Skip to content

Commit 6418f35

Browse files
bergerhofferbergerhoffer
authored
Merge pull request #30435 from bergerhoffer/adding-oauth-api-server-example
Adding examples for viewing OAuth API server audit logs
2 parents 3487cd6 + c8be92a commit 6418f35

File tree

2 files changed

+63
-43
lines changed

2 files changed

+63
-43
lines changed

‎modules/nodes-nodes-audit-log-basic-viewing.adoc‎

Lines changed: 61 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -3,17 +3,17 @@
33
// * security/audit-log-view.adoc
44

55
[id="nodes-nodes-audit-log-basic-viewing_{context}"]
6-
= Viewing the audit log
6+
= Viewing the audit logs
77

8-
You can view logs for the {product-title} API server or the Kubernetes API server for each master node.
8+
You can view the logs for the OpenShift API server, Kubernetes API server, and OpenShift OAuth API server for each master node.
99

1010
.Procedure
1111

12-
To view the audit log:
12+
To view the audit logs:
1313

14-
. View the {product-title} API server logs
14+
* View the OpenShift API server logs:
1515

16-
.. If necessary, get the node name of the log you want to view:
16+
.. List the OpenShift API server logs that are available for each master node:
1717
+
1818
[source,terminal]
1919
----
@@ -23,90 +23,110 @@ $ oc adm node-logs --role=master --path=openshift-apiserver/
2323
.Example output
2424
[source,terminal]
2525
----
26-
ip-10-0-140-97.ec2.internal audit-2019-04-09T00-12-19.834.log
27-
ip-10-0-140-97.ec2.internal audit-2019-04-09T11-13-00.469.log
28-
ip-10-0-140-97.ec2.internal audit.log
29-
ip-10-0-153-35.ec2.internal audit-2019-04-09T00-11-49.835.log
30-
ip-10-0-153-35.ec2.internal audit-2019-04-09T11-08-30.469.log
31-
ip-10-0-153-35.ec2.internal audit.log
32-
ip-10-0-170-165.ec2.internal audit-2019-04-09T00-13-00.128.log
33-
ip-10-0-170-165.ec2.internal audit-2019-04-09T11-10-04.082.log
34-
ip-10-0-170-165.ec2.internal audit.log
26+
ci-ln-m0wpfjb-f76d1-vnb5x-master-0 audit-2021-03-09T00-12-19.834.log
27+
ci-ln-m0wpfjb-f76d1-vnb5x-master-0 audit.log
28+
ci-ln-m0wpfjb-f76d1-vnb5x-master-1 audit-2021-03-09T00-11-49.835.log
29+
ci-ln-m0wpfjb-f76d1-vnb5x-master-1 audit.log
30+
ci-ln-m0wpfjb-f76d1-vnb5x-master-2 audit-2021-03-09T00-13-00.128.log
31+
ci-ln-m0wpfjb-f76d1-vnb5x-master-2 audit.log
3532
----
3633

37-
.. View the {product-title} API server log for a specific master node and timestamp or view all the logs for that master:
34+
.. View a specific OpenShift API server log by providing the node name and the log name:
3835
+
3936
[source,terminal]
4037
----
41-
$ oc adm node-logs <node-name> --path=openshift-apiserver/<log-name>
38+
$ oc adm node-logs <node_name> --path=openshift-apiserver/<log_name>
4239
----
4340
+
4441
For example:
4542
+
4643
[source,terminal]
4744
----
48-
$ oc adm node-logs ip-10-0-140-97.ec2.internal --path=openshift-apiserver/audit-2019-04-08T13-09-01.227.log
45+
$ oc adm node-logs ci-ln-m0wpfjb-f76d1-vnb5x-master-0 --path=openshift-apiserver/audit-2021-03-09T00-12-19.834.log
4946
----
5047
+
48+
.Example output
5149
[source,terminal]
5250
----
53-
$ oc adm node-logs ip-10-0-140-97.ec2.internal --path=openshift-apiserver/audit.log
51+
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"381acf6d-5f30-4c7d-8175-c9c317ae5893","stage":"ResponseComplete","requestURI":"/metrics","verb":"get","user":{"username":"system:serviceaccount:openshift-monitoring:prometheus-k8s","uid":"825b60a0-3976-4861-a342-3b2b561e8f82","groups":["system:serviceaccounts","system:serviceaccounts:openshift-monitoring","system:authenticated"]},"sourceIPs":["10.129.2.6"],"userAgent":"Prometheus/2.23.0","responseStatus":{"metadata":{},"code":200},"requestReceivedTimestamp":"2021-03-08T18:02:04.086545Z","stageTimestamp":"2021-03-08T18:02:04.107102Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"prometheus-k8s\" of ClusterRole \"prometheus-k8s\" to ServiceAccount \"prometheus-k8s/openshift-monitoring\""}}
5452
----
53+
54+
* View the Kubernetes API server logs:
55+
56+
.. List the Kubernetes API server logs that are available for each master node:
5557
+
56-
The output appears similar to the following:
58+
[source,terminal]
59+
----
60+
$ oc adm node-logs --role=master --path=kube-apiserver/
61+
----
5762
+
5863
.Example output
5964
[source,terminal]
6065
----
61-
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"ad209ce1-fec7-4130-8192-c4cc63f1d8cd","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/openshift-kube-controller-manager/configmaps/cert-recovery-controller-lock?timeout=35s","verb":"update","user":{"username":"system:serviceaccount:openshift-kube-controller-manager:localhost-recovery-client","uid":"dd4997e3-d565-4e37-80f8-7fc122ccd785","groups":["system:serviceaccounts","system:serviceaccounts:openshift-kube-controller-manager","system:authenticated"]},"sourceIPs":["::1"],"userAgent":"cluster-kube-controller-manager-operator/v0.0.0 (linux/amd64) kubernetes/$Format","objectRef":{"resource":"configmaps","namespace":"openshift-kube-controller-manager","name":"cert-recovery-controller-lock","uid":"5c57190b-6993-425d-8101-8337e48c7548","apiVersion":"v1","resourceVersion":"574307"},"responseStatus":{"metadata":{},"code":200},"requestReceivedTimestamp":"2020-04-02T08:27:20.200962Z","stageTimestamp":"2020-04-02T08:27:20.206710Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"system:openshift:operator:kube-controller-manager-recovery\" of ClusterRole \"cluster-admin\" to ServiceAccount \"localhost-recovery-client/openshift-kube-controller-manager\""}}
66+
ci-ln-m0wpfjb-f76d1-vnb5x-master-0 audit-2021-03-09T14-07-27.129.log
67+
ci-ln-m0wpfjb-f76d1-vnb5x-master-0 audit.log
68+
ci-ln-m0wpfjb-f76d1-vnb5x-master-1 audit-2021-03-09T19-24-22.620.log
69+
ci-ln-m0wpfjb-f76d1-vnb5x-master-1 audit.log
70+
ci-ln-m0wpfjb-f76d1-vnb5x-master-2 audit-2021-03-09T18-37-07.511.log
71+
ci-ln-m0wpfjb-f76d1-vnb5x-master-2 audit.log
6272
----
6373

64-
. View the Kubernetes API server logs:
65-
66-
.. If necessary, get the node name of the log you want to view:
74+
.. View a specific Kubernetes API server log by providing the node name and the log name:
6775
+
6876
[source,terminal]
6977
----
70-
$ oc adm node-logs --role=master --path=kube-apiserver/
78+
$ oc adm node-logs <node_name> --path=kube-apiserver/<log_name>
79+
----
80+
+
81+
For example:
82+
+
83+
[source,terminal]
84+
----
85+
$ oc adm node-logs ci-ln-m0wpfjb-f76d1-vnb5x-master-0 --path=kube-apiserver/audit-2021-03-09T14-07-27.129.log
7186
----
7287
+
7388
.Example output
7489
[source,terminal]
7590
----
76-
ip-10-0-140-97.ec2.internal audit-2019-04-09T14-07-27.129.log
77-
ip-10-0-140-97.ec2.internal audit-2019-04-09T19-18-32.542.log
78-
ip-10-0-140-97.ec2.internal audit.log
79-
ip-10-0-153-35.ec2.internal audit-2019-04-09T19-24-22.620.log
80-
ip-10-0-153-35.ec2.internal audit-2019-04-09T19-51-30.905.log
81-
ip-10-0-153-35.ec2.internal audit.log
82-
ip-10-0-170-165.ec2.internal audit-2019-04-09T18-37-07.511.log
83-
ip-10-0-170-165.ec2.internal audit-2019-04-09T19-21-14.371.log
84-
ip-10-0-170-165.ec2.internal audit.log
91+
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"cfce8a0b-b5f5-4365-8c9f-79c1227d10f9","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/openshift-kube-scheduler/serviceaccounts/openshift-kube-scheduler-sa","verb":"get","user":{"username":"system:serviceaccount:openshift-kube-scheduler-operator:openshift-kube-scheduler-operator","uid":"2574b041-f3c8-44e6-a057-baef7aa81516","groups":["system:serviceaccounts","system:serviceaccounts:openshift-kube-scheduler-operator","system:authenticated"]},"sourceIPs":["10.128.0.8"],"userAgent":"cluster-kube-scheduler-operator/v0.0.0 (linux/amd64) kubernetes/$Format","objectRef":{"resource":"serviceaccounts","namespace":"openshift-kube-scheduler","name":"openshift-kube-scheduler-sa","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":200},"requestReceivedTimestamp":"2021-03-08T18:06:42.512619Z","stageTimestamp":"2021-03-08T18:06:42.516145Z","annotations":{"authentication.k8s.io/legacy-token":"system:serviceaccount:openshift-kube-scheduler-operator:openshift-kube-scheduler-operator","authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"system:openshift:operator:cluster-kube-scheduler-operator\" of ClusterRole \"cluster-admin\" to ServiceAccount \"openshift-kube-scheduler-operator/openshift-kube-scheduler-operator\""}}
8592
----
8693

87-
.. View the Kubernetes API server log for a specific master node and timestamp or view all the logs for that master:
94+
* View the OpenShift OAuth API server logs:
95+
96+
.. List the OpenShift OAuth API server logs that are available for each master node:
8897
+
8998
[source,terminal]
9099
----
91-
$ oc adm node-logs <node-name> --path=kube-apiserver/<log-name>
100+
$ oc adm node-logs --role=master --path=oauth-apiserver/
92101
----
93102
+
94-
For example:
95-
+
103+
.Example output
96104
[source,terminal]
97105
----
98-
$ oc adm node-logs ip-10-0-140-97.ec2.internal --path=kube-apiserver/audit-2019-04-09T14-07-27.129.log
106+
ci-ln-m0wpfjb-f76d1-vnb5x-master-0 audit-2021-03-09T13-06-26.128.log
107+
ci-ln-m0wpfjb-f76d1-vnb5x-master-0 audit.log
108+
ci-ln-m0wpfjb-f76d1-vnb5x-master-1 audit-2021-03-09T18-23-21.619.log
109+
ci-ln-m0wpfjb-f76d1-vnb5x-master-1 audit.log
110+
ci-ln-m0wpfjb-f76d1-vnb5x-master-2 audit-2021-03-09T17-36-06.510.log
111+
ci-ln-m0wpfjb-f76d1-vnb5x-master-2 audit.log
99112
----
113+
114+
.. View a specific OpenShift OAuth API server log by providing the node name and the log name:
100115
+
101116
[source,terminal]
102117
----
103-
$ oc adm node-logs ip-10-0-170-165.ec2.internal --path=kube-apiserver/audit.log
118+
$ oc adm node-logs <node_name> --path=oauth-apiserver/<log_name>
104119
----
105120
+
106-
The output appears similar to the following:
121+
For example:
122+
+
123+
[source,terminal]
124+
----
125+
$ oc adm node-logs ci-ln-m0wpfjb-f76d1-vnb5x-master-0 --path=oauth-apiserver/audit-2021-03-09T13-06-26.128.log
126+
----
107127
+
108128
.Example output
109129
[source,terminal]
110130
----
111-
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"ad209ce1-fec7-4130-8192-c4cc63f1d8cd","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/openshift-kube-controller-manager/configmaps/cert-recovery-controller-lock?timeout=35s","verb":"update","user":{"username":"system:serviceaccount:openshift-kube-controller-manager:localhost-recovery-client","uid":"dd4997e3-d565-4e37-80f8-7fc122ccd785","groups":["system:serviceaccounts","system:serviceaccounts:openshift-kube-controller-manager","system:authenticated"]},"sourceIPs":["::1"],"userAgent":"cluster-kube-controller-manager-operator/v0.0.0 (linux/amd64) kubernetes/$Format","objectRef":{"resource":"configmaps","namespace":"openshift-kube-controller-manager","name":"cert-recovery-controller-lock","uid":"5c57190b-6993-425d-8101-8337e48c7548","apiVersion":"v1","resourceVersion":"574307"},"responseStatus":{"metadata":{},"code":200},"requestReceivedTimestamp":"2020-04-02T08:27:20.200962Z","stageTimestamp":"2020-04-02T08:27:20.206710Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"system:openshift:operator:kube-controller-manager-recovery\" of ClusterRole \"cluster-admin\" to ServiceAccount \"localhost-recovery-client/openshift-kube-controller-manager\""}}
131+
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"dd4c44e2-3ea1-4830-9ab7-c91a5f1388d6","stage":"ResponseComplete","requestURI":"/apis/user.openshift.io/v1/users/~","verb":"get","user":{"username":"system:serviceaccount:openshift-monitoring:prometheus-k8s","groups":["system:serviceaccounts","system:serviceaccounts:openshift-monitoring","system:authenticated"]},"sourceIPs":["10.0.32.4","10.128.0.1"],"userAgent":"dockerregistry/v0.0.0 (linux/amd64) kubernetes/$Format","objectRef":{"resource":"users","name":"~","apiGroup":"user.openshift.io","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":200},"requestReceivedTimestamp":"2021-03-08T17:47:43.653187Z","stageTimestamp":"2021-03-08T17:47:43.660187Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"basic-users\" of ClusterRole \"basic-user\" to Group \"system:authenticated\""}}
112132
----

‎modules/security-audit-log-filtering.adoc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,11 +48,11 @@ $ oc adm node-logs node-1.example.com \
4848
| jq 'select(.requestURI | startswith("/apis/apiextensions.k8s.io/v1beta1")) | .userAgent'
4949
----
5050

51-
* Filter Kubernetes API server audit logs by excluding a verb:
51+
* Filter OpenShift OAuth API server audit logs by excluding a verb:
5252
+
5353
[source,terminal]
5454
----
5555
$ oc adm node-logs node-1.example.com \
56-
--path=kube-apiserver/audit.log \
56+
--path=oauth-apiserver/audit.log \
5757
| jq 'select(.verb != "get")'
5858
----

0 commit comments

Comments
 (0)