p>

<p>Is there some kind of standard labeling schema in stackdriver to denote ssh access?</p>

mstorkson
<p>So it turns out that Google Cloud has Auditing enabled by default for Kubernetes, which logs many things, including access to the pod through kubectl. I was able to update my stackdriver log filter like so:</p>

<p><code>protoPayload.@type="type.googleapis.com/google.cloud.audit.AuditLog"</code></p>

<p>And get the logs I was interested in.</p>
