Skip to content

Commit fd6648f

Browse files
authored
removed( enable log handling) command and its content
1 parent 140f0d0 commit fd6648f

File tree

1 file changed

+0
-14
lines changed

1 file changed

+0
-14
lines changed

content/en/docs/concepts/security/security-checklist.md

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -207,21 +207,7 @@ SELinux is only available on Linux nodes, and enabled in
207207
## Logs and auditing
208208

209209
- [ ] Audit logs, if enabled, are protected from general access.
210-
- [ ] The `/logs` API is disabled (you are running kube-apiserver with
211-
`--enable-logs-handler=false`).
212210

213-
Kubernetes includes a `/logs` API endpoint, enabled by default,
214-
that lets users request the contents of the API server's `/var/log` directory over HTTP. Accessing
215-
that endpoint requires authentication.
216-
217-
Allowing broad access to Kubernetes logs can make security information
218-
available to a potential attacker.
219-
220-
As a good practice, set up a separate means to collect and aggregate
221-
control plane logs, and do not use the `/logs` API endpoint.
222-
Alternatively, if you run your control plane with the `/logs` API endpoint
223-
and limit the content of `/var/log` (within the host or container where the API server is running) to
224-
Kubernetes API server logs only.
225211

226212
## Pod placement
227213

0 commit comments

Comments
 (0)