Skip to content

Commit 3a962f8

Browse files
bergerhofferbergerhoffer
authored
Merge pull request #45799 from bergerhoffer/OSDOCS-2890
OSDOCS-2890: Updating for OAuth server audit logging
2 parents e7c95f7 + c79fdd6 commit 3a962f8

File tree

4 files changed

+64
-13
lines changed

4 files changed

+64
-13
lines changed

‎modules/gathering-data-audit-logs.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ endif::viewing[]
2929

3030
.Procedure
3131

32-
. Run the `oc adm must-gather` command with the `-- /usr/bin/gather_audit_logs` flag:
32+
. Run the `oc adm must-gather` command with `-- /usr/bin/gather_audit_logs`:
3333
+
3434
[source,terminal]
3535
----

‎modules/nodes-nodes-audit-config-about.adoc

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
[id="about-audit-log-profiles_{context}"]
77
= About audit log policy profiles
88

9-
Audit log profiles define how to log requests that come to the OpenShift API server, the Kubernetes API server, and the OAuth API server.
9+
Audit log profiles define how to log requests that come to the OpenShift API server, Kubernetes API server, OpenShift OAuth API server, and OpenShift OAuth server.
1010

1111
{product-title} provides the following predefined audit policy profiles:
1212

@@ -35,7 +35,7 @@ It is not recommended to disable audit logging by using the `None` profile unles
3535
|===
3636
[.small]
3737
--
38-
1. Sensitive resources, such as `Secret`, `Route`, and `OAuthClient` objects, are never logged past the metadata level.
38+
1. Sensitive resources, such as `Secret`, `Route`, and `OAuthClient` objects, are only ever logged at the metadata level. OpenShift OAuth server events are only ever logged at the metadata level.
3939
--
4040

4141
By default, {product-title} uses the `Default` audit log profile. You can use another audit policy profile that also logs request bodies, but be aware of the increased resource usage (CPU, memory, and I/O).

‎modules/nodes-nodes-audit-log-basic-viewing.adoc

Lines changed: 52 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -6,15 +6,15 @@
66
[id="nodes-nodes-audit-log-basic-viewing_{context}"]
77
= Viewing the audit logs
88

9-
You can view the logs for the OpenShift API server, Kubernetes API server, and OpenShift OAuth API server for each control plane node.
9+
You can view the logs for the OpenShift API server, Kubernetes API server, OpenShift OAuth API server, and OpenShift OAuth server for each control plane node.
1010

1111
.Procedure
1212

1313
To view the audit logs:
1414

15-
* View the OpenShift API server logs:
15+
* View the OpenShift API server audit logs:
1616
17-
.. List the OpenShift API server logs that are available for each control plane node:
17+
.. List the OpenShift API server audit logs that are available for each control plane node:
1818
+
1919
[source,terminal]
2020
----
@@ -32,7 +32,7 @@ ci-ln-m0wpfjb-f76d1-vnb5x-master-2 audit-2021-03-09T00-13-00.128.log
3232
ci-ln-m0wpfjb-f76d1-vnb5x-master-2 audit.log
3333
----
3434

35-
.. View a specific OpenShift API server log by providing the node name and the log name:
35+
.. View a specific OpenShift API server audit log by providing the node name and the log name:
3636
+
3737
[source,terminal]
3838
----
@@ -52,9 +52,9 @@ $ oc adm node-logs ci-ln-m0wpfjb-f76d1-vnb5x-master-0 --path=openshift-apiserver
5252
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"381acf6d-5f30-4c7d-8175-c9c317ae5893","stage":"ResponseComplete","requestURI":"/metrics","verb":"get","user":{"username":"system:serviceaccount:openshift-monitoring:prometheus-k8s","uid":"825b60a0-3976-4861-a342-3b2b561e8f82","groups":["system:serviceaccounts","system:serviceaccounts:openshift-monitoring","system:authenticated"]},"sourceIPs":["10.129.2.6"],"userAgent":"Prometheus/2.23.0","responseStatus":{"metadata":{},"code":200},"requestReceivedTimestamp":"2021-03-08T18:02:04.086545Z","stageTimestamp":"2021-03-08T18:02:04.107102Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"prometheus-k8s\" of ClusterRole \"prometheus-k8s\" to ServiceAccount \"prometheus-k8s/openshift-monitoring\""}}
5353
----
5454

55-
* View the Kubernetes API server logs:
55+
* View the Kubernetes API server audit logs:
5656
57-
.. List the Kubernetes API server logs that are available for each control plane node:
57+
.. List the Kubernetes API server audit logs that are available for each control plane node:
5858
+
5959
[source,terminal]
6060
----
@@ -72,7 +72,7 @@ ci-ln-m0wpfjb-f76d1-vnb5x-master-2 audit-2021-03-09T18-37-07.511.log
7272
ci-ln-m0wpfjb-f76d1-vnb5x-master-2 audit.log
7373
----
7474

75-
.. View a specific Kubernetes API server log by providing the node name and the log name:
75+
.. View a specific Kubernetes API server audit log by providing the node name and the log name:
7676
+
7777
[source,terminal]
7878
----
@@ -92,9 +92,9 @@ $ oc adm node-logs ci-ln-m0wpfjb-f76d1-vnb5x-master-0 --path=kube-apiserver/audi
9292
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"cfce8a0b-b5f5-4365-8c9f-79c1227d10f9","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/openshift-kube-scheduler/serviceaccounts/openshift-kube-scheduler-sa","verb":"get","user":{"username":"system:serviceaccount:openshift-kube-scheduler-operator:openshift-kube-scheduler-operator","uid":"2574b041-f3c8-44e6-a057-baef7aa81516","groups":["system:serviceaccounts","system:serviceaccounts:openshift-kube-scheduler-operator","system:authenticated"]},"sourceIPs":["10.128.0.8"],"userAgent":"cluster-kube-scheduler-operator/v0.0.0 (linux/amd64) kubernetes/$Format","objectRef":{"resource":"serviceaccounts","namespace":"openshift-kube-scheduler","name":"openshift-kube-scheduler-sa","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":200},"requestReceivedTimestamp":"2021-03-08T18:06:42.512619Z","stageTimestamp":"2021-03-08T18:06:42.516145Z","annotations":{"authentication.k8s.io/legacy-token":"system:serviceaccount:openshift-kube-scheduler-operator:openshift-kube-scheduler-operator","authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"system:openshift:operator:cluster-kube-scheduler-operator\" of ClusterRole \"cluster-admin\" to ServiceAccount \"openshift-kube-scheduler-operator/openshift-kube-scheduler-operator\""}}
9393
----
9494

95-
* View the OpenShift OAuth API server logs:
95+
* View the OpenShift OAuth API server audit logs:
9696
97-
.. List the OpenShift OAuth API server logs that are available for each control plane node:
97+
.. List the OpenShift OAuth API server audit logs that are available for each control plane node:
9898
+
9999
[source,terminal]
100100
----
@@ -112,7 +112,7 @@ ci-ln-m0wpfjb-f76d1-vnb5x-master-2 audit-2021-03-09T17-36-06.510.log
112112
ci-ln-m0wpfjb-f76d1-vnb5x-master-2 audit.log
113113
----
114114

115-
.. View a specific OpenShift OAuth API server log by providing the node name and the log name:
115+
.. View a specific OpenShift OAuth API server audit log by providing the node name and the log name:
116116
+
117117
[source,terminal]
118118
----
@@ -131,3 +131,45 @@ $ oc adm node-logs ci-ln-m0wpfjb-f76d1-vnb5x-master-0 --path=oauth-apiserver/aud
131131
----
132132
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"dd4c44e2-3ea1-4830-9ab7-c91a5f1388d6","stage":"ResponseComplete","requestURI":"/apis/user.openshift.io/v1/users/~","verb":"get","user":{"username":"system:serviceaccount:openshift-monitoring:prometheus-k8s","groups":["system:serviceaccounts","system:serviceaccounts:openshift-monitoring","system:authenticated"]},"sourceIPs":["10.0.32.4","10.128.0.1"],"userAgent":"dockerregistry/v0.0.0 (linux/amd64) kubernetes/$Format","objectRef":{"resource":"users","name":"~","apiGroup":"user.openshift.io","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":200},"requestReceivedTimestamp":"2021-03-08T17:47:43.653187Z","stageTimestamp":"2021-03-08T17:47:43.660187Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"basic-users\" of ClusterRole \"basic-user\" to Group \"system:authenticated\""}}
133133
----
134+
135+
* View the OpenShift OAuth server audit logs:
136+
137+
.. List the OpenShift OAuth server audit logs that are available for each control plane node:
138+
+
139+
[source,terminal]
140+
----
141+
$ oc adm node-logs --role=master --path=oauth-server/
142+
----
143+
+
144+
.Example output
145+
[source,terminal]
146+
----
147+
ci-ln-m0wpfjb-f76d1-vnb5x-master-0 audit-2022-05-11T18-57-32.395.log
148+
ci-ln-m0wpfjb-f76d1-vnb5x-master-0 audit.log
149+
ci-ln-m0wpfjb-f76d1-vnb5x-master-1 audit-2022-05-11T19-07-07.021.log
150+
ci-ln-m0wpfjb-f76d1-vnb5x-master-1 audit.log
151+
ci-ln-m0wpfjb-f76d1-vnb5x-master-2 audit-2022-05-11T19-06-51.844.log
152+
ci-ln-m0wpfjb-f76d1-vnb5x-master-2 audit.log
153+
----
154+
155+
.. View a specific OpenShift OAuth server audit log by providing the node name and the log name:
156+
+
157+
[source,terminal]
158+
----
159+
$ oc adm node-logs <node_name> --path=oauth-server/<log_name>
160+
----
161+
+
162+
For example:
163+
+
164+
[source,terminal]
165+
----
166+
$ oc adm node-logs ci-ln-m0wpfjb-f76d1-vnb5x-master-0 --path=oauth-server/audit-2022-05-11T18-57-32.395.log
167+
----
168+
+
169+
.Example output
170+
[source,terminal]
171+
----
172+
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"13c20345-f33b-4b7d-b3b6-e7793f805621","stage":"ResponseComplete","requestURI":"/login","verb":"post","user":{"username":"system:anonymous","groups":["system:unauthenticated"]},"sourceIPs":["10.128.2.6"],"userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0","responseStatus":{"metadata":{},"code":302},"requestReceivedTimestamp":"2022-05-11T17:31:16.280155Z","stageTimestamp":"2022-05-11T17:31:16.297083Z","annotations":{"authentication.openshift.io/decision":"error","authentication.openshift.io/username":"kubeadmin","authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":""}}
173+
----
174+
+
175+
The possible values for the `authentication.openshift.io/decision` annotation are `allow`, `deny`, or `error`.

‎modules/security-audit-log-filtering.adoc

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,3 +57,12 @@ $ oc adm node-logs node-1.example.com \
5757
--path=oauth-apiserver/audit.log \
5858
| jq 'select(.verb != "get")'
5959
----
60+
61+
* Filter OpenShift OAuth server audit logs by events that identified a username and failed with an error:
62+
+
63+
[source,terminal]
64+
----
65+
$ oc adm node-logs node-1.example.com \
66+
--path=oauth-server/audit.log \
67+
| jq 'select(.annotations["authentication.openshift.io/username"] != null and .annotations["authentication.openshift.io/decision"] == "error")'
68+
----

0 commit comments

Comments
 (0)