API-1449: Enable kube-apiserver audit logging. #1051
Conversation
openshift-ci
bot
added
the
approved
|
/assign @fzdarsky Frank, any objection to this change? KAS rotates and truncates its own audit logs, so we should not expect to see problems with disk space exhaustion. |
dhellmann
left a comment
dhellmann
left a comment
There was a problem hiding this comment.
I see how this removes the configuration option. I don't see how it ensures that the audit logs are written out. Is that a default behavior that doesn't need to be enabled? Is it because the output directory is now being created? Or am I missing something in reading the changes?
| cmd.MarkFlagFilename("config", "yaml", "yml") | ||
| // All other flags will be read after reading both config file and env vars. | ||
| flags.String("data-dir", cfg.DataDir, "The directory for storing runtime data.") | ||
| flags.String("audit-log-dir", cfg.AuditLogDir, "The directory for storing audit logs.") |
There was a problem hiding this comment.
There's a sample configuration file in https://github.com/openshift/microshift/blob/main/packaging/microshift/config.yaml that has this config value, too. We can clean that up in a separate PR.
|
@dhellmann Specifying an audit log path in itself enables audit logging (https://github.com/benluddy/microshift/blob/f233b7f9b38eec3c97ad8a2686340b929de9d82e/vendor/k8s.io/apiserver/pkg/server/options/audit.go#L501-L503). I've also manually verified that, with this change, audit logs are written to /var/log/kube-apiserver/audit.log. |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: benluddy, dhellmann The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/test e2e-openshift-conformance-sig-node |
|
@benluddy: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
4 participants
Audit logs from kube-apiserver are used in virtually every support engagement with the API team, so they're useful to enable out-of-the-box. I've also removed the audit log path config field, instead using the same path used by OpenShift (under /var/log).