Page Comparison

...

• Make sure that Logging is enabled on the Load Balancer Backend Service Configuration

• Check this link for more information on how to enable Logging on the Load Balancer Backend Service

Create a

...

Image RemovedImage Removed

First, create a Pub/Sub topic in a project that will be used by the logs routing sink:

...

Pub/Sub Topic For The Logs Routing Sink

...

1. In the GCP console, switch to the project where you will create the Pub/Sub topic

2. Using the left-hand side menu, select Pub/Sub (in the Analytics section), and then select Topics

...

1. , Click on Create Topic

2. In Create Topic Flow

3. Use datatheorem-logs-processing as the topic ID

...

2. Uncheck "Add a default subscription"

...

• No other options are needed

...

Click Create to create the topic

...

1. an confirm not other boxes are checked

2. Click Create

...

Create The Cloud Logging Sink

1. Using the left-hand side menu, select Logging (in the Observability section), then within the Configure subsection, select Log router

2. Click

...

1. Create Sink

2. In the Sink details section, input datatheorem-logs-processing as the sink name, and click Next

3. You will have to fill in the full ID of the sink destination. For a Pub/Sub topic, it must be formatted as (but replace the [PROJECT_ID] and [TOPIC_ID] with the topic's information): pubsub.googleapis.com/projects/[PROJECT_ID]/topics/[TOPIC_ID]

4. Click Next

...

Choose Logs to Include in Sink

...

1. In the Choose logs to include section, add the following inclusion filter: resource.type="http_load_balancer"

• You can click on Preview logs to see which logs will be included

...

Complete the sink creation by clicking on Create sink

Create a Service Account

...

1. Click Create sink

...

Create a Service Account To Authenticate Log Forwarding

1. In the GCP on console, switch back to the GCP project where the Pub/Sub topic was created

2. Then using the left-hand side menu, select IAM & Admin section, and then select Service Accounts

3. Click on Create Service Account at the top

4. In the Service account details section, input datatheorem-logs-processing as the name

...

1. Click CREATE AND CONTINUE

Allow Service Account to Assume Role To Authenticate Log Forwarding

1. In the Grant this service account access to project section

...

1. Select a role

2. Filter for “token creator” in the role filter

3. Select Service Account OpenID Connect Identity Token Creator

...

1. role to allow Pub/Sub to generate OIDC tokens that will be used to authenticate requests

2. Complete the service account creation by clicking on Done

...

Collect Service Account’s OAuth2 ClientId

1. On the service account listing, above the table, input datatheorem-logs-processing to retrieve the newly created service account

2. Copy the value from the OAuth 2 Client ID column and register it below

...

Create a Pub/Sub

...

Subscription In The Same GCP project As The Pub/Sub

...

Topic

1. Using the left-hand side menu, select Pub/Sub (in the Analytics section), then within the PUB/SUB subsection, select Subscriptions

2. Click on CREATE SUBSCRIPTION at the top

3. Input datatheorem-logs-processing as the subscription ID

4. Click on Select a Cloud Pub/Sub topic and input datatheorem to filter the previously created Pub/Sub topic

5. In the Delivery type section, select Push

6. In the Endpoint URL text box, input https://api-protect-api.securetheorem.com/logs/v1/ingest/gcp_load_balancers

...

1. Check on the Enable Authentication checkbox below the Endpoint URL, and select the previously created service account

2. In the Retry policy section at the bottom, change the retry policy in the subscription to exponential backoff instead of immediate retry

...

1. Click CREATE

Image Added

Kubernetes In-Cluster Helm Chart Integration

...