mirror of
https://github.com/openshift/openshift-docs.git
synced 2026-02-07 09:46:53 +01:00
176 lines
8.2 KiB
Plaintext
176 lines
8.2 KiB
Plaintext
// Module included in the following assemblies:
|
|
//
|
|
// * security/audit-log-view.adoc
|
|
|
|
:_mod-docs-content-type: PROCEDURE
|
|
[id="nodes-nodes-audit-log-basic-viewing_{context}"]
|
|
= Viewing the audit logs
|
|
|
|
You can view the logs for the OpenShift API server, Kubernetes API server, OpenShift OAuth API server, and OpenShift OAuth server for each control plane node.
|
|
|
|
.Procedure
|
|
|
|
To view the audit logs:
|
|
|
|
* View the OpenShift API server audit logs:
|
|
|
|
.. List the OpenShift API server audit logs that are available for each control plane node:
|
|
+
|
|
[source,terminal]
|
|
----
|
|
$ oc adm node-logs --role=master --path=openshift-apiserver/
|
|
----
|
|
+
|
|
.Example output
|
|
[source,terminal]
|
|
----
|
|
ci-ln-m0wpfjb-f76d1-vnb5x-master-0 audit-2021-03-09T00-12-19.834.log
|
|
ci-ln-m0wpfjb-f76d1-vnb5x-master-0 audit.log
|
|
ci-ln-m0wpfjb-f76d1-vnb5x-master-1 audit-2021-03-09T00-11-49.835.log
|
|
ci-ln-m0wpfjb-f76d1-vnb5x-master-1 audit.log
|
|
ci-ln-m0wpfjb-f76d1-vnb5x-master-2 audit-2021-03-09T00-13-00.128.log
|
|
ci-ln-m0wpfjb-f76d1-vnb5x-master-2 audit.log
|
|
----
|
|
|
|
.. View a specific OpenShift API server audit log by providing the node name and the log name:
|
|
+
|
|
[source,terminal]
|
|
----
|
|
$ oc adm node-logs <node_name> --path=openshift-apiserver/<log_name>
|
|
----
|
|
+
|
|
For example:
|
|
+
|
|
[source,terminal]
|
|
----
|
|
$ oc adm node-logs ci-ln-m0wpfjb-f76d1-vnb5x-master-0 --path=openshift-apiserver/audit-2021-03-09T00-12-19.834.log
|
|
----
|
|
+
|
|
.Example output
|
|
[source,terminal]
|
|
----
|
|
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"381acf6d-5f30-4c7d-8175-c9c317ae5893","stage":"ResponseComplete","requestURI":"/metrics","verb":"get","user":{"username":"system:serviceaccount:openshift-monitoring:prometheus-k8s","uid":"825b60a0-3976-4861-a342-3b2b561e8f82","groups":["system:serviceaccounts","system:serviceaccounts:openshift-monitoring","system:authenticated"]},"sourceIPs":["10.129.2.6"],"userAgent":"Prometheus/2.23.0","responseStatus":{"metadata":{},"code":200},"requestReceivedTimestamp":"2021-03-08T18:02:04.086545Z","stageTimestamp":"2021-03-08T18:02:04.107102Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"prometheus-k8s\" of ClusterRole \"prometheus-k8s\" to ServiceAccount \"prometheus-k8s/openshift-monitoring\""}}
|
|
----
|
|
|
|
* View the Kubernetes API server audit logs:
|
|
|
|
.. List the Kubernetes API server audit logs that are available for each control plane node:
|
|
+
|
|
[source,terminal]
|
|
----
|
|
$ oc adm node-logs --role=master --path=kube-apiserver/
|
|
----
|
|
+
|
|
.Example output
|
|
[source,terminal]
|
|
----
|
|
ci-ln-m0wpfjb-f76d1-vnb5x-master-0 audit-2021-03-09T14-07-27.129.log
|
|
ci-ln-m0wpfjb-f76d1-vnb5x-master-0 audit.log
|
|
ci-ln-m0wpfjb-f76d1-vnb5x-master-1 audit-2021-03-09T19-24-22.620.log
|
|
ci-ln-m0wpfjb-f76d1-vnb5x-master-1 audit.log
|
|
ci-ln-m0wpfjb-f76d1-vnb5x-master-2 audit-2021-03-09T18-37-07.511.log
|
|
ci-ln-m0wpfjb-f76d1-vnb5x-master-2 audit.log
|
|
----
|
|
|
|
.. View a specific Kubernetes API server audit log by providing the node name and the log name:
|
|
+
|
|
[source,terminal]
|
|
----
|
|
$ oc adm node-logs <node_name> --path=kube-apiserver/<log_name>
|
|
----
|
|
+
|
|
For example:
|
|
+
|
|
[source,terminal]
|
|
----
|
|
$ oc adm node-logs ci-ln-m0wpfjb-f76d1-vnb5x-master-0 --path=kube-apiserver/audit-2021-03-09T14-07-27.129.log
|
|
----
|
|
+
|
|
.Example output
|
|
[source,terminal]
|
|
----
|
|
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"cfce8a0b-b5f5-4365-8c9f-79c1227d10f9","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/openshift-kube-scheduler/serviceaccounts/openshift-kube-scheduler-sa","verb":"get","user":{"username":"system:serviceaccount:openshift-kube-scheduler-operator:openshift-kube-scheduler-operator","uid":"2574b041-f3c8-44e6-a057-baef7aa81516","groups":["system:serviceaccounts","system:serviceaccounts:openshift-kube-scheduler-operator","system:authenticated"]},"sourceIPs":["10.128.0.8"],"userAgent":"cluster-kube-scheduler-operator/v0.0.0 (linux/amd64) kubernetes/$Format","objectRef":{"resource":"serviceaccounts","namespace":"openshift-kube-scheduler","name":"openshift-kube-scheduler-sa","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":200},"requestReceivedTimestamp":"2021-03-08T18:06:42.512619Z","stageTimestamp":"2021-03-08T18:06:42.516145Z","annotations":{"authentication.k8s.io/legacy-token":"system:serviceaccount:openshift-kube-scheduler-operator:openshift-kube-scheduler-operator","authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"system:openshift:operator:cluster-kube-scheduler-operator\" of ClusterRole \"cluster-admin\" to ServiceAccount \"openshift-kube-scheduler-operator/openshift-kube-scheduler-operator\""}}
|
|
----
|
|
|
|
* View the OpenShift OAuth API server audit logs:
|
|
|
|
.. List the OpenShift OAuth API server audit logs that are available for each control plane node:
|
|
+
|
|
[source,terminal]
|
|
----
|
|
$ oc adm node-logs --role=master --path=oauth-apiserver/
|
|
----
|
|
+
|
|
.Example output
|
|
[source,terminal]
|
|
----
|
|
ci-ln-m0wpfjb-f76d1-vnb5x-master-0 audit-2021-03-09T13-06-26.128.log
|
|
ci-ln-m0wpfjb-f76d1-vnb5x-master-0 audit.log
|
|
ci-ln-m0wpfjb-f76d1-vnb5x-master-1 audit-2021-03-09T18-23-21.619.log
|
|
ci-ln-m0wpfjb-f76d1-vnb5x-master-1 audit.log
|
|
ci-ln-m0wpfjb-f76d1-vnb5x-master-2 audit-2021-03-09T17-36-06.510.log
|
|
ci-ln-m0wpfjb-f76d1-vnb5x-master-2 audit.log
|
|
----
|
|
|
|
.. View a specific OpenShift OAuth API server audit log by providing the node name and the log name:
|
|
+
|
|
[source,terminal]
|
|
----
|
|
$ oc adm node-logs <node_name> --path=oauth-apiserver/<log_name>
|
|
----
|
|
+
|
|
For example:
|
|
+
|
|
[source,terminal]
|
|
----
|
|
$ oc adm node-logs ci-ln-m0wpfjb-f76d1-vnb5x-master-0 --path=oauth-apiserver/audit-2021-03-09T13-06-26.128.log
|
|
----
|
|
+
|
|
.Example output
|
|
[source,terminal]
|
|
----
|
|
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"dd4c44e2-3ea1-4830-9ab7-c91a5f1388d6","stage":"ResponseComplete","requestURI":"/apis/user.openshift.io/v1/users/~","verb":"get","user":{"username":"system:serviceaccount:openshift-monitoring:prometheus-k8s","groups":["system:serviceaccounts","system:serviceaccounts:openshift-monitoring","system:authenticated"]},"sourceIPs":["10.0.32.4","10.128.0.1"],"userAgent":"dockerregistry/v0.0.0 (linux/amd64) kubernetes/$Format","objectRef":{"resource":"users","name":"~","apiGroup":"user.openshift.io","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":200},"requestReceivedTimestamp":"2021-03-08T17:47:43.653187Z","stageTimestamp":"2021-03-08T17:47:43.660187Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"basic-users\" of ClusterRole \"basic-user\" to Group \"system:authenticated\""}}
|
|
----
|
|
|
|
* View the OpenShift OAuth server audit logs:
|
|
|
|
.. List the OpenShift OAuth server audit logs that are available for each control plane node:
|
|
+
|
|
[source,terminal]
|
|
----
|
|
$ oc adm node-logs --role=master --path=oauth-server/
|
|
----
|
|
+
|
|
.Example output
|
|
[source,terminal]
|
|
----
|
|
ci-ln-m0wpfjb-f76d1-vnb5x-master-0 audit-2022-05-11T18-57-32.395.log
|
|
ci-ln-m0wpfjb-f76d1-vnb5x-master-0 audit.log
|
|
ci-ln-m0wpfjb-f76d1-vnb5x-master-1 audit-2022-05-11T19-07-07.021.log
|
|
ci-ln-m0wpfjb-f76d1-vnb5x-master-1 audit.log
|
|
ci-ln-m0wpfjb-f76d1-vnb5x-master-2 audit-2022-05-11T19-06-51.844.log
|
|
ci-ln-m0wpfjb-f76d1-vnb5x-master-2 audit.log
|
|
----
|
|
|
|
.. View a specific OpenShift OAuth server audit log by providing the node name and the log name:
|
|
+
|
|
[source,terminal]
|
|
----
|
|
$ oc adm node-logs <node_name> --path=oauth-server/<log_name>
|
|
----
|
|
+
|
|
For example:
|
|
+
|
|
[source,terminal]
|
|
----
|
|
$ oc adm node-logs ci-ln-m0wpfjb-f76d1-vnb5x-master-0 --path=oauth-server/audit-2022-05-11T18-57-32.395.log
|
|
----
|
|
+
|
|
.Example output
|
|
[source,terminal]
|
|
----
|
|
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"13c20345-f33b-4b7d-b3b6-e7793f805621","stage":"ResponseComplete","requestURI":"/login","verb":"post","user":{"username":"system:anonymous","groups":["system:unauthenticated"]},"sourceIPs":["10.128.2.6"],"userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0","responseStatus":{"metadata":{},"code":302},"requestReceivedTimestamp":"2022-05-11T17:31:16.280155Z","stageTimestamp":"2022-05-11T17:31:16.297083Z","annotations":{"authentication.openshift.io/decision":"error","authentication.openshift.io/username":"kubeadmin","authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":""}}
|
|
----
|
|
+
|
|
The possible values for the `authentication.openshift.io/decision` annotation are `allow`, `deny`, or `error`.
|