Skip to content

Commit 8390399

Browse files
jab-rhjab-rh
committed
OSDOCS-3546: Egress firewall supports logging
Because the logging mechanism for EgressFirewall is an extension of that for network policy, this PR reshuffles and expands the content to reflect this. The new location of the content is with the rest of the OVN-Kubernetes documentation. - https://issues.redhat.com/browse/OSDOCS-3546
1 parent 7b98173 commit 8390399

9 files changed

+30
-27
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1029,8 +1029,6 @@ Topics:
10291029
Topics:
10301030
- Name: About network policy
10311031
File: about-network-policy
1032-
- Name: Logging network policy
1033-
File: logging-network-policy
10341032
- Name: Creating a network policy
10351033
File: creating-network-policy
10361034
- Name: Viewing a network policy
@@ -1155,6 +1153,8 @@ Topics:
11551153
File: rollback-to-openshift-sdn
11561154
- Name: Converting to IPv4/IPv6 dual stack networking
11571155
File: converting-to-dual-stack
1156+
- Name: Logging for egress firewall and network policy rules
1157+
File: logging-network-policy
11581158
- Name: Configuring IPsec encryption
11591159
File: configuring-ipsec-ovn
11601160
- Name: Configuring an egress firewall for a project

‎logging/cluster-logging-external.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -198,6 +198,6 @@ include::modules/cluster-logging-collector-collecting-ovn-logs.adoc[leveloffset=
198198
[role="_additional-resources"]
199199
.Additional resources
200200

201-
* xref:../networking/network_policy/logging-network-policy.adoc#nw-networkpolicy-audit-concept_logging-network-policy[Network policy audit logging]
201+
* xref:../networking/ovn_kubernetes_network_provider/logging-network-policy.adoc#logging-network-policy[Logging for egress firewall and network policy rules]
202202

203203
include::modules/cluster-logging-troubleshooting-log-forwarding.adoc[leveloffset=+1]

‎modules/nw-networkpolicy-audit-concept.adoc

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
[id="nw-networkpolicy-audit-concept_{context}"]
2-
= Network policy audit logging
2+
= Audit logging
33

4-
The OVN-Kubernetes cluster network provider uses Open Virtual Network (OVN) ACLs to manage network policy. Audit logging exposes allow and deny ACL events.
4+
The OVN-Kubernetes cluster network provider uses Open Virtual Network (OVN) ACLs to manage egress firewalls and network policies. Audit logging exposes allow and deny ACL events.
55

6-
You can configure the destination for network policy audit logs, such as a syslog server or a UNIX domain socket.
6+
You can configure the destination for audit logs, such as a syslog server or a UNIX domain socket.
77
Regardless of any additional configuration, an audit log is always saved to `/var/log/ovn/acl-audit-log.log` on each OVN-Kubernetes pod in the cluster.
88

9-
Network policy audit logging is enabled per namespace by annotating the namespace with the `k8s.ovn.org/acl-logging` key as in the following example:
9+
Audit logging is enabled per namespace by annotating the namespace with the `k8s.ovn.org/acl-logging` key as in the following example:
1010

1111
.Example namespace annotation
1212
[source,yaml]
@@ -25,22 +25,22 @@ metadata:
2525

2626
The logging format is compatible with syslog as defined by RFC5424. The syslog facility is configurable and defaults to `local0`. An example log entry might resemble the following:
2727

28-
.Example ACL deny log entry
28+
.Example ACL deny log entry for a network policy
2929
[source,text]
3030
----
3131
2021-06-13T19:33:11.590Z|00005|acl_log(ovn_pinctrl0)|INFO|name="verify-audit-logging_deny-all", verdict=drop, severity=alert: icmp,vlan_tci=0x0000,dl_src=0a:58:0a:80:02:39,dl_dst=0a:58:0a:80:02:37,nw_src=10.128.2.57,nw_dst=10.128.2.55,nw_tos=0,nw_ecn=0,nw_ttl=64,icmp_type=8,icmp_code=0
3232
----
3333

3434
The following table describes namespace annotation values:
3535

36-
.Network policy audit logging namespace annotation
36+
.Audit logging namespace annotation
3737
[cols=".^4,.^6a",options="header"]
3838
|====
3939
|Annotation|Value
4040

4141
|`k8s.ovn.org/acl-logging`
4242
|
43-
You must specify at least one of `allow`, `deny`, or both to enable network policy audit logging for a namespace.
43+
You must specify at least one of `allow`, `deny`, or both to enable audit logging for a namespace.
4444

4545
`deny`:: Optional: Specify `alert`, `warning`, `notice`, `info`, or `debug`.
4646
`allow`:: Optional: Specify `alert`, `warning`, `notice`, `info`, or `debug`.

‎modules/nw-networkpolicy-audit-configure.adoc

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
:_content-type: PROCEDURE
22
[id="nw-networkpolicy-audit-configure_{context}"]
3-
= Configuring network policy auditing for a cluster
3+
= Configuring egress firewall and network policy auditing for a cluster
44

5-
As a cluster administrator, you can customize network policy audit logging for your cluster.
5+
As a cluster administrator, you can customize audit logging for your cluster.
66

77
.Prerequisites
88

@@ -11,7 +11,7 @@ As a cluster administrator, you can customize network policy audit logging for y
1111
1212
.Procedure
1313

14-
* To customize the network policy audit logging configuration, enter the following command:
14+
* To customize the audit logging configuration, enter the following command:
1515
+
1616
[source,terminal]
1717
----

‎modules/nw-networkpolicy-audit-disable.adoc

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
:_content-type: PROCEDURE
22
[id="nw-networkpolicy-audit-disable_{context}"]
3-
= Disabling network policy audit logging for a namespace
3+
= Disabling egress firewall and network policy audit logging for a namespace
44

5-
As a cluster administrator, you can disable network policy audit logging for a namespace.
5+
As a cluster administrator, you can disable audit logging for a namespace.
66

77
.Prerequisites
88

@@ -11,7 +11,7 @@ As a cluster administrator, you can disable network policy audit logging for a n
1111
1212
.Procedure
1313

14-
* To disable network policy audit logging for a namespace, enter the following command:
14+
* To disable audit logging for a namespace, enter the following command:
1515
+
1616
[source,terminal]
1717
----

‎modules/nw-networkpolicy-audit-enable.adoc

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
:_content-type: PROCEDURE
22
[id="nw-networkpolicy-audit-enable_{context}"]
3-
= Enabling network policy audit logging for a namespace
3+
= Enabling egress firewall and network policy audit logging for a namespace
44

5-
As a cluster administrator, you can enable network policy audit logging for a namespace.
5+
As a cluster administrator, you can enable audit logging for a namespace.
66

77
.Prerequisites
88

@@ -11,7 +11,7 @@ As a cluster administrator, you can enable network policy audit logging for a na
1111
1212
.Procedure
1313

14-
* To enable network policy audit logging for a namespace, enter the following command:
14+
* To enable audit logging for a namespace, enter the following command:
1515
+
1616
[source,terminal]
1717
----
@@ -52,7 +52,7 @@ namespace/verify-audit-logging annotated
5252
5353
.Verification
5454
55-
* Display the latest entries in the network policy audit log:
55+
* Display the latest entries in the audit log:
5656
+
5757
[source,terminal]
5858
----

‎networking/network_policy/creating-network-policy.adoc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,4 +24,5 @@ ifndef::openshift-rosa,openshift-dedicated[]
2424
== Additional resources
2525
2626
* xref:../../web_console/web-console.adoc#web-console[Accessing the web console]
27+
* xref:../../networking/ovn_kubernetes_network_provider/logging-network-policy.adoc#logging-network-policy[Logging for egress firewall and network policy rules]
2728
endif::[]

‎networking/ovn_kubernetes_network_provider/about-ovn-kubernetes.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ include::modules/nw-ovn-kuberentes-limitations.adoc[leveloffset=+1]
3030

3131
* xref:../../networking/ovn_kubernetes_network_provider/configuring-egress-firewall-ovn.adoc#configuring-egress-firewall-ovn[Configuring an egress firewall for a project]
3232
* xref:../../networking/network_policy/about-network-policy.adoc#about-network-policy[About network policy]
33-
* xref:../../networking/network_policy/logging-network-policy.adoc#logging-network-policy[Logging network policy events]
33+
* xref:../../networking/ovn_kubernetes_network_provider/logging-network-policy.adoc#logging-network-policy[Logging network policy events]
3434
* xref:../../networking/ovn_kubernetes_network_provider/enabling-multicast.adoc#nw-ovn-kubernetes-enabling-multicast[Enabling multicast for a project]
3535
* xref:../../networking/ovn_kubernetes_network_provider/configuring-ipsec-ovn.adoc#configuring-ipsec-ovn[Configuring IPsec encryption]
3636
* xref:../../rest_api/operator_apis/network-operator-openshift-io-v1.adoc#network-operator-openshift-io-v1[Network [operator.openshift.io/v1\]]

‎networking/network_policy/logging-network-policy.adoc renamed to ‎networking/ovn_kubernetes_network_provider/logging-network-policy.adoc

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,24 @@
11
:_content-type: ASSEMBLY
22
[id="logging-network-policy"]
3-
= Logging network policy events
3+
= Logging for egress firewall and network policy rules
44
include::_attributes/common-attributes.adoc[]
55
:context: logging-network-policy
66

77
toc::[]
88

9-
As a cluster administrator, you can configure network policy audit logging for your cluster and enable logging for one or more namespaces.
9+
As a cluster administrator, you can configure audit logging for your cluster and enable logging for one or more namespaces. {product-title} produces audit logs for both egress firewalls and network policies.
1010

1111
[NOTE]
1212
====
13-
Audit logging of network policies is available for only the xref:../../networking/ovn_kubernetes_network_provider/about-ovn-kubernetes.adoc#about-ovn-kubernetes[OVN-Kubernetes cluster network provider].
13+
Audit logging is available for only the xref:../../networking/ovn_kubernetes_network_provider/about-ovn-kubernetes.adoc#about-ovn-kubernetes[OVN-Kubernetes cluster network provider].
1414
====
1515

1616
include::modules/nw-networkpolicy-audit-concept.adoc[leveloffset=+1]
1717

18-
== Network policy audit configuration
18+
[id="network-policy-audit-configuration-{context}"]
19+
== Audit configuration
1920

20-
The configuration for audit logging is specified as part of the OVN-Kubernetes cluster network provider configuration. The following YAML illustrates default values for network policy audit logging feature.
21+
The configuration for audit logging is specified as part of the OVN-Kubernetes cluster network provider configuration. The following YAML illustrates the default values for the audit logging:
2122

2223
.Audit logging configuration
2324
[source,yaml]
@@ -36,7 +37,7 @@ spec:
3637
syslogFacility: local0
3738
----
3839

39-
The following table describes the configuration fields for network policy audit logging.
40+
The following table describes the configuration fields for audit logging.
4041

4142
include::modules/nw-operator-cr.adoc[tag=policy-audit]
4243

@@ -49,3 +50,4 @@ include::modules/nw-networkpolicy-audit-disable.adoc[leveloffset=+1]
4950
== Additional resources
5051

5152
* xref:../../networking/network_policy/about-network-policy.adoc#about-network-policy[About network policy]
53+
* xref:../../networking/ovn_kubernetes_network_provider/configuring-egress-firewall-ovn.adoc#configuring-egress-firewall-ovn[Configuring an egress firewall for a project]

0 commit comments

Comments
 (0)