Read a Kubernetes workload’s logs
Use a fixed k8s_container and namespace filter, then investigate specific error messages without opening unrelated application logs.
APIs & logs · MCP Firewall integration
Give AI selected Google Cloud logs. Keep access scoped.
Put Google Cloud Logging behind GateRook’s MCP Firewall. Select projects or log views, configure Application Default Credentials or a service account key, and optionally impersonate a dedicated identity. Connection scope, IAM permissions and query limits constrain the logs returned to AI.
Connection in GateRook
stage-cloud-logs
Google Cloud Logging
stage / QA- Connector type
- GCP Cloud Logging
- Name / environment
- stage-cloud-logs / stage
- Resource names
- projects/orders-stage
- Credentials source
- adc
The security boundary
Your AI requests a tool. GateRook checks its mode and policy, requires approval when configured, and resolves credentials locally before an allowed call runs.
Understand the request flowAsk your AI
Find recent order 48213 errors in Google Cloud Logging and explain the sequence.
gcp_logging_search · arguments
{
"connection": "stage-cloud-logs",
"query": "severity>=ERROR AND SEARCH(\"48213\")",
"from": "-15m",
"to": "now",
"limit": 20
}Example result
{
"backend": "gcp-logging",
"entries": [
{
"timestamp": "2026-10-22T12:29:00Z",
"severity": "ERROR",
"message": "Payment authorization timed out for order 48213"
}
],
"count": 1,
"truncated": false
}Sample configuration and output, not a live connection. Replace example values with your environment. Tool names here are connector names; the endpoint may expose a connection-specific name.
Useful access. Explicit control.
What you can do with Google Cloud Logging and AI
Investigate structured events
Ask the AI to inspect returned jsonPayload or other structured fields and compare events by an application identifier.
Use a dedicated log view
Point the connection to an existing log view to narrow its accessible data independently of the query supplied by the agent.
From service to MCP Firewall
How to connect Google Cloud Logging
GateRook must be running on a computer that can reach your service. Open Connections, choose Add connection, and select GCP Cloud Logging. Give the connection a name and environment.
New to GateRook? Start with the full setup guide.Prepare the Google Cloud identity
Use gcloud auth application-default login on the GateRook computer for ADC, or prepare a service account key for the connection. Grant read access only to the intended logs. Configure impersonation permissions if you use a target service account.
Choose resources and an enforced filter
Open Connections, Add connection and GCP Cloud Logging. Select the resource names, identity source and optional impersonation target. Add an always-on scope filter for the service or namespace.
Test and save the connection
Run Test connection and finish Add to endpoint. Verify a short Logging query language search in Playground before using it from an AI app.
Choose the endpoint and tool modes
Add the tested connection to an endpoint. In Tools & policies, enable only the tools needed for the task. Start with Read only where supported; use Approval for any selected mutation and leave other tools Off. A connection alone does not grant an AI client access.
Connect your AI and verify the first call
In Clients, choose your AI app and endpoint, review the connection details, and connect. Try this guide’s example in Playground before asking your AI. Open Activity to inspect the tool, target, decision and returned result. The getting started guide covers this shared flow.
Connection settings
Configure Google Cloud Logging in GateRook
These are example values for the connection form. Enter credentials into GateRook’s secret fields, not into an AI prompt. Requirements and alternatives are noted per field.
| Setting | Example | How to use it |
|---|---|---|
Connector type | GCP Cloud Logging | Choose GCP Cloud Logging in Add connection. It is a dedicated built-in connector. |
Name / environment | stage-cloud-logs / stage | Keep environments and access scopes recognizable. |
Resource names | projects/orders-stage | Use project, folder, organization, billing account or supported log view resource names. A log view provides the tightest scope. |
Credentials source | adc | Use Application Default Credentials on this computer, or select serviceAccountKey and enter the JSON key in GateRook. |
Impersonate | gw-reader@orders-stage.iam.gserviceaccount.com | Optional service account impersonation. The source identity needs permission to impersonate the target. |
Always add this filter | resource.type="k8s_container" AND resource.labels.namespace_name="orders" | A fixed filter applied in addition to the agent query. |
Know what you expose
Google Cloud Logging tools and access boundaries
The connector defines available operations. GateRook’s MCP Firewall enforces endpoint modes and connection policies before an AI client can use them.
| Tool | Purpose | Access behavior |
|---|---|---|
gcp_logging_search | Search a bounded time range in the backend query language, with a cursor for older results. | Read only |
gcp_logging_tail | Read new log entries since a cursor, waiting up to eight seconds for another page. | Read only |
Before you enable access
- This integration reads logs. It does not edit entries, change retention or administer the logging service.
- The connection scope, environment policy and result limits all apply. A truncated page is only part of the evidence.
- Log messages may contain application data or sensitive payloads. Scope the source and review the data your AI app is permitted to receive.
- Google Cloud IAM and log-view permissions remain authoritative. Configuring a resource does not grant access to it.
- The connection includes a quota-per-minute setting for entries.list calls. Broad searches can still consume project API quota.
GateRook stores local connection secrets encrypted and resolves them for connectors. Allowed tool results are returned to your AI client and may be processed by its provider. Scope the data you expose as well as the actions you allow.
Practical answers
Google Cloud Logging connection questions
Use Test connection to isolate service access problems. Use Playground and Activity to inspect endpoint permissions and tool calls.
Must I upload a service account JSON key?
No. ADC is supported, and the connection can optionally impersonate a service account. A JSON key is an alternative credential source.
Can I force every query to one namespace?
Yes. Set Always add this filter to the namespace or resource condition. The connector applies that scope together with the agent’s query.
Does this use SQL?
No. A GCP Cloud Logging connection uses the Logging query language. The AI should form its filter for that backend.
Why does an older connection still expose logs_search and logs_tail?
Older saved Logs connections retain their compatible tool names. New GCP Cloud Logging connections expose gcp_logging_search and gcp_logging_tail. Use the names shown in your endpoint; the endpoint may also add a connection-specific prefix.
Keep exploring
Extend control across your stack
Google Cloud
Control Google Cloud access through GateRook. Keep service account keys local, scope read-only inventory and monitoring, and enable log access deliberately.
Kubernetes
Protect Kubernetes access with GateRook’s MCP Firewall. Restrict namespaces, enable log access deliberately and approve enabled rollout or manifest changes.
Loki
Control AI access to Loki logs with GateRook. Configure tenant and source scope, keep credentials local and bound LogQL results and time ranges.
Your MCP Firewall. Your access rules.
Control AI access to Google Cloud Logging.
Start with read-only access. Approve changes. Inspect the audit trail.