mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-25 04:28:15 +00:00
docs: add new audit log docs (#1847)
* docs: add new audit log docs Signed-off-by: Alexandre Lamarre <alexandre.lamarre@suse.com> * docs: minor tweaks to audit logs redaction engine clarification typo fixes correction about path redaction example Signed-off-by: Alexandre Lamarre <alexandre.lamarre@suse.com> * Update docs/how-to-guides/advanced-user-guides/enable-api-audit-log.md Co-authored-by: Lucas Saintarbor <lucas.saintarbor@suse.com> Update docs/how-to-guides/advanced-user-guides/enable-api-audit-log.md Co-authored-by: Lucas Saintarbor <lucas.saintarbor@suse.com> Update docs/how-to-guides/advanced-user-guides/enable-api-audit-log.md Co-authored-by: Lucas Saintarbor <lucas.saintarbor@suse.com> Update docs/how-to-guides/advanced-user-guides/enable-api-audit-log.md Co-authored-by: Lucas Saintarbor <lucas.saintarbor@suse.com> Update docs/how-to-guides/advanced-user-guides/enable-api-audit-log.md Co-authored-by: Lucas Saintarbor <lucas.saintarbor@suse.com> Update docs/how-to-guides/advanced-user-guides/enable-api-audit-log.md Co-authored-by: Lucas Saintarbor <lucas.saintarbor@suse.com> Update docs/how-to-guides/advanced-user-guides/enable-api-audit-log.md Co-authored-by: Lucas Saintarbor <lucas.saintarbor@suse.com> Update docs/how-to-guides/advanced-user-guides/enable-api-audit-log.md Co-authored-by: Lucas Saintarbor <lucas.saintarbor@suse.com> Update docs/troubleshooting/other-troubleshooting-tips/user-id-tracking-in-audit-logs.md Co-authored-by: Lucas Saintarbor <lucas.saintarbor@suse.com> Update docs/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md Co-authored-by: Lucas Saintarbor <lucas.saintarbor@suse.com> Update docs/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md Co-authored-by: Lucas Saintarbor <lucas.saintarbor@suse.com> Update docs/how-to-guides/advanced-user-guides/enable-api-audit-log.md Co-authored-by: Lucas Saintarbor <lucas.saintarbor@suse.com> Update docs/how-to-guides/advanced-user-guides/enable-api-audit-log.md Co-authored-by: Lucas Saintarbor <lucas.saintarbor@suse.com> Update docs/how-to-guides/advanced-user-guides/enable-api-audit-log.md Co-authored-by: Lucas Saintarbor <lucas.saintarbor@suse.com> Update docs/how-to-guides/advanced-user-guides/enable-api-audit-log.md Co-authored-by: Lucas Saintarbor <lucas.saintarbor@suse.com> * clarify json path engine limitations, and link to upstream resource Signed-off-by: Alexandre Lamarre <alexandre.lamarre@suse.com> * apply changes in docs to versioned_docs/version-2.12 Signed-off-by: Alexandre Lamarre <alexandre.lamarre@suse.com> --------- Signed-off-by: Alexandre Lamarre <alexandre.lamarre@suse.com> Co-authored-by: Lucas Saintarbor <lucas.saintarbor@suse.com>
This commit is contained in:
Alexandre Lamarre
co-authored by
Lucas Saintarbor
Lucas Saintarbor
parent
23c2f68170
commit
45f812baa1
+6
-1
@@ -36,7 +36,8 @@ For information on enabling experimental features, refer to [this page.](../../.
|
||||
| `antiAffinity` | "preferred" | `string` - AntiAffinity rule for Rancher pods - "preferred, required" |
|
||||
| `auditLog.destination` | "sidecar" | `string` - Stream to sidecar container console or hostPath volume - "sidecar, hostPath" |
|
||||
| `auditLog.hostPath` | "/var/log/rancher/audit" | `string` - log file destination on host (only applies when `auditLog.destination` is set to `hostPath`) |
|
||||
| `auditLog.level` | 0 | `int` - set the [API Audit Log](../../../how-to-guides/advanced-user-guides/enable-api-audit-log.md) level. 0 is off. [0-3] |
|
||||
| `auditLog.enabled` | false | `bool` - Enables / disables audit logging. |
|
||||
| `auditLog.level` | 0 | `int` - Sets the [API Audit Log](../../../how-to-guides/advanced-user-guides/enable-api-audit-log.md) level [0-3]. |
|
||||
| `auditLog.maxAge` | 1 | `int` - maximum number of days to retain old audit log files (only applies when `auditLog.destination` is set to `hostPath`) |
|
||||
| `auditLog.maxBackup` | 1 | `int` - maximum number of audit log files to retain (only applies when `auditLog.destination` is set to `hostPath`) |
|
||||
| `auditLog.maxSize` | 100 | `int` - maximum size in megabytes of the audit log file before it gets rotated (only applies when `auditLog.destination` is set to `hostPath`) |
|
||||
@@ -63,6 +64,10 @@ For information on enabling experimental features, refer to [this page.](../../.
|
||||
| `tls` | "ingress" | `string` - See [External TLS Termination](#external-tls-termination) for details. - "ingress, external" |
|
||||
| `useBundledSystemChart` | `false` | `bool` - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations. |
|
||||
|
||||
|
||||
When using Rancher v2.12.0 and above, Rancher will use an audit logging controller that watches `AuditPolicy` CRs for configuring additional redactions, for more info see [API Audit Log](../../../how-to-guides/advanced-user-guides/enable-api-audit-log.md).
|
||||
|
||||
|
||||
### Bootstrap Password
|
||||
|
||||
You can [set a specific bootstrap password](../resources/bootstrap-password.md) during Rancher installation. If you don't set a specific bootstrap password, Rancher randomly generates a password for the first admin account.
|
||||
|
||||
@@ -185,6 +185,7 @@ For help troubleshooting certificates, see [this section.](../../getting-started
|
||||
If you want to record all transactions with the Rancher API, enable the [API Auditing](enable-api-audit-log.md) feature by adding the flags below into your install command.
|
||||
|
||||
-e AUDIT_LEVEL=1 \
|
||||
-e AUDIT_LOG_ENABLED=true \
|
||||
-e AUDIT_LOG_PATH=/var/log/auditlog/rancher-api-audit.log \
|
||||
-e AUDIT_LOG_MAXAGE=20 \
|
||||
-e AUDIT_LOG_MAXBACKUP=20 \
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -44,6 +44,7 @@ Privileged access is [required.](../../getting-started/installation-and-upgrade/
|
||||
docker run -d --restart=unless-stopped \
|
||||
-p 80:80 -p 443:443 \
|
||||
-v /var/log/rancher/auditlog:/var/log/auditlog \
|
||||
-e AUDIT_LOG_ENABLED=true \
|
||||
-e AUDIT_LEVEL=1 \
|
||||
--privileged \
|
||||
rancher/rancher:latest
|
||||
|
||||
@@ -23,4 +23,4 @@ A Rancher Admin should now be able to view Rancher audit logs and follow through
|
||||
## Feature Description
|
||||
|
||||
- When Kubernetes Audit logs are enabled on the downstream cluster, in each event that is logged, the external Identity Provider's username is now logged for each request, at the "metadata" level.
|
||||
- When Rancher API Audit logs are enabled on the Rancher installation, the external Identity Provider's username is also logged now at the `auditLog.level=1` for each request that hits the Rancher API server, including the login requests.
|
||||
- When you enable Rancher API Audit logs for a Rancher installation, the external Identity Provider's username is also logged now at the `auditLog.level=0` for each request that hits the Rancher API server, including login requests.
|
||||
|
||||
+6
-1
@@ -36,7 +36,8 @@ For information on enabling experimental features, refer to [this page.](../../.
|
||||
| `antiAffinity` | "preferred" | `string` - AntiAffinity rule for Rancher pods - "preferred, required" |
|
||||
| `auditLog.destination` | "sidecar" | `string` - Stream to sidecar container console or hostPath volume - "sidecar, hostPath" |
|
||||
| `auditLog.hostPath` | "/var/log/rancher/audit" | `string` - log file destination on host (only applies when `auditLog.destination` is set to `hostPath`) |
|
||||
| `auditLog.level` | 0 | `int` - set the [API Audit Log](../../../how-to-guides/advanced-user-guides/enable-api-audit-log.md) level. 0 is off. [0-3] |
|
||||
| `auditLog.enabled` | false | `bool` - Enables / disables audit logging. |
|
||||
| `auditLog.level` | 0 | `int` - Sets the [API Audit Log](../../../how-to-guides/advanced-user-guides/enable-api-audit-log.md) level [0-3]. |
|
||||
| `auditLog.maxAge` | 1 | `int` - maximum number of days to retain old audit log files (only applies when `auditLog.destination` is set to `hostPath`) |
|
||||
| `auditLog.maxBackup` | 1 | `int` - maximum number of audit log files to retain (only applies when `auditLog.destination` is set to `hostPath`) |
|
||||
| `auditLog.maxSize` | 100 | `int` - maximum size in megabytes of the audit log file before it gets rotated (only applies when `auditLog.destination` is set to `hostPath`) |
|
||||
@@ -63,6 +64,10 @@ For information on enabling experimental features, refer to [this page.](../../.
|
||||
| `tls` | "ingress" | `string` - See [External TLS Termination](#external-tls-termination) for details. - "ingress, external" |
|
||||
| `useBundledSystemChart` | `false` | `bool` - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations. |
|
||||
|
||||
|
||||
When using Rancher v2.12.0 and above, Rancher will use an audit logging controller that watches `AuditPolicy` CRs for configuring additional redactions, for more info see [API Audit Log](../../../how-to-guides/advanced-user-guides/enable-api-audit-log.md).
|
||||
|
||||
|
||||
### Bootstrap Password
|
||||
|
||||
You can [set a specific bootstrap password](../resources/bootstrap-password.md) during Rancher installation. If you don't set a specific bootstrap password, Rancher randomly generates a password for the first admin account.
|
||||
|
||||
+1
@@ -185,6 +185,7 @@ For help troubleshooting certificates, see [this section.](../../getting-started
|
||||
If you want to record all transactions with the Rancher API, enable the [API Auditing](enable-api-audit-log.md) feature by adding the flags below into your install command.
|
||||
|
||||
-e AUDIT_LEVEL=1 \
|
||||
-e AUDIT_LOG_ENABLED=true \
|
||||
-e AUDIT_LOG_PATH=/var/log/auditlog/rancher-api-audit.log \
|
||||
-e AUDIT_LOG_MAXAGE=20 \
|
||||
-e AUDIT_LOG_MAXBACKUP=20 \
|
||||
|
||||
+600
-477
File diff suppressed because it is too large
Load Diff
+1
@@ -44,6 +44,7 @@ Privileged access is [required.](../../getting-started/installation-and-upgrade/
|
||||
docker run -d --restart=unless-stopped \
|
||||
-p 80:80 -p 443:443 \
|
||||
-v /var/log/rancher/auditlog:/var/log/auditlog \
|
||||
-e AUDIT_LOG_ENABLED=true \
|
||||
-e AUDIT_LEVEL=1 \
|
||||
--privileged \
|
||||
rancher/rancher:latest
|
||||
|
||||
+1
-1
@@ -23,4 +23,4 @@ A Rancher Admin should now be able to view Rancher audit logs and follow through
|
||||
## Feature Description
|
||||
|
||||
- When Kubernetes Audit logs are enabled on the downstream cluster, in each event that is logged, the external Identity Provider's username is now logged for each request, at the "metadata" level.
|
||||
- When Rancher API Audit logs are enabled on the Rancher installation, the external Identity Provider's username is also logged now at the `auditLog.level=1` for each request that hits the Rancher API server, including the login requests.
|
||||
- When you enable Rancher API Audit logs for a Rancher installation, the external Identity Provider's username is also logged now at the `auditLog.level=0` for each request that hits the Rancher API server, including login requests.
|
||||
|
||||
Reference in New Issue
Block a user