Skip to content

Commit e41e433

Browse files
bergerhofferbergerhoffer
authored
Merge pull request #36229 from bergerhoffer/OSDOCS-1801
OSDOCS-1801: Adding new audit policy options
2 parents 6316d9d + 98446bd commit e41e433

File tree

5 files changed

+175
-11
lines changed

5 files changed

+175
-11
lines changed

‎modules/nodes-nodes-audit-config-about.adoc‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ Audit log profiles define how to log requests that come to the OpenShift API ser
99

1010
{product-title} provides the following predefined audit policy profiles:
1111

12-
[cols="1,2",options="header"]
12+
[cols="1,2a",options="header"]
1313
|===
1414
|Profile
1515
|Description
@@ -22,6 +22,15 @@ Audit log profiles define how to log requests that come to the OpenShift API ser
2222

2323
|`AllRequestBodies`
2424
|In addition to logging metadata for all requests, logs request bodies for every read and write request to the API servers (`get`, `list`, `create`, `update`, `patch`). This profile has the most resource overhead. ^[1]^
25+
26+
|`None`
27+
|No requests are logged; even OAuth access token requests and OAuth authorize token requests are not logged.
28+
29+
[WARNING]
30+
====
31+
It is not recommended to disable audit logging by using the `None` profile unless you are fully aware of the risks of not logging data that can be beneficial when troubleshooting issues. If you disable audit logging and a support situation arises, you might need to enable audit logging and reproduce the issue in order to troubleshoot properly.
32+
====
33+
2534
|===
2635
[.small]
2736
--

‎modules/nodes-nodes-audit-policy-custom.adoc‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/audit-log-policy-config.adoc
4+
5+
[id="configuring-audit-policy-custom_{context}"]
6+
= Configuring the audit log policy with custom rules
7+
8+
You can configure an audit log policy that defines custom rules. You can specify multiple groups and define which profile to use for that group.
9+
10+
These custom rules take precedence over the top-level profile field. The custom rules are evaluated from top to bottom, and the first that matches is applied.
11+
12+
.Prerequisites
13+
14+
* You have access to the cluster as a user with the `cluster-admin` role.
15+
16+
.Procedure
17+
18+
. Edit the `APIServer` resource:
19+
+
20+
[source,terminal]
21+
----
22+
$ oc edit apiserver cluster
23+
----
24+
25+
. Add the `spec.audit.customRules` field:
26+
+
27+
[source,yaml]
28+
----
29+
apiVersion: config.openshift.io/v1
30+
kind: APIServer
31+
metadata:
32+
...
33+
spec:
34+
audit:
35+
customRules: <1>
36+
- group: system:authenticated:oauth
37+
profile: WriteRequestBodies
38+
- group: system:authenticated
39+
profile: AllRequestBodies
40+
profile: Default <2>
41+
----
42+
<1> Add one or more groups and specify the profile to use for that group. These custom rules take precedence over the top-level profile field. The custom rules are evaluated from top to bottom, and the first that matches is applied.
43+
<2> Set to `Default`, `WriteRequestBodies`, `AllRequestBodies`, or `None`. If you do not set this top-level `audit.profile` field, it defaults to the `Default` profile.
44+
+
45+
[WARNING]
46+
====
47+
It is not recommended to disable audit logging by using the `None` profile unless you are fully aware of the risks of not logging data that can be beneficial when troubleshooting issues. If you disable audit logging and a support situation arises, you might need to enable audit logging and reproduce the issue in order to troubleshoot properly.
48+
====
49+
50+
. Save the file to apply the changes.
51+
52+
.Verification
53+
54+
* Verify that a new revision of the Kubernetes API server pods is rolled out. It can take several minutes for all nodes to update to the new revision.
55+
+
56+
[source,terminal]
57+
----
58+
$ oc get kubeapiserver -o=jsonpath='{range .items[0].status.conditions[?(@.type=="NodeInstallerProgressing")]}{.reason}{"\n"}{.message}{"\n"}'
59+
----
60+
+
61+
Review the `NodeInstallerProgressing` status condition for the Kubernetes API server to verify that all nodes are at the latest revision. The output shows `AllNodesAtLatestRevision` upon successful update:
62+
+
63+
[source,terminal]
64+
----
65+
AllNodesAtLatestRevision
66+
3 nodes are at revision 12 <1>
67+
----
68+
<1> In this example, the latest revision number is `12`.
69+
+
70+
If the output shows a message similar to one of the following messages, the update is still in progress. Wait a few minutes and try again.
71+
72+
** `3 nodes are at revision 11; 0 nodes have achieved new revision 12`
73+
** `2 nodes are at revision 11; 1 nodes are at revision 12`

‎modules/nodes-nodes-audit-policy-disable.adoc‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/audit-log-policy-config.adoc
4+
5+
[id="configuring-audit-policy-disable_{context}"]
6+
= Disabling audit logging
7+
8+
You can disable audit logging for {product-title}. When you disable audit logging, even OAuth access token requests and OAuth authorize token requests are not logged.
9+
10+
[WARNING]
11+
====
12+
It is not recommended to disable audit logging by using the `None` profile unless you are fully aware of the risks of not logging data that can be beneficial when troubleshooting issues. If you disable audit logging and a support situation arises, you might need to enable audit logging and reproduce the issue in order to troubleshoot properly.
13+
====
14+
15+
.Prerequisites
16+
17+
* You have access to the cluster as a user with the `cluster-admin` role.
18+
19+
.Procedure
20+
21+
. Edit the `APIServer` resource:
22+
+
23+
[source,terminal]
24+
----
25+
$ oc edit apiserver cluster
26+
----
27+
28+
. Set the `spec.audit.profile` field to `None`:
29+
+
30+
[source,yaml]
31+
----
32+
apiVersion: config.openshift.io/v1
33+
kind: APIServer
34+
metadata:
35+
...
36+
spec:
37+
audit:
38+
profile: None
39+
----
40+
+
41+
[NOTE]
42+
====
43+
You can also disable audit logging only for specific groups by specifying custom rules in the `spec.audit.customRules` field.
44+
====
45+
46+
. Save the file to apply the changes.
47+
48+
.Verification
49+
50+
* Verify that a new revision of the Kubernetes API server pods is rolled out. It can take several minutes for all nodes to update to the new revision.
51+
+
52+
[source,terminal]
53+
----
54+
$ oc get kubeapiserver -o=jsonpath='{range .items[0].status.conditions[?(@.type=="NodeInstallerProgressing")]}{.reason}{"\n"}{.message}{"\n"}'
55+
----
56+
+
57+
Review the `NodeInstallerProgressing` status condition for the Kubernetes API server to verify that all nodes are at the latest revision. The output shows `AllNodesAtLatestRevision` upon successful update:
58+
+
59+
[source,terminal]
60+
----
61+
AllNodesAtLatestRevision
62+
3 nodes are at revision 12 <1>
63+
----
64+
<1> In this example, the latest revision number is `12`.
65+
+
66+
If the output shows a message similar to one of the following messages, the update is still in progress. Wait a few minutes and try again.
67+
68+
** `3 nodes are at revision 11; 0 nodes have achieved new revision 12`
69+
** `2 nodes are at revision 11; 1 nodes are at revision 12`

‎modules/nodes-nodes-audit-policy.adoc‎

Lines changed: 17 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -24,19 +24,26 @@ $ oc edit apiserver cluster
2424
+
2525
[source,yaml]
2626
----
27-
apiVersion: config.openshift.io/v1
28-
kind: APIServer
29-
metadata:
30-
...
31-
spec:
32-
audit:
33-
profile: WriteRequestBodies <1>
27+
apiVersion: config.openshift.io/v1
28+
kind: APIServer
29+
metadata:
30+
...
31+
spec:
32+
audit:
33+
profile: WriteRequestBodies <1>
3434
----
35-
<1> Set to `Default`, `WriteRequestBodies`, or `AllRequestBodies`. The default profile is `Default`.
35+
<1> Set to `Default`, `WriteRequestBodies`, `AllRequestBodies`, or `None`. The default profile is `Default`.
36+
+
37+
[WARNING]
38+
====
39+
It is not recommended to disable audit logging by using the `None` profile unless you are fully aware of the risks of not logging data that can be beneficial when troubleshooting issues. If you disable audit logging and a support situation arises, you might need to enable audit logging and reproduce the issue in order to troubleshoot properly.
40+
====
3641

3742
. Save the file to apply the changes.
3843

39-
. Verify that a new revision of the Kubernetes API server pods has rolled out. This will take several minutes.
44+
.Verification
45+
46+
* Verify that a new revision of the Kubernetes API server pods is rolled out. It can take several minutes for all nodes to update to the new revision.
4047
+
4148
[source,terminal]
4249
----
@@ -52,7 +59,7 @@ AllNodesAtLatestRevision
5259
----
5360
<1> In this example, the latest revision number is `12`.
5461
+
55-
If the output shows a message similar to one of the following, this means that the update is still in progress. Wait a few minutes and try again.
62+
If the output shows a message similar to one of the following messages, the update is still in progress. Wait a few minutes and try again.
5663

5764
** `3 nodes are at revision 11; 0 nodes have achieved new revision 12`
5865
** `2 nodes are at revision 11; 1 nodes are at revision 12`

‎security/audit-log-policy-config.adoc‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,3 +12,9 @@ include::modules/nodes-nodes-audit-config-about.adoc[leveloffset=+1]
1212

1313
// Configuring the audit log policy
1414
include::modules/nodes-nodes-audit-policy.adoc[leveloffset=+1]
15+
16+
// Configuring the audit log policy with custom rules
17+
include::modules/nodes-nodes-audit-policy-custom.adoc[leveloffset=+1]
18+
19+
// Disabling audit logging
20+
include::modules/nodes-nodes-audit-policy-disable.adoc[leveloffset=+1]

0 commit comments

Comments
 (0)