This is regarding understanding the source of GKE logs.
To explain this with a small example: If you have multiple GKE logs related to cluster operations that show logs with the method google.container.v1beta1.ClusterManager.GetCluster, it’s important to identify where these logs are coming from.
To do this, you can start by going to the Cloud Logging section and filtering the logs to find entries that contain the google.container.v1beta1.ClusterManager.GetCluster field.
As shown in the image above, you'll notice some logs. For instance, I selected one of the logs, and by clicking on Expand nested fields, you can view more detailed information. Please refer to the image below for further guidance.
As you can see the Collapse nested field with wide view.
Now for the next step you have to look for the field with the value callerIp and callerSuppliedUserAgent.
As you can see in the image above, I took an example with callerIp: 34.116.101.10, which is part of the Google IP ranges. To learn more about Google IPs, you can refer to this link.
Regarding the callerSuppliedUserAgent: google-api-go-client/0.5 cluster-autoscaler,gzip(gfe), this user agent indicates that the GKE Cluster Autoscaler (CA) performed the google.container.v1beta1.ClusterManager.GetCluster operation.
Essentially, the Cluster Autoscaler (CA) is invoked on the GKE cluster to monitor its size every minute, ensuring it meets the demands of your workloads. When demand decreases, the CA scales the cluster down to the minimum size you’ve set.
To understand who did what and where, it's best to check the logs, particularly the operation logs. These logs will help you determine what happened on your cloud resources. Always look for callerIp and userAgent details—sometimes logs are straightforward, but other times you may need to dive deeper 🕵️♂️.
I hope you found this information helpful. If you did, please feel free to share and like 👍.