mirror of
https://github.com/openshift/openshift-docs.git
synced 2026-02-05 12:46:18 +01:00
73 lines
2.8 KiB
Plaintext
73 lines
2.8 KiB
Plaintext
// Module included in the following assemblies:
|
|
//
|
|
// * networking/network_security/logging-network-security.adoc
|
|
|
|
:_mod-docs-content-type: PROCEDURE
|
|
[id="nw-networkpolicy-audit-enable_{context}"]
|
|
= Enabling egress firewall and network policy audit logging for a namespace
|
|
|
|
As a cluster administrator, you can enable audit logging for a namespace.
|
|
|
|
.Prerequisites
|
|
|
|
* Install the OpenShift CLI (`oc`).
|
|
* Log in to the cluster with a user with `cluster-admin` privileges.
|
|
|
|
.Procedure
|
|
|
|
* To enable audit logging for a namespace, enter the following command:
|
|
+
|
|
[source,terminal]
|
|
----
|
|
$ oc annotate namespace <namespace> \
|
|
k8s.ovn.org/acl-logging='{ "deny": "alert", "allow": "notice" }'
|
|
----
|
|
+
|
|
--
|
|
where:
|
|
|
|
`<namespace>`:: Specifies the name of the namespace.
|
|
--
|
|
+
|
|
[TIP]
|
|
====
|
|
You can also apply the following YAML to enable audit logging:
|
|
|
|
[source,yaml]
|
|
----
|
|
kind: Namespace
|
|
apiVersion: v1
|
|
metadata:
|
|
name: <namespace>
|
|
annotations:
|
|
k8s.ovn.org/acl-logging: |-
|
|
{
|
|
"deny": "alert",
|
|
"allow": "notice"
|
|
}
|
|
----
|
|
====
|
|
+
|
|
Successful output lists the audit logging name and the `annotated` status.
|
|
|
|
.Verification
|
|
|
|
* Display the latest entries in the audit log:
|
|
+
|
|
[source,terminal]
|
|
----
|
|
$ for pod in $(oc get pods -n openshift-ovn-kubernetes -l app=ovnkube-node --no-headers=true | awk '{ print $1 }') ; do
|
|
oc exec -it $pod -n openshift-ovn-kubernetes -- tail -4 /var/log/ovn/acl-audit-log.log
|
|
done
|
|
----
|
|
+
|
|
.Example output
|
|
[source,text]
|
|
----
|
|
2023-11-02T16:49:57.909Z|00028|acl_log(ovn_pinctrl0)|INFO|name="NP:verify-audit-logging:allow-from-same-namespace:Egress:0", verdict=allow, severity=alert, direction=from-lport: icmp,vlan_tci=0x0000,dl_src=0a:58:0a:81:02:22,dl_dst=0a:58:0a:81:02:23,nw_src=10.129.2.34,nw_dst=10.129.2.35,nw_tos=0,nw_ecn=0,nw_ttl=64,nw_frag=no,icmp_type=8,icmp_code=0
|
|
2023-11-02T16:49:57.909Z|00029|acl_log(ovn_pinctrl0)|INFO|name="NP:verify-audit-logging:allow-from-same-namespace:Ingress:0", verdict=allow, severity=alert, direction=to-lport: icmp,vlan_tci=0x0000,dl_src=0a:58:0a:81:02:22,dl_dst=0a:58:0a:81:02:23,nw_src=10.129.2.34,nw_dst=10.129.2.35,nw_tos=0,nw_ecn=0,nw_ttl=64,nw_frag=no,icmp_type=8,icmp_code=0
|
|
2023-11-02T16:49:58.932Z|00030|acl_log(ovn_pinctrl0)|INFO|name="NP:verify-audit-logging:allow-from-same-namespace:Egress:0", verdict=allow, severity=alert, direction=from-lport: icmp,vlan_tci=0x0000,dl_src=0a:58:0a:81:02:22,dl_dst=0a:58:0a:81:02:23,nw_src=10.129.2.34,nw_dst=10.129.2.35,nw_tos=0,nw_ecn=0,nw_ttl=64,nw_frag=no,icmp_type=8,icmp_code=0
|
|
2023-11-02T16:49:58.932Z|00031|acl_log(ovn_pinctrl0)|INFO|name="NP:verify-audit-logging:allow-from-same-namespace:Ingress:0", verdict=allow, severity=alert, direction=to-lport: icmp,vlan_tci=0x0000,dl_src=0a:58:0a:81:02:22,dl_dst=0a:58:0a:81:02:23,nw_src=10.129.2.34,nw_dst=10.129.2.35,nw_tos=0,nw_ecn=0,nw_ttl=64,nw_frag=no,icmp_type=8,icmp_code=0
|
|
|
|
----
|