Parse GCP logging to get JSON list of container images used in the past 60 days in a GKE jupyterhub deployment.

used_containers.sh

#!/usr/bin/env bash
# Parse GCP logging to print sample JSON list of container images used in the
# past 60 days in a GKE singleuser-server Jupyterhub deployment.
# Be sure to set PROJECT_ID and have jq installed.

set -e


PROJECT_ID="gcpprojectid"

# Pull cluster audit logs for every time jupyterhub tries to create a new 
# singleuse-server pod. Then use jq to yank the image names and spit them out
# as a unique list.
gcloud logging read "protoPayload.methodName=io.k8s.core.v1.pods.create AND protoPayload.request.metadata.labels.app=jupyterhub AND protoPayload.request.metadata.labels.component=singleuser-server AND resource.type=k8s_cluster AND logName=projects/${PROJECT_ID}/logs/cloudaudit.googleapis.com%2Factivity" \
    --project="${PROJECT_ID}" \
    --freshness="60d" \
    --format=json \
    --limit=500 \
    | jq '[ .[] | .protoPayload.request.spec.containers[0].image ] | unique'