Skip to content

Commit bcfd5b2

Browse files
jiaqiluojiaqiluo
authored
Add the instruction for enable API audit log in downstream clusters (#824)
1 parent f6a7012 commit bcfd5b2

File tree

8 files changed

+1250
-206
lines changed

8 files changed

+1250
-206
lines changed

Diff for: ‎docs/how-to-guides/advanced-user-guides/enable-api-audit-log-in-downstream-clusters.md

+142
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
---
2+
title: Enabling the API Audit Log in Downstream Clusters
3+
---
4+
5+
<head>
6+
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log-in-downstream-clusters"/>
7+
</head>
8+
9+
Kubernetes auditing provides a security-relevant chronological set of records about a cluster. Kube-apiserver performs auditing. Requests generate an event at each stage of its execution, which is then preprocessed according to a certain policy and written to a backend. The policy determines what’s recorded and the backend persists the records.
10+
11+
You might want to configure the audit log as part of compliance with the Center for Internet Security (CIS) Kubernetes Benchmark controls.
12+
13+
For configuration details, refer to the [official Kubernetes documentation](https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/).
14+
15+
16+
<Tabs groupId="k8s-distro">
17+
<TabItem value="RKE2/K3s" default>
18+
19+
:::note
20+
21+
This feature is available in Rancher v2.7.2 and above.
22+
23+
:::
24+
25+
As a prerequisite, you need to create a secret or configmap which will be the source of the audit policy.
26+
27+
The secret or configmap must meet the following two requirements:
28+
29+
1. It must be in the `fleet-default` namespace where the Cluster object exists.
30+
2. It must have the annotation `rke.cattle.io/object-authorized-for-clusters: cluster-name1,cluster-name2` which permits the target clusters to use it.
31+
32+
:::tip
33+
34+
Rancher Dashboard provides an easy-to-use form for creating the secret or configmap.
35+
36+
:::
37+
38+
Example:
39+
40+
```yaml
41+
apiVersion: v1
42+
data:
43+
audit-policy: >-
44+
IyBMb2cgYWxsIHJlcXVlc3RzIGF0IHRoZSBNZXRhZGF0YSBsZXZlbC4KYXBpVmVyc2lvbjogYXVkaXQuazhzLmlvL3YxCmtpbmQ6IFBvbGljeQpydWxlczoKLSBsZXZlbDogTWV0YWRhdGE=
45+
kind: Secret
46+
metadata:
47+
annotations:
48+
rke.cattle.io/object-authorized-for-clusters: cluster1
49+
name: name1
50+
namespace: fleet-default
51+
```
52+
53+
The audit log can be enabled and configured by editing the cluster in YAML and utilizing the `machineSelectorFiles` and `machineGlobalConfig` directives.
54+
55+
Example:
56+
57+
```yaml
58+
apiVersion: provisioning.cattle.io/v1
59+
kind: Cluster
60+
spec:
61+
rkeConfig:
62+
machineGlobalConfig:
63+
kube-apiserver-arg:
64+
- audit-policy-file=<customized-path>/dev-audit-policy.yaml
65+
- audit-log-path=<customized-path>/dev-audit.logs
66+
machineSelectorFiles:
67+
- fileSources:
68+
- configMap:
69+
name: ''
70+
secret:
71+
items:
72+
- key: audit-policy
73+
path: <customized-path>/dev-audit-policy.yaml
74+
name: dev-audit-policy
75+
machineLabelSelector:
76+
matchLabels:
77+
rke.cattle.io/control-plane-role: 'true'
78+
```
79+
80+
For more information about cluster configuration, refer to the REK2 or K3s cluster configuration reference pages.
81+
82+
</TabItem>
83+
84+
<TabItem value="RKE1">
85+
86+
The audit log can be enabled and configured by editing the cluster with YAML.
87+
88+
When the audit log is enabled, RKE1 default values will be applied.
89+
90+
```yaml
91+
#
92+
# Rancher Config
93+
#
94+
rancher_kubernetes_engine_config:
95+
services:
96+
kube-api:
97+
audit_log:
98+
enabled: true
99+
```
100+
101+
You can customize the audit log by using the configuration directive.
102+
103+
```yaml
104+
#
105+
# Rancher Config
106+
#
107+
rancher_kubernetes_engine_config:
108+
services:
109+
kube-api:
110+
audit_log:
111+
enabled: true
112+
configuration:
113+
max_age: 6
114+
max_backup: 6
115+
max_size: 110
116+
path: /var/log/kube-audit/audit-log.json
117+
format: json
118+
policy:
119+
apiVersion: audit.k8s.io/v1 # This is required.
120+
kind: Policy
121+
omitStages:
122+
- "RequestReceived"
123+
rules:
124+
# Log pod changes at RequestResponse level
125+
- level: RequestResponse
126+
resources:
127+
- group: ""
128+
# Resource "pods" doesn't match requests to any subresource of pods,
129+
# which is consistent with the RBAC policy.
130+
resources: ["pods"]
131+
# Log "pods/log", "pods/status" at Metadata level
132+
- level: Metadata
133+
resources:
134+
- group: ""
135+
resources: ["pods/log", "pods/status"]
136+
```
137+
138+
For configuration details, refer to the official [RKE1 documentation](https://rke.docs.rancher.com/config-options/audit-log).
139+
140+
</TabItem>
141+
</Tabs>
142+

0 commit comments

Comments
 (0)