diff --git a/docs/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md b/docs/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md index aa8da6f793f..8dedc6288bf 100644 --- a/docs/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md +++ b/docs/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md @@ -36,7 +36,8 @@ For information on enabling experimental features, refer to [this page.](../../. | `antiAffinity` | "preferred" | `string` - AntiAffinity rule for Rancher pods - "preferred, required" | | `auditLog.destination` | "sidecar" | `string` - Stream to sidecar container console or hostPath volume - "sidecar, hostPath" | | `auditLog.hostPath` | "/var/log/rancher/audit" | `string` - log file destination on host (only applies when `auditLog.destination` is set to `hostPath`) | -| `auditLog.level` | 0 | `int` - set the [API Audit Log](../../../how-to-guides/advanced-user-guides/enable-api-audit-log.md) level. 0 is off. [0-3] | +| `auditLog.enabled` | false | `bool` - Enables / disables audit logging. | +| `auditLog.level` | 0 | `int` - Sets the [API Audit Log](../../../how-to-guides/advanced-user-guides/enable-api-audit-log.md) level [0-3]. | | `auditLog.maxAge` | 1 | `int` - maximum number of days to retain old audit log files (only applies when `auditLog.destination` is set to `hostPath`) | | `auditLog.maxBackup` | 1 | `int` - maximum number of audit log files to retain (only applies when `auditLog.destination` is set to `hostPath`) | | `auditLog.maxSize` | 100 | `int` - maximum size in megabytes of the audit log file before it gets rotated (only applies when `auditLog.destination` is set to `hostPath`) | @@ -63,6 +64,10 @@ For information on enabling experimental features, refer to [this page.](../../. | `tls` | "ingress" | `string` - See [External TLS Termination](#external-tls-termination) for details. - "ingress, external" | | `useBundledSystemChart` | `false` | `bool` - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations. | + +When using Rancher v2.12.0 and above, Rancher will use an audit logging controller that watches `AuditPolicy` CRs for configuring additional redactions, for more info see [API Audit Log](../../../how-to-guides/advanced-user-guides/enable-api-audit-log.md). + + ### Bootstrap Password You can [set a specific bootstrap password](../resources/bootstrap-password.md) during Rancher installation. If you don't set a specific bootstrap password, Rancher randomly generates a password for the first admin account. diff --git a/docs/how-to-guides/advanced-user-guides/configure-layer-7-nginx-load-balancer.md b/docs/how-to-guides/advanced-user-guides/configure-layer-7-nginx-load-balancer.md index f7266be3ff3..7a4384b4dad 100644 --- a/docs/how-to-guides/advanced-user-guides/configure-layer-7-nginx-load-balancer.md +++ b/docs/how-to-guides/advanced-user-guides/configure-layer-7-nginx-load-balancer.md @@ -185,6 +185,7 @@ For help troubleshooting certificates, see [this section.](../../getting-started If you want to record all transactions with the Rancher API, enable the [API Auditing](enable-api-audit-log.md) feature by adding the flags below into your install command. -e AUDIT_LEVEL=1 \ + -e AUDIT_LOG_ENABLED=true \ -e AUDIT_LOG_PATH=/var/log/auditlog/rancher-api-audit.log \ -e AUDIT_LOG_MAXAGE=20 \ -e AUDIT_LOG_MAXBACKUP=20 \ diff --git a/docs/how-to-guides/advanced-user-guides/enable-api-audit-log.md b/docs/how-to-guides/advanced-user-guides/enable-api-audit-log.md index 4f0a15c7984..36e9a7f5ad3 100644 --- a/docs/how-to-guides/advanced-user-guides/enable-api-audit-log.md +++ b/docs/how-to-guides/advanced-user-guides/enable-api-audit-log.md @@ -24,7 +24,8 @@ The usage below defines rules about what the audit log should record and what da | Parameter | Description | | ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| `AUDIT_LEVEL` | `0` - Disable audit log (default setting).
`1` - Log event metadata.
`2` - Log event metadata and request body.
`3` - Log event metadata, request body, and response body. Each log transaction for a request/response pair uses the same `auditID` value.

See [Audit Level Logging](#audit-log-levels) for a table that displays what each setting logs. | +| `AUDIT_LOG_ENABLED` | `false` - Disables the audit log (default setting).
`true` - Enables the audit log. | +| `AUDIT_LEVEL` | `0` - Log request and response metadata (default setting).
`1` - Log request and response headers.
`2` - Log request body.
`3` - Log response body. Each log level is cumulative and each subsequent level logs the previous level data. Each log transaction for a request/response pair uses the same `auditID` value.

See [Audit Level Logging](#audit-log-levels) for a table that displays what each setting logs. | | `AUDIT_LOG_PATH` | Log path for Rancher Server API. Default path is `/var/log/auditlog/rancher-api-audit.log`. You can mount the log directory to host.

Usage Example: `AUDIT_LOG_PATH=/my/custom/path/`
| | `AUDIT_LOG_MAXAGE` | Defined the maximum number of days to retain old audit log files. Default is 10 days. | | `AUDIT_LOG_MAXBACKUP` | Defines the maximum number of audit log files to retain. Default is 10. | @@ -36,12 +37,138 @@ The usage below defines rules about what the audit log should record and what da The following table displays what parts of API transactions are logged for each [`AUDIT_LEVEL`](#api-audit-log-options) setting. -| `AUDIT_LEVEL` Setting | Metadata | Request Body | Response Body | -| --------------------- | -------- | ------------ | ------------- | -| `0` | | | | -| `1` | ✓ | | | -| `2` | ✓ | ✓ | | -| `3` | ✓ | ✓ | ✓ | + +| `AUDIT_LEVEL` Setting | Metadata | Request Headers | Response Headers | Request Body | Response Body | +|--------------------------------|----------------|---------------------------|-----------------------------|----------------------|-----------------------| +| 0 | ✓ | +| 1 | ✓ | ✓ | ✓ +| 2 | ✓ | ✓ | ✓ | ✓ +| 3 | ✓ | ✓ | ✓ | ✓ | ✓ + +## Audit Log policies + +Audit log policies allow end users to configure redactions using `AuditPolicy` cluster-scoped CRs in addition to the [default redactions and filters](#default-redactions--filters). + +All configured audit log policies are additive. + +Redaction policies for headers utilize a regular expression (regex) engine to redact headers, while a JSONPath engine is used to redact request/response headers. + +The JSONPath engine does not support the script or filter expressions. For getting started with JSONPath expressions, a good resource to consult is [Stafan Goessner's article on JSONPath](https://goessner.net/articles/JsonPath/). + +The structure of an audit policy CR is as follows: + +```yaml +apiVersion: auditlog.cattle.io/v1 +kind: AuditPolicy +spec: + enabled : true # true/false + # list of API request filters + filters: + - action: allow # allow/deny + # would allow logs sent to "/foo/some/endpoint" but not "/foo" or "/foobar". + requestURI: "/foo/.*" + # additionalRedactions allows configuration of redactions on headers using `jsonpath` expressions + additionalRedactions: + # redacts headers based on regex expressions + - headers: + - "Cache.*" + # paths redacts information from request and response bodies based on json path expressions + paths: + - "$.gitCommit" + verbosity: + level : 0 # matches the levels in the above audit log table + # request allows fine-grained control over which request data + # gets included. This overrides the behaviour of the generic verbosity.level + request: + headers : true # true/false + body : true # true/false + # response allows fine-grained control over which response data + # gets included. This overrides the behaviour of the generic verbosity.level + response: + headers : true # true/false + body: true # true/false +``` + +### Examples + +The following example shows only logging requests containing `login` in the request path to the audit log path: + +```yaml +apiVersion: auditlog.cattle.io/v1 +kind: AuditPolicy +metadata: + name: filters +spec: + filters: + - action: deny + requestUri: ".*" + - action: allow + requestUri: ".*login.*" +``` + +The following example shows how to redact specific fields containing `gitCommint` in request/response bodies: + +```yaml +apiVersion: auditlog.cattle.io/v1 +kind: AuditPolicy +metadata: + name: redactions +spec: + additionalRedactions: + - paths: + - "$.gitCommit" +``` + +### Default redactions & filters + +The audit log controller comes with default built-in redactions for common sensitive information. + +#### Redacted headers + +Generic headers: +- `Cookie` +- `Set-Cookie` +- `X-Api-Set-Cookie-Header` +- `Authorization` +- `X-Api-Tunnel-Params` +- `X-Api-Tunnel-Token` +- `X-Api-Auth-Header` +- `X-Amz-Security-Token` + + +#### Redacted body fields + +Generic body fields: + +- `credentials` +- `applicationSecret` +- `oauthCredential` +- `serviceAccountCredential` +- `spKey` +- `spCert` +- `certificate` +- `privateKey` +- `secretsEncryptionConfig` +- `manifestUrl` +- `insecureWindowsNodeCommand` +- `insecureNodeCommand` +- `insecureCommand` +- `command` +- `nodeCommand` +- `windowsNodeCommand` +- `clientRandom` + +Generic body regex redactor: +- `".*([pP]assword|[Kk]ube[Cc]onfig|[Tt]oken).*"` + +#### Cluster Driver + +By default, any API request with fields tied to cluster drivers will have any non `public*` or `optional*` fields redacted by the audit log controller. + +#### Redacted URIs + +Any endpoint containing `secrets` or `configmaps` will have relevant fields stripped from both the request and response bodies. Additionally, any endpoint containing `/v3/imports/*` will have its URI redacted. + ## Viewing API Audit Logs @@ -71,492 +198,488 @@ After you enable auditing, each API request or response is logged by Rancher in ### Metadata Level -If you set your `AUDIT_LEVEL` to `1`, Rancher logs the metadata header for every API request, but not the body. The header provides basic information about the API transaction, such as the transaction's ID, who initiated the transaction, the time it occurred, etc. +If you set your `AUDIT_LEVEL` to `0`, Rancher logs the metadata header for every API request, but neither the body nor the request and response headers. The metadata provides basic information about the API transaction, such as the transaction ID, the initiator of the transaction, the time it occurred, etc. ```json { - "auditID": "30022177-9e2e-43d1-b0d0-06ef9d3db183", - "requestURI": "/v3/schemas", - "sourceIPs": ["::1"], - "user": { - "name": "user-f4tt2", - "group": ["system:authenticated"] - }, - "verb": "GET", - "stage": "RequestReceived", - "stageTimestamp": "2018-07-20 10:22:43 +0800" + "auditID": "40bd4e40-875b-4020-933e-4c4f4c4db366", + "requestURI": "/v3/schemas", + "user": { + "name": "user-6j5s6", + "group": [ + "system:authenticated", + "system:cattle:authenticated" + ], + "extra": { + "principalid": [ + "local://user-6j5s6" + ], + "requesthost": [ + "localhost:8443" + ], + "requesttokenid": [ + "token-zs42h" + ], + "username": [ + "admin" + ] + } + }, + "method": "GET", + "remoteAddr": "127.0.0.1:58652", + "responseCode": 200, + "requestTimestamp": "2025-06-30T11:13:25-04:00", + "responseTimestamp": "2025-06-30T11:13:25-04:00" } ``` -### Metadata and Request Body Level +### Metadata and headers level -If you set your `AUDIT_LEVEL` to `2`, Rancher logs the metadata header and body for every API request. - -The code sample below depicts an API request, with both its metadata header and body. +If you set your `AUDIT_LEVEL` to `1`, Rancher logs the metadata and the request and response headers for every API request. ```json { - "auditID": "ef1d249e-bfac-4fd0-a61f-cbdcad53b9bb", - "requestURI": "/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx", - "sourceIPs": ["::1"], - "user": { - "name": "user-f4tt2", - "group": ["system:authenticated"] - }, - "verb": "PUT", - "stage": "RequestReceived", - "stageTimestamp": "2018-07-20 10:28:08 +0800", - "requestBody": { - "hostIPC": false, - "hostNetwork": false, - "hostPID": false, - "paused": false, - "annotations": {}, - "baseType": "workload", - "containers": [ - { - "allowPrivilegeEscalation": false, - "image": "nginx", - "imagePullPolicy": "Always", - "initContainer": false, - "name": "nginx", - "ports": [ - { - "containerPort": 80, - "dnsName": "nginx-nodeport", - "kind": "NodePort", - "name": "80tcp01", - "protocol": "TCP", - "sourcePort": 0, - "type": "/v3/project/schemas/containerPort" - } + "auditID": "f8c83dc6-a080-4e2e-ab43-552bddf01716", + "requestURI": "/v1/apps.deployments?page=1&pagesize=100&sort=metadata.name&filter=metadata.namespace!=p-npsl5&filter=metadata.namespace!=p-nzp6c&filter=metadata.namespace!=cattle-fleet-clusters-system&filter=metadata.namespace!=cattle-fleet-system&filter=metadata.namespace!=cattle-global-data&filter=metadata.namespace!=cattle-impersonation-system&filter=metadata.namespace!=cattle-provisioning-capi-system&filter=metadata.namespace!=cattle-system&filter=metadata.namespace!=cattle-ui-plugin-system&filter=metadata.namespace!=cluster-fleet-local-local-1a3d67d0a899&filter=metadata.namespace!=fleet-default&filter=metadata.namespace!=fleet-local&filter=metadata.namespace!=kube-node-lease&filter=metadata.namespace!=kube-public&filter=metadata.namespace!=kube-system&exclude=metadata.managedFields", + "user": { + "name": "user-6j5s6", + "group": [ + "system:authenticated", + "system:cattle:authenticated" ], - "privileged": false, - "readOnly": false, - "resources": { - "type": "/v3/project/schemas/resourceRequirements", - "requests": {}, - "limits": {} - }, - "restartCount": 0, - "runAsNonRoot": false, - "stdin": true, - "stdinOnce": false, - "terminationMessagePath": "/dev/termination-log", - "terminationMessagePolicy": "File", - "tty": true, - "type": "/v3/project/schemas/container", - "environmentFrom": [], - "capAdd": [], - "capDrop": [], - "livenessProbe": null, - "volumeMounts": [] - } - ], - "created": "2018-07-18T07:34:16Z", - "createdTS": 1531899256000, - "creatorId": null, - "deploymentConfig": { - "maxSurge": 1, - "maxUnavailable": 0, - "minReadySeconds": 0, - "progressDeadlineSeconds": 600, - "revisionHistoryLimit": 10, - "strategy": "RollingUpdate" - }, - "deploymentStatus": { - "availableReplicas": 1, - "conditions": [ - { - "lastTransitionTime": "2018-07-18T07:34:38Z", - "lastTransitionTimeTS": 1531899278000, - "lastUpdateTime": "2018-07-18T07:34:38Z", - "lastUpdateTimeTS": 1531899278000, - "message": "Deployment has minimum availability.", - "reason": "MinimumReplicasAvailable", - "status": "True", - "type": "Available" - }, - { - "lastTransitionTime": "2018-07-18T07:34:16Z", - "lastTransitionTimeTS": 1531899256000, - "lastUpdateTime": "2018-07-18T07:34:38Z", - "lastUpdateTimeTS": 1531899278000, - "message": "ReplicaSet \"nginx-64d85666f9\" has successfully progressed.", - "reason": "NewReplicaSetAvailable", - "status": "True", - "type": "Progressing" + "extra": { + "principalid": [ + "local://user-6j5s6" + ], + "requesthost": [ + "localhost:8443" + ], + "requesttokenid": [ + "token-zs42h" + ], + "username": [ + "admin" + ] } - ], - "observedGeneration": 2, - "readyReplicas": 1, - "replicas": 1, - "type": "/v3/project/schemas/deploymentStatus", - "unavailableReplicas": 0, - "updatedReplicas": 1 }, - "dnsPolicy": "ClusterFirst", - "id": "deployment:default:nginx", - "labels": { - "workload.user.cattle.io/workloadselector": "deployment-default-nginx" - }, - "name": "nginx", - "namespaceId": "default", - "projectId": "c-bcz5t:p-fdr4s", - "publicEndpoints": [ - { - "addresses": ["10.64.3.58"], - "allNodes": true, - "ingressId": null, - "nodeId": null, - "podId": null, - "port": 30917, - "protocol": "TCP", - "serviceId": "default:nginx-nodeport", - "type": "publicEndpoint" - } - ], - "restartPolicy": "Always", - "scale": 1, - "schedulerName": "default-scheduler", - "selector": { - "matchLabels": { - "workload.user.cattle.io/workloadselector": "deployment-default-nginx" - }, - "type": "/v3/project/schemas/labelSelector" - }, - "state": "active", - "terminationGracePeriodSeconds": 30, - "transitioning": "no", - "transitioningMessage": "", - "type": "deployment", - "uuid": "f998037d-8a5c-11e8-a4cf-0245a7ebb0fd", - "workloadAnnotations": { - "deployment.kubernetes.io/revision": "1", - "field.cattle.io/creatorId": "user-f4tt2" - }, - "workloadLabels": { - "workload.user.cattle.io/workloadselector": "deployment-default-nginx" - }, - "scheduling": { - "node": {} - }, - "description": "my description", - "volumes": [] - } -} -``` - -### Metadata, Request Body, and Response Body Level - -If you set your `AUDIT_LEVEL` to `3`, Rancher logs: - -- The metadata header and body for every API request. -- The metadata header and body for every API response. - -#### Request - -The code sample below depicts an API request, with both its metadata header and body. - -```json -{ - "auditID": "a886fd9f-5d6b-4ae3-9a10-5bff8f3d68af", - "requestURI": "/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx", - "sourceIPs": ["::1"], - "user": { - "name": "user-f4tt2", - "group": ["system:authenticated"] - }, - "verb": "PUT", - "stage": "RequestReceived", - "stageTimestamp": "2018-07-20 10:33:06 +0800", - "requestBody": { - "hostIPC": false, - "hostNetwork": false, - "hostPID": false, - "paused": false, - "annotations": {}, - "baseType": "workload", - "containers": [ - { - "allowPrivilegeEscalation": false, - "image": "nginx", - "imagePullPolicy": "Always", - "initContainer": false, - "name": "nginx", - "ports": [ - { - "containerPort": 80, - "dnsName": "nginx-nodeport", - "kind": "NodePort", - "name": "80tcp01", - "protocol": "TCP", - "sourcePort": 0, - "type": "/v3/project/schemas/containerPort" - } + "method": "GET", + "remoteAddr": "127.0.0.1:58833", + "responseCode": 200, + "requestTimestamp": "2025-06-30T11:17:04-04:00", + "responseTimestamp": "2025-06-30T11:17:04-04:00", + "requestHeader": { + "Accept": [ + "application/json" ], - "privileged": false, - "readOnly": false, - "resources": { - "type": "/v3/project/schemas/resourceRequirements", - "requests": {}, - "limits": {} - }, - "restartCount": 0, - "runAsNonRoot": false, - "stdin": true, - "stdinOnce": false, - "terminationMessagePath": "/dev/termination-log", - "terminationMessagePolicy": "File", - "tty": true, - "type": "/v3/project/schemas/container", - "environmentFrom": [], - "capAdd": [], - "capDrop": [], - "livenessProbe": null, - "volumeMounts": [] - } - ], - "created": "2018-07-18T07:34:16Z", - "createdTS": 1531899256000, - "creatorId": null, - "deploymentConfig": { - "maxSurge": 1, - "maxUnavailable": 0, - "minReadySeconds": 0, - "progressDeadlineSeconds": 600, - "revisionHistoryLimit": 10, - "strategy": "RollingUpdate" - }, - "deploymentStatus": { - "availableReplicas": 1, - "conditions": [ - { - "lastTransitionTime": "2018-07-18T07:34:38Z", - "lastTransitionTimeTS": 1531899278000, - "lastUpdateTime": "2018-07-18T07:34:38Z", - "lastUpdateTimeTS": 1531899278000, - "message": "Deployment has minimum availability.", - "reason": "MinimumReplicasAvailable", - "status": "True", - "type": "Available" - }, - { - "lastTransitionTime": "2018-07-18T07:34:16Z", - "lastTransitionTimeTS": 1531899256000, - "lastUpdateTime": "2018-07-18T07:34:38Z", - "lastUpdateTimeTS": 1531899278000, - "message": "ReplicaSet \"nginx-64d85666f9\" has successfully progressed.", - "reason": "NewReplicaSetAvailable", - "status": "True", - "type": "Progressing" - } - ], - "observedGeneration": 2, - "readyReplicas": 1, - "replicas": 1, - "type": "/v3/project/schemas/deploymentStatus", - "unavailableReplicas": 0, - "updatedReplicas": 1 - }, - "dnsPolicy": "ClusterFirst", - "id": "deployment:default:nginx", - "labels": { - "workload.user.cattle.io/workloadselector": "deployment-default-nginx" - }, - "name": "nginx", - "namespaceId": "default", - "projectId": "c-bcz5t:p-fdr4s", - "publicEndpoints": [ - { - "addresses": ["10.64.3.58"], - "allNodes": true, - "ingressId": null, - "nodeId": null, - "podId": null, - "port": 30917, - "protocol": "TCP", - "serviceId": "default:nginx-nodeport", - "type": "publicEndpoint" - } - ], - "restartPolicy": "Always", - "scale": 1, - "schedulerName": "default-scheduler", - "selector": { - "matchLabels": { - "workload.user.cattle.io/workloadselector": "deployment-default-nginx" - }, - "type": "/v3/project/schemas/labelSelector" - }, - "state": "active", - "terminationGracePeriodSeconds": 30, - "transitioning": "no", - "transitioningMessage": "", - "type": "deployment", - "uuid": "f998037d-8a5c-11e8-a4cf-0245a7ebb0fd", - "workloadAnnotations": { - "deployment.kubernetes.io/revision": "1", - "field.cattle.io/creatorId": "user-f4tt2" - }, - "workloadLabels": { - "workload.user.cattle.io/workloadselector": "deployment-default-nginx" - }, - "scheduling": { - "node": {} - }, - "description": "my decript", - "volumes": [] - } -} -``` - -#### Response - -The code sample below depicts an API response, with both its metadata header and body. - -```json -{ - "auditID": "a886fd9f-5d6b-4ae3-9a10-5bff8f3d68af", - "responseStatus": "200", - "stage": "ResponseComplete", - "stageTimestamp": "2018-07-20 10:33:06 +0800", - "responseBody": { - "actionLinks": { - "pause": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx?action=pause", - "resume": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx?action=resume", - "rollback": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx?action=rollback" - }, - "annotations": {}, - "baseType": "workload", - "containers": [ - { - "allowPrivilegeEscalation": false, - "image": "nginx", - "imagePullPolicy": "Always", - "initContainer": false, - "name": "nginx", - "ports": [ - { - "containerPort": 80, - "dnsName": "nginx-nodeport", - "kind": "NodePort", - "name": "80tcp01", - "protocol": "TCP", - "sourcePort": 0, - "type": "/v3/project/schemas/containerPort" - } + "Accept-Encoding": [ + "gzip, deflate, br, zstd" ], - "privileged": false, - "readOnly": false, - "resources": { - "type": "/v3/project/schemas/resourceRequirements" - }, - "restartCount": 0, - "runAsNonRoot": false, - "stdin": true, - "stdinOnce": false, - "terminationMessagePath": "/dev/termination-log", - "terminationMessagePolicy": "File", - "tty": true, - "type": "/v3/project/schemas/container" - } - ], - "created": "2018-07-18T07:34:16Z", - "createdTS": 1531899256000, - "creatorId": null, - "deploymentConfig": { - "maxSurge": 1, - "maxUnavailable": 0, - "minReadySeconds": 0, - "progressDeadlineSeconds": 600, - "revisionHistoryLimit": 10, - "strategy": "RollingUpdate" + "Accept-Language": [ + "en-US,en;q=0.5" + ], + "Connection": [ + "keep-alive" + ], + "Cookie": [ + "[redacted]" + ], + "Referer": [ + "https://localhost:8443/dashboard/c/local/explorer/apps.deployment" + ], + "Sec-Fetch-Dest": [ + "empty" + ], + "Sec-Fetch-Mode": [ + "cors" + ], + "Sec-Fetch-Site": [ + "same-origin" + ], + "User-Agent": [ + "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0" + ], + "X-Api-Csrf": [ + "fccc690cab7b0c169b3fc6527edadef3" + ] }, - "deploymentStatus": { - "availableReplicas": 1, - "conditions": [ - { - "lastTransitionTime": "2018-07-18T07:34:38Z", - "lastTransitionTimeTS": 1531899278000, - "lastUpdateTime": "2018-07-18T07:34:38Z", - "lastUpdateTimeTS": 1531899278000, - "message": "Deployment has minimum availability.", - "reason": "MinimumReplicasAvailable", - "status": "True", - "type": "Available" - }, - { - "lastTransitionTime": "2018-07-18T07:34:16Z", - "lastTransitionTimeTS": 1531899256000, - "lastUpdateTime": "2018-07-18T07:34:38Z", - "lastUpdateTimeTS": 1531899278000, - "message": "ReplicaSet \"nginx-64d85666f9\" has successfully progressed.", - "reason": "NewReplicaSetAvailable", - "status": "True", - "type": "Progressing" - } - ], - "observedGeneration": 2, - "readyReplicas": 1, - "replicas": 1, - "type": "/v3/project/schemas/deploymentStatus", - "unavailableReplicas": 0, - "updatedReplicas": 1 - }, - "dnsPolicy": "ClusterFirst", - "hostIPC": false, - "hostNetwork": false, - "hostPID": false, - "id": "deployment:default:nginx", - "labels": { - "workload.user.cattle.io/workloadselector": "deployment-default-nginx" - }, - "links": { - "remove": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx", - "revisions": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx/revisions", - "self": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx", - "update": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx", - "yaml": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx/yaml" - }, - "name": "nginx", - "namespaceId": "default", - "paused": false, - "projectId": "c-bcz5t:p-fdr4s", - "publicEndpoints": [ - { - "addresses": ["10.64.3.58"], - "allNodes": true, - "ingressId": null, - "nodeId": null, - "podId": null, - "port": 30917, - "protocol": "TCP", - "serviceId": "default:nginx-nodeport" - } - ], - "restartPolicy": "Always", - "scale": 1, - "schedulerName": "default-scheduler", - "selector": { - "matchLabels": { - "workload.user.cattle.io/workloadselector": "deployment-default-nginx" - }, - "type": "/v3/project/schemas/labelSelector" - }, - "state": "active", - "terminationGracePeriodSeconds": 30, - "transitioning": "no", - "transitioningMessage": "", - "type": "deployment", - "uuid": "f998037d-8a5c-11e8-a4cf-0245a7ebb0fd", - "workloadAnnotations": { - "deployment.kubernetes.io/revision": "1", - "field.cattle.io/creatorId": "user-f4tt2" - }, - "workloadLabels": { - "workload.user.cattle.io/workloadselector": "deployment-default-nginx" + "responseHeader": { + "Cache-Control": [ + "no-cache, no-store, must-revalidate" + ], + "Content-Encoding": [ + "gzip" + ], + "Content-Type": [ + "application/json" + ], + "Expires": [ + "Wed 24 Feb 1982 18:42:00 GMT" + ], + "X-Api-Cattle-Auth": [ + "true" + ], + "X-Api-Schemas": [ + "https://localhost:8443/v1/schemas" + ], + "X-Content-Type-Options": [ + "nosniff" + ] } - } } ``` + +### Metadata, headers and Request Body Level + +If you set your `AUDIT_LEVEL` to `2`, Rancher logs the metadata, the request and response headers and the request body for every API request. + +The code sample below depicts an API request, with both its metadata, headers and request body. + +```json +{ + "auditID": "d1088a09-2a13-4450-970e-0d44bd2c49ee", + "requestURI": "/v3/projects", + "user": { + "name": "user-6j5s6", + "group": [ + "system:authenticated", + "system:cattle:authenticated" + ], + "extra": { + "principalid": [ + "local://user-6j5s6" + ], + "requesthost": [ + "localhost:8443" + ], + "requesttokenid": [ + "token-zs42h" + ], + "username": [ + "admin" + ] + } + }, + "method": "POST", + "remoteAddr": "127.0.0.1:49966", + "responseCode": 201, + "requestTimestamp": "2025-06-30T12:32:13-04:00", + "responseTimestamp": "2025-06-30T12:32:13-04:00", + "requestHeader": { + "Accept": [ + "application/json" + ], + "Accept-Encoding": [ + "gzip, deflate, br, zstd" + ], + "Accept-Language": [ + "en-US,en;q=0.5" + ], + "Connection": [ + "keep-alive" + ], + "Content-Length": [ + "214" + ], + "Content-Type": [ + "application/json" + ], + "Cookie": [ + "[redacted]" + ], + "Impersonate-Extra-Principalid": [ + "local://user-6j5s6" + ], + "Impersonate-Extra-Requesthost": [ + "localhost:8443" + ], + "Impersonate-Extra-Requesttokenid": [ + "token-zs42h" + ], + "Impersonate-Extra-Username": [ + "admin" + ], + "Impersonate-Group": [ + "system:authenticated", + "system:cattle:authenticated" + ], + "Impersonate-User": [ + "user-6j5s6" + ], + "Origin": [ + "https://localhost:8443" + ], + "Priority": [ + "u=0" + ], + "Referer": [ + "https://localhost:8443/dashboard/c/local/explorer/management.cattle.io.project/create" + ], + "Sec-Fetch-Dest": [ + "empty" + ], + "Sec-Fetch-Mode": [ + "cors" + ], + "Sec-Fetch-Site": [ + "same-origin" + ], + "User-Agent": [ + "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0" + ], + "X-Api-Csrf": [ + "fccc690cab7b0c169b3fc6527edadef3" + ] + }, + "responseHeader": { + "Cache-Control": [ + "no-cache, no-store, must-revalidate" + ], + "Content-Encoding": [ + "gzip" + ], + "Content-Type": [ + "application/json" + ], + "Expires": [ + "Wed 24 Feb 1982 18:42:00 GMT" + ], + "X-Api-Cattle-Auth": [ + "true" + ], + "X-Api-Schemas": [ + "https://localhost:8443/v3/project/schemas" + ], + "X-Content-Type-Options": [ + "nosniff" + ] + }, + "requestBody": { + "annotations": {}, + "clusterId": "local", + "containerDefaultResourceLimit": {}, + "creatorId": "local://user-6j5s6", + "labels": {}, + "name": "example-project", + "namespaceDefaultResourceQuota": {}, + "resourceQuota": {}, + "type": "project" + } +} +``` + +### Metadata, Headers, Request Body and Response Body Level + +If you set your `AUDIT_LEVEL` to `3`, Rancher logs the metadata, request and response headers and request body and response. + +The code sample below depicts an example of an API request with that information logged. + +```json +{ + "auditID": "a9549a5b-4351-4bd5-adcd-12f7ec667a6b", + "requestURI": "/v3/projects", + "user": { + "name": "user-6j5s6", + "group": [ + "system:authenticated", + "system:cattle:authenticated" + ], + "extra": { + "principalid": [ + "local://user-6j5s6" + ], + "requesthost": [ + "localhost:8443" + ], + "requesttokenid": [ + "token-zs42h" + ], + "username": [ + "admin" + ] + } + }, + "method": "POST", + "remoteAddr": "127.0.0.1:50454", + "responseCode": 201, + "requestTimestamp": "2025-06-30T12:42:24-04:00", + "responseTimestamp": "2025-06-30T12:42:24-04:00", + "requestHeader": { + "Accept": [ + "application/json" + ], + "Accept-Encoding": [ + "gzip, deflate, br, zstd" + ], + "Accept-Language": [ + "en-US,en;q=0.5" + ], + "Connection": [ + "keep-alive" + ], + "Content-Length": [ + "214" + ], + "Content-Type": [ + "application/json" + ], + "Cookie": [ + "[redacted]" + ], + "Impersonate-Extra-Principalid": [ + "local://user-6j5s6" + ], + "Impersonate-Extra-Requesthost": [ + "localhost:8443" + ], + "Impersonate-Extra-Requesttokenid": [ + "token-zs42h" + ], + "Impersonate-Extra-Username": [ + "admin" + ], + "Impersonate-Group": [ + "system:authenticated", + "system:cattle:authenticated" + ], + "Impersonate-User": [ + "user-6j5s6" + ], + "Origin": [ + "https://localhost:8443" + ], + "Priority": [ + "u=0" + ], + "Referer": [ + "https://localhost:8443/dashboard/c/local/explorer/management.cattle.io.project/create" + ], + "Sec-Fetch-Dest": [ + "empty" + ], + "Sec-Fetch-Mode": [ + "cors" + ], + "Sec-Fetch-Site": [ + "same-origin" + ], + "User-Agent": [ + "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0" + ], + "X-Api-Csrf": [ + "fccc690cab7b0c169b3fc6527edadef3" + ] + }, + "responseHeader": { + "Cache-Control": [ + "no-cache, no-store, must-revalidate" + ], + "Content-Encoding": [ + "gzip" + ], + "Content-Type": [ + "application/json" + ], + "Expires": [ + "Wed 24 Feb 1982 18:42:00 GMT" + ], + "X-Api-Cattle-Auth": [ + "true" + ], + "X-Api-Schemas": [ + "https://localhost:8443/v3/project/schemas" + ], + "X-Content-Type-Options": [ + "nosniff" + ] + }, + "requestBody": { + "annotations": {}, + "clusterId": "local", + "containerDefaultResourceLimit": {}, + "creatorId": "local://user-6j5s6", + "labels": {}, + "name": "example-project", + "namespaceDefaultResourceQuota": {}, + "resourceQuota": {}, + "type": "project" + }, + "responseBody": { + "actions": { + "exportYaml": "https://localhost:8443/v3/projects/local:p-qt6tq?action=exportYaml" + }, + "annotations": { + "authz.management.cattle.io/creator-role-bindings": "{\"required\":[\"project-owner\"]}" + }, + "backingNamespace": "local-p-qt6tq", + "baseType": "project", + "clusterId": "local", + "containerDefaultResourceLimit": { + "type": "/v3/schemas/containerResourceLimit" + }, + "created": "2025-06-30T16:42:24Z", + "createdTS": 1751301744000, + "creatorId": "user-6j5s6", + "id": "local:p-qt6tq", + "labels": { + "cattle.io/creator": "norman" + }, + "links": { + "basicAuths": "https://localhost:8443/v3/projects/local:p-qt6tq/basicauths", + "certificates": "https://localhost:8443/v3/projects/local:p-qt6tq/certificates", + "configMaps": "https://localhost:8443/v3/projects/local:p-qt6tq/configmaps", + "cronJobs": "https://localhost:8443/v3/projects/local:p-qt6tq/cronjobs", + "daemonSets": "https://localhost:8443/v3/projects/local:p-qt6tq/daemonsets", + "deployments": "https://localhost:8443/v3/projects/local:p-qt6tq/deployments", + "dnsRecords": "https://localhost:8443/v3/projects/local:p-qt6tq/dnsrecords", + "dockerCredentials": "https://localhost:8443/v3/projects/local:p-qt6tq/dockercredentials", + "horizontalPodAutoscalers": "https://localhost:8443/v3/projects/local:p-qt6tq/horizontalpodautoscalers", + "ingresses": "https://localhost:8443/v3/projects/local:p-qt6tq/ingresses", + "jobs": "https://localhost:8443/v3/projects/local:p-qt6tq/jobs", + "namespacedBasicAuths": "https://localhost:8443/v3/projects/local:p-qt6tq/namespacedbasicauths", + "namespacedCertificates": "https://localhost:8443/v3/projects/local:p-qt6tq/namespacedcertificates", + "namespacedDockerCredentials": "https://localhost:8443/v3/projects/local:p-qt6tq/namespaceddockercredentials", + "namespacedSecrets": "https://localhost:8443/v3/projects/local:p-qt6tq/namespacedsecrets", + "namespacedServiceAccountTokens": "[redacted]", + "namespacedSshAuths": "https://localhost:8443/v3/projects/local:p-qt6tq/namespacedsshauths", + "persistentVolumeClaims": "https://localhost:8443/v3/projects/local:p-qt6tq/persistentvolumeclaims", + "pods": "https://localhost:8443/v3/projects/local:p-qt6tq/pods", + "projectNetworkPolicies": "https://localhost:8443/v3/projects/local:p-qt6tq/projectnetworkpolicies", + "projectRoleTemplateBindings": "https://localhost:8443/v3/projects/local:p-qt6tq/projectroletemplatebindings", + "remove": "https://localhost:8443/v3/projects/local:p-qt6tq", + "replicaSets": "https://localhost:8443/v3/projects/local:p-qt6tq/replicasets", + "replicationControllers": "https://localhost:8443/v3/projects/local:p-qt6tq/replicationcontrollers", + "secrets": "https://localhost:8443/v3/projects/local:p-qt6tq/secrets", + "self": "https://localhost:8443/v3/projects/local:p-qt6tq", + "serviceAccountTokens": "[redacted]", + "services": "https://localhost:8443/v3/projects/local:p-qt6tq/services", + "sshAuths": "https://localhost:8443/v3/projects/local:p-qt6tq/sshauths", + "statefulSets": "https://localhost:8443/v3/projects/local:p-qt6tq/statefulsets", + "subscribe": "https://localhost:8443/v3/projects/local:p-qt6tq/subscribe", + "update": "https://localhost:8443/v3/projects/local:p-qt6tq", + "workloads": "https://localhost:8443/v3/projects/local:p-qt6tq/workloads" + }, + "name": "example-project", + "namespaceDefaultResourceQuota": { + "limit": { + "type": "/v3/schemas/resourceQuotaLimit" + }, + "type": "/v3/schemas/namespaceResourceQuota" + }, + "namespaceId": null, + "resourceQuota": { + "limit": { + "type": "/v3/schemas/resourceQuotaLimit" + }, + "type": "/v3/schemas/projectResourceQuota", + "usedLimit": { + "type": "/v3/schemas/resourceQuotaLimit" + } + }, + "state": "active", + "transitioning": "no", + "transitioningMessage": "", + "type": "project", + "uuid": "b582603b-7826-4302-8393-792df2611265" + } +} +``` \ No newline at end of file diff --git a/docs/reference-guides/single-node-rancher-in-docker/advanced-options.md b/docs/reference-guides/single-node-rancher-in-docker/advanced-options.md index c4dcde046d9..18cadd15b4c 100644 --- a/docs/reference-guides/single-node-rancher-in-docker/advanced-options.md +++ b/docs/reference-guides/single-node-rancher-in-docker/advanced-options.md @@ -44,6 +44,7 @@ Privileged access is [required.](../../getting-started/installation-and-upgrade/ docker run -d --restart=unless-stopped \ -p 80:80 -p 443:443 \ -v /var/log/rancher/auditlog:/var/log/auditlog \ + -e AUDIT_LOG_ENABLED=true \ -e AUDIT_LEVEL=1 \ --privileged \ rancher/rancher:latest diff --git a/docs/troubleshooting/other-troubleshooting-tips/user-id-tracking-in-audit-logs.md b/docs/troubleshooting/other-troubleshooting-tips/user-id-tracking-in-audit-logs.md index adecdecde12..24fba32d46b 100644 --- a/docs/troubleshooting/other-troubleshooting-tips/user-id-tracking-in-audit-logs.md +++ b/docs/troubleshooting/other-troubleshooting-tips/user-id-tracking-in-audit-logs.md @@ -23,4 +23,4 @@ A Rancher Admin should now be able to view Rancher audit logs and follow through ## Feature Description - When Kubernetes Audit logs are enabled on the downstream cluster, in each event that is logged, the external Identity Provider's username is now logged for each request, at the "metadata" level. -- When Rancher API Audit logs are enabled on the Rancher installation, the external Identity Provider's username is also logged now at the `auditLog.level=1` for each request that hits the Rancher API server, including the login requests. +- When you enable Rancher API Audit logs for a Rancher installation, the external Identity Provider's username is also logged now at the `auditLog.level=0` for each request that hits the Rancher API server, including login requests. diff --git a/versioned_docs/version-2.12/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md b/versioned_docs/version-2.12/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md index aa8da6f793f..8dedc6288bf 100644 --- a/versioned_docs/version-2.12/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md +++ b/versioned_docs/version-2.12/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md @@ -36,7 +36,8 @@ For information on enabling experimental features, refer to [this page.](../../. | `antiAffinity` | "preferred" | `string` - AntiAffinity rule for Rancher pods - "preferred, required" | | `auditLog.destination` | "sidecar" | `string` - Stream to sidecar container console or hostPath volume - "sidecar, hostPath" | | `auditLog.hostPath` | "/var/log/rancher/audit" | `string` - log file destination on host (only applies when `auditLog.destination` is set to `hostPath`) | -| `auditLog.level` | 0 | `int` - set the [API Audit Log](../../../how-to-guides/advanced-user-guides/enable-api-audit-log.md) level. 0 is off. [0-3] | +| `auditLog.enabled` | false | `bool` - Enables / disables audit logging. | +| `auditLog.level` | 0 | `int` - Sets the [API Audit Log](../../../how-to-guides/advanced-user-guides/enable-api-audit-log.md) level [0-3]. | | `auditLog.maxAge` | 1 | `int` - maximum number of days to retain old audit log files (only applies when `auditLog.destination` is set to `hostPath`) | | `auditLog.maxBackup` | 1 | `int` - maximum number of audit log files to retain (only applies when `auditLog.destination` is set to `hostPath`) | | `auditLog.maxSize` | 100 | `int` - maximum size in megabytes of the audit log file before it gets rotated (only applies when `auditLog.destination` is set to `hostPath`) | @@ -63,6 +64,10 @@ For information on enabling experimental features, refer to [this page.](../../. | `tls` | "ingress" | `string` - See [External TLS Termination](#external-tls-termination) for details. - "ingress, external" | | `useBundledSystemChart` | `false` | `bool` - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations. | + +When using Rancher v2.12.0 and above, Rancher will use an audit logging controller that watches `AuditPolicy` CRs for configuring additional redactions, for more info see [API Audit Log](../../../how-to-guides/advanced-user-guides/enable-api-audit-log.md). + + ### Bootstrap Password You can [set a specific bootstrap password](../resources/bootstrap-password.md) during Rancher installation. If you don't set a specific bootstrap password, Rancher randomly generates a password for the first admin account. diff --git a/versioned_docs/version-2.12/how-to-guides/advanced-user-guides/configure-layer-7-nginx-load-balancer.md b/versioned_docs/version-2.12/how-to-guides/advanced-user-guides/configure-layer-7-nginx-load-balancer.md index f7266be3ff3..7a4384b4dad 100644 --- a/versioned_docs/version-2.12/how-to-guides/advanced-user-guides/configure-layer-7-nginx-load-balancer.md +++ b/versioned_docs/version-2.12/how-to-guides/advanced-user-guides/configure-layer-7-nginx-load-balancer.md @@ -185,6 +185,7 @@ For help troubleshooting certificates, see [this section.](../../getting-started If you want to record all transactions with the Rancher API, enable the [API Auditing](enable-api-audit-log.md) feature by adding the flags below into your install command. -e AUDIT_LEVEL=1 \ + -e AUDIT_LOG_ENABLED=true \ -e AUDIT_LOG_PATH=/var/log/auditlog/rancher-api-audit.log \ -e AUDIT_LOG_MAXAGE=20 \ -e AUDIT_LOG_MAXBACKUP=20 \ diff --git a/versioned_docs/version-2.12/how-to-guides/advanced-user-guides/enable-api-audit-log.md b/versioned_docs/version-2.12/how-to-guides/advanced-user-guides/enable-api-audit-log.md index 4f0a15c7984..36e9a7f5ad3 100644 --- a/versioned_docs/version-2.12/how-to-guides/advanced-user-guides/enable-api-audit-log.md +++ b/versioned_docs/version-2.12/how-to-guides/advanced-user-guides/enable-api-audit-log.md @@ -24,7 +24,8 @@ The usage below defines rules about what the audit log should record and what da | Parameter | Description | | ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| `AUDIT_LEVEL` | `0` - Disable audit log (default setting).
`1` - Log event metadata.
`2` - Log event metadata and request body.
`3` - Log event metadata, request body, and response body. Each log transaction for a request/response pair uses the same `auditID` value.

See [Audit Level Logging](#audit-log-levels) for a table that displays what each setting logs. | +| `AUDIT_LOG_ENABLED` | `false` - Disables the audit log (default setting).
`true` - Enables the audit log. | +| `AUDIT_LEVEL` | `0` - Log request and response metadata (default setting).
`1` - Log request and response headers.
`2` - Log request body.
`3` - Log response body. Each log level is cumulative and each subsequent level logs the previous level data. Each log transaction for a request/response pair uses the same `auditID` value.

See [Audit Level Logging](#audit-log-levels) for a table that displays what each setting logs. | | `AUDIT_LOG_PATH` | Log path for Rancher Server API. Default path is `/var/log/auditlog/rancher-api-audit.log`. You can mount the log directory to host.

Usage Example: `AUDIT_LOG_PATH=/my/custom/path/`
| | `AUDIT_LOG_MAXAGE` | Defined the maximum number of days to retain old audit log files. Default is 10 days. | | `AUDIT_LOG_MAXBACKUP` | Defines the maximum number of audit log files to retain. Default is 10. | @@ -36,12 +37,138 @@ The usage below defines rules about what the audit log should record and what da The following table displays what parts of API transactions are logged for each [`AUDIT_LEVEL`](#api-audit-log-options) setting. -| `AUDIT_LEVEL` Setting | Metadata | Request Body | Response Body | -| --------------------- | -------- | ------------ | ------------- | -| `0` | | | | -| `1` | ✓ | | | -| `2` | ✓ | ✓ | | -| `3` | ✓ | ✓ | ✓ | + +| `AUDIT_LEVEL` Setting | Metadata | Request Headers | Response Headers | Request Body | Response Body | +|--------------------------------|----------------|---------------------------|-----------------------------|----------------------|-----------------------| +| 0 | ✓ | +| 1 | ✓ | ✓ | ✓ +| 2 | ✓ | ✓ | ✓ | ✓ +| 3 | ✓ | ✓ | ✓ | ✓ | ✓ + +## Audit Log policies + +Audit log policies allow end users to configure redactions using `AuditPolicy` cluster-scoped CRs in addition to the [default redactions and filters](#default-redactions--filters). + +All configured audit log policies are additive. + +Redaction policies for headers utilize a regular expression (regex) engine to redact headers, while a JSONPath engine is used to redact request/response headers. + +The JSONPath engine does not support the script or filter expressions. For getting started with JSONPath expressions, a good resource to consult is [Stafan Goessner's article on JSONPath](https://goessner.net/articles/JsonPath/). + +The structure of an audit policy CR is as follows: + +```yaml +apiVersion: auditlog.cattle.io/v1 +kind: AuditPolicy +spec: + enabled : true # true/false + # list of API request filters + filters: + - action: allow # allow/deny + # would allow logs sent to "/foo/some/endpoint" but not "/foo" or "/foobar". + requestURI: "/foo/.*" + # additionalRedactions allows configuration of redactions on headers using `jsonpath` expressions + additionalRedactions: + # redacts headers based on regex expressions + - headers: + - "Cache.*" + # paths redacts information from request and response bodies based on json path expressions + paths: + - "$.gitCommit" + verbosity: + level : 0 # matches the levels in the above audit log table + # request allows fine-grained control over which request data + # gets included. This overrides the behaviour of the generic verbosity.level + request: + headers : true # true/false + body : true # true/false + # response allows fine-grained control over which response data + # gets included. This overrides the behaviour of the generic verbosity.level + response: + headers : true # true/false + body: true # true/false +``` + +### Examples + +The following example shows only logging requests containing `login` in the request path to the audit log path: + +```yaml +apiVersion: auditlog.cattle.io/v1 +kind: AuditPolicy +metadata: + name: filters +spec: + filters: + - action: deny + requestUri: ".*" + - action: allow + requestUri: ".*login.*" +``` + +The following example shows how to redact specific fields containing `gitCommint` in request/response bodies: + +```yaml +apiVersion: auditlog.cattle.io/v1 +kind: AuditPolicy +metadata: + name: redactions +spec: + additionalRedactions: + - paths: + - "$.gitCommit" +``` + +### Default redactions & filters + +The audit log controller comes with default built-in redactions for common sensitive information. + +#### Redacted headers + +Generic headers: +- `Cookie` +- `Set-Cookie` +- `X-Api-Set-Cookie-Header` +- `Authorization` +- `X-Api-Tunnel-Params` +- `X-Api-Tunnel-Token` +- `X-Api-Auth-Header` +- `X-Amz-Security-Token` + + +#### Redacted body fields + +Generic body fields: + +- `credentials` +- `applicationSecret` +- `oauthCredential` +- `serviceAccountCredential` +- `spKey` +- `spCert` +- `certificate` +- `privateKey` +- `secretsEncryptionConfig` +- `manifestUrl` +- `insecureWindowsNodeCommand` +- `insecureNodeCommand` +- `insecureCommand` +- `command` +- `nodeCommand` +- `windowsNodeCommand` +- `clientRandom` + +Generic body regex redactor: +- `".*([pP]assword|[Kk]ube[Cc]onfig|[Tt]oken).*"` + +#### Cluster Driver + +By default, any API request with fields tied to cluster drivers will have any non `public*` or `optional*` fields redacted by the audit log controller. + +#### Redacted URIs + +Any endpoint containing `secrets` or `configmaps` will have relevant fields stripped from both the request and response bodies. Additionally, any endpoint containing `/v3/imports/*` will have its URI redacted. + ## Viewing API Audit Logs @@ -71,492 +198,488 @@ After you enable auditing, each API request or response is logged by Rancher in ### Metadata Level -If you set your `AUDIT_LEVEL` to `1`, Rancher logs the metadata header for every API request, but not the body. The header provides basic information about the API transaction, such as the transaction's ID, who initiated the transaction, the time it occurred, etc. +If you set your `AUDIT_LEVEL` to `0`, Rancher logs the metadata header for every API request, but neither the body nor the request and response headers. The metadata provides basic information about the API transaction, such as the transaction ID, the initiator of the transaction, the time it occurred, etc. ```json { - "auditID": "30022177-9e2e-43d1-b0d0-06ef9d3db183", - "requestURI": "/v3/schemas", - "sourceIPs": ["::1"], - "user": { - "name": "user-f4tt2", - "group": ["system:authenticated"] - }, - "verb": "GET", - "stage": "RequestReceived", - "stageTimestamp": "2018-07-20 10:22:43 +0800" + "auditID": "40bd4e40-875b-4020-933e-4c4f4c4db366", + "requestURI": "/v3/schemas", + "user": { + "name": "user-6j5s6", + "group": [ + "system:authenticated", + "system:cattle:authenticated" + ], + "extra": { + "principalid": [ + "local://user-6j5s6" + ], + "requesthost": [ + "localhost:8443" + ], + "requesttokenid": [ + "token-zs42h" + ], + "username": [ + "admin" + ] + } + }, + "method": "GET", + "remoteAddr": "127.0.0.1:58652", + "responseCode": 200, + "requestTimestamp": "2025-06-30T11:13:25-04:00", + "responseTimestamp": "2025-06-30T11:13:25-04:00" } ``` -### Metadata and Request Body Level +### Metadata and headers level -If you set your `AUDIT_LEVEL` to `2`, Rancher logs the metadata header and body for every API request. - -The code sample below depicts an API request, with both its metadata header and body. +If you set your `AUDIT_LEVEL` to `1`, Rancher logs the metadata and the request and response headers for every API request. ```json { - "auditID": "ef1d249e-bfac-4fd0-a61f-cbdcad53b9bb", - "requestURI": "/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx", - "sourceIPs": ["::1"], - "user": { - "name": "user-f4tt2", - "group": ["system:authenticated"] - }, - "verb": "PUT", - "stage": "RequestReceived", - "stageTimestamp": "2018-07-20 10:28:08 +0800", - "requestBody": { - "hostIPC": false, - "hostNetwork": false, - "hostPID": false, - "paused": false, - "annotations": {}, - "baseType": "workload", - "containers": [ - { - "allowPrivilegeEscalation": false, - "image": "nginx", - "imagePullPolicy": "Always", - "initContainer": false, - "name": "nginx", - "ports": [ - { - "containerPort": 80, - "dnsName": "nginx-nodeport", - "kind": "NodePort", - "name": "80tcp01", - "protocol": "TCP", - "sourcePort": 0, - "type": "/v3/project/schemas/containerPort" - } + "auditID": "f8c83dc6-a080-4e2e-ab43-552bddf01716", + "requestURI": "/v1/apps.deployments?page=1&pagesize=100&sort=metadata.name&filter=metadata.namespace!=p-npsl5&filter=metadata.namespace!=p-nzp6c&filter=metadata.namespace!=cattle-fleet-clusters-system&filter=metadata.namespace!=cattle-fleet-system&filter=metadata.namespace!=cattle-global-data&filter=metadata.namespace!=cattle-impersonation-system&filter=metadata.namespace!=cattle-provisioning-capi-system&filter=metadata.namespace!=cattle-system&filter=metadata.namespace!=cattle-ui-plugin-system&filter=metadata.namespace!=cluster-fleet-local-local-1a3d67d0a899&filter=metadata.namespace!=fleet-default&filter=metadata.namespace!=fleet-local&filter=metadata.namespace!=kube-node-lease&filter=metadata.namespace!=kube-public&filter=metadata.namespace!=kube-system&exclude=metadata.managedFields", + "user": { + "name": "user-6j5s6", + "group": [ + "system:authenticated", + "system:cattle:authenticated" ], - "privileged": false, - "readOnly": false, - "resources": { - "type": "/v3/project/schemas/resourceRequirements", - "requests": {}, - "limits": {} - }, - "restartCount": 0, - "runAsNonRoot": false, - "stdin": true, - "stdinOnce": false, - "terminationMessagePath": "/dev/termination-log", - "terminationMessagePolicy": "File", - "tty": true, - "type": "/v3/project/schemas/container", - "environmentFrom": [], - "capAdd": [], - "capDrop": [], - "livenessProbe": null, - "volumeMounts": [] - } - ], - "created": "2018-07-18T07:34:16Z", - "createdTS": 1531899256000, - "creatorId": null, - "deploymentConfig": { - "maxSurge": 1, - "maxUnavailable": 0, - "minReadySeconds": 0, - "progressDeadlineSeconds": 600, - "revisionHistoryLimit": 10, - "strategy": "RollingUpdate" - }, - "deploymentStatus": { - "availableReplicas": 1, - "conditions": [ - { - "lastTransitionTime": "2018-07-18T07:34:38Z", - "lastTransitionTimeTS": 1531899278000, - "lastUpdateTime": "2018-07-18T07:34:38Z", - "lastUpdateTimeTS": 1531899278000, - "message": "Deployment has minimum availability.", - "reason": "MinimumReplicasAvailable", - "status": "True", - "type": "Available" - }, - { - "lastTransitionTime": "2018-07-18T07:34:16Z", - "lastTransitionTimeTS": 1531899256000, - "lastUpdateTime": "2018-07-18T07:34:38Z", - "lastUpdateTimeTS": 1531899278000, - "message": "ReplicaSet \"nginx-64d85666f9\" has successfully progressed.", - "reason": "NewReplicaSetAvailable", - "status": "True", - "type": "Progressing" + "extra": { + "principalid": [ + "local://user-6j5s6" + ], + "requesthost": [ + "localhost:8443" + ], + "requesttokenid": [ + "token-zs42h" + ], + "username": [ + "admin" + ] } - ], - "observedGeneration": 2, - "readyReplicas": 1, - "replicas": 1, - "type": "/v3/project/schemas/deploymentStatus", - "unavailableReplicas": 0, - "updatedReplicas": 1 }, - "dnsPolicy": "ClusterFirst", - "id": "deployment:default:nginx", - "labels": { - "workload.user.cattle.io/workloadselector": "deployment-default-nginx" - }, - "name": "nginx", - "namespaceId": "default", - "projectId": "c-bcz5t:p-fdr4s", - "publicEndpoints": [ - { - "addresses": ["10.64.3.58"], - "allNodes": true, - "ingressId": null, - "nodeId": null, - "podId": null, - "port": 30917, - "protocol": "TCP", - "serviceId": "default:nginx-nodeport", - "type": "publicEndpoint" - } - ], - "restartPolicy": "Always", - "scale": 1, - "schedulerName": "default-scheduler", - "selector": { - "matchLabels": { - "workload.user.cattle.io/workloadselector": "deployment-default-nginx" - }, - "type": "/v3/project/schemas/labelSelector" - }, - "state": "active", - "terminationGracePeriodSeconds": 30, - "transitioning": "no", - "transitioningMessage": "", - "type": "deployment", - "uuid": "f998037d-8a5c-11e8-a4cf-0245a7ebb0fd", - "workloadAnnotations": { - "deployment.kubernetes.io/revision": "1", - "field.cattle.io/creatorId": "user-f4tt2" - }, - "workloadLabels": { - "workload.user.cattle.io/workloadselector": "deployment-default-nginx" - }, - "scheduling": { - "node": {} - }, - "description": "my description", - "volumes": [] - } -} -``` - -### Metadata, Request Body, and Response Body Level - -If you set your `AUDIT_LEVEL` to `3`, Rancher logs: - -- The metadata header and body for every API request. -- The metadata header and body for every API response. - -#### Request - -The code sample below depicts an API request, with both its metadata header and body. - -```json -{ - "auditID": "a886fd9f-5d6b-4ae3-9a10-5bff8f3d68af", - "requestURI": "/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx", - "sourceIPs": ["::1"], - "user": { - "name": "user-f4tt2", - "group": ["system:authenticated"] - }, - "verb": "PUT", - "stage": "RequestReceived", - "stageTimestamp": "2018-07-20 10:33:06 +0800", - "requestBody": { - "hostIPC": false, - "hostNetwork": false, - "hostPID": false, - "paused": false, - "annotations": {}, - "baseType": "workload", - "containers": [ - { - "allowPrivilegeEscalation": false, - "image": "nginx", - "imagePullPolicy": "Always", - "initContainer": false, - "name": "nginx", - "ports": [ - { - "containerPort": 80, - "dnsName": "nginx-nodeport", - "kind": "NodePort", - "name": "80tcp01", - "protocol": "TCP", - "sourcePort": 0, - "type": "/v3/project/schemas/containerPort" - } + "method": "GET", + "remoteAddr": "127.0.0.1:58833", + "responseCode": 200, + "requestTimestamp": "2025-06-30T11:17:04-04:00", + "responseTimestamp": "2025-06-30T11:17:04-04:00", + "requestHeader": { + "Accept": [ + "application/json" ], - "privileged": false, - "readOnly": false, - "resources": { - "type": "/v3/project/schemas/resourceRequirements", - "requests": {}, - "limits": {} - }, - "restartCount": 0, - "runAsNonRoot": false, - "stdin": true, - "stdinOnce": false, - "terminationMessagePath": "/dev/termination-log", - "terminationMessagePolicy": "File", - "tty": true, - "type": "/v3/project/schemas/container", - "environmentFrom": [], - "capAdd": [], - "capDrop": [], - "livenessProbe": null, - "volumeMounts": [] - } - ], - "created": "2018-07-18T07:34:16Z", - "createdTS": 1531899256000, - "creatorId": null, - "deploymentConfig": { - "maxSurge": 1, - "maxUnavailable": 0, - "minReadySeconds": 0, - "progressDeadlineSeconds": 600, - "revisionHistoryLimit": 10, - "strategy": "RollingUpdate" - }, - "deploymentStatus": { - "availableReplicas": 1, - "conditions": [ - { - "lastTransitionTime": "2018-07-18T07:34:38Z", - "lastTransitionTimeTS": 1531899278000, - "lastUpdateTime": "2018-07-18T07:34:38Z", - "lastUpdateTimeTS": 1531899278000, - "message": "Deployment has minimum availability.", - "reason": "MinimumReplicasAvailable", - "status": "True", - "type": "Available" - }, - { - "lastTransitionTime": "2018-07-18T07:34:16Z", - "lastTransitionTimeTS": 1531899256000, - "lastUpdateTime": "2018-07-18T07:34:38Z", - "lastUpdateTimeTS": 1531899278000, - "message": "ReplicaSet \"nginx-64d85666f9\" has successfully progressed.", - "reason": "NewReplicaSetAvailable", - "status": "True", - "type": "Progressing" - } - ], - "observedGeneration": 2, - "readyReplicas": 1, - "replicas": 1, - "type": "/v3/project/schemas/deploymentStatus", - "unavailableReplicas": 0, - "updatedReplicas": 1 - }, - "dnsPolicy": "ClusterFirst", - "id": "deployment:default:nginx", - "labels": { - "workload.user.cattle.io/workloadselector": "deployment-default-nginx" - }, - "name": "nginx", - "namespaceId": "default", - "projectId": "c-bcz5t:p-fdr4s", - "publicEndpoints": [ - { - "addresses": ["10.64.3.58"], - "allNodes": true, - "ingressId": null, - "nodeId": null, - "podId": null, - "port": 30917, - "protocol": "TCP", - "serviceId": "default:nginx-nodeport", - "type": "publicEndpoint" - } - ], - "restartPolicy": "Always", - "scale": 1, - "schedulerName": "default-scheduler", - "selector": { - "matchLabels": { - "workload.user.cattle.io/workloadselector": "deployment-default-nginx" - }, - "type": "/v3/project/schemas/labelSelector" - }, - "state": "active", - "terminationGracePeriodSeconds": 30, - "transitioning": "no", - "transitioningMessage": "", - "type": "deployment", - "uuid": "f998037d-8a5c-11e8-a4cf-0245a7ebb0fd", - "workloadAnnotations": { - "deployment.kubernetes.io/revision": "1", - "field.cattle.io/creatorId": "user-f4tt2" - }, - "workloadLabels": { - "workload.user.cattle.io/workloadselector": "deployment-default-nginx" - }, - "scheduling": { - "node": {} - }, - "description": "my decript", - "volumes": [] - } -} -``` - -#### Response - -The code sample below depicts an API response, with both its metadata header and body. - -```json -{ - "auditID": "a886fd9f-5d6b-4ae3-9a10-5bff8f3d68af", - "responseStatus": "200", - "stage": "ResponseComplete", - "stageTimestamp": "2018-07-20 10:33:06 +0800", - "responseBody": { - "actionLinks": { - "pause": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx?action=pause", - "resume": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx?action=resume", - "rollback": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx?action=rollback" - }, - "annotations": {}, - "baseType": "workload", - "containers": [ - { - "allowPrivilegeEscalation": false, - "image": "nginx", - "imagePullPolicy": "Always", - "initContainer": false, - "name": "nginx", - "ports": [ - { - "containerPort": 80, - "dnsName": "nginx-nodeport", - "kind": "NodePort", - "name": "80tcp01", - "protocol": "TCP", - "sourcePort": 0, - "type": "/v3/project/schemas/containerPort" - } + "Accept-Encoding": [ + "gzip, deflate, br, zstd" ], - "privileged": false, - "readOnly": false, - "resources": { - "type": "/v3/project/schemas/resourceRequirements" - }, - "restartCount": 0, - "runAsNonRoot": false, - "stdin": true, - "stdinOnce": false, - "terminationMessagePath": "/dev/termination-log", - "terminationMessagePolicy": "File", - "tty": true, - "type": "/v3/project/schemas/container" - } - ], - "created": "2018-07-18T07:34:16Z", - "createdTS": 1531899256000, - "creatorId": null, - "deploymentConfig": { - "maxSurge": 1, - "maxUnavailable": 0, - "minReadySeconds": 0, - "progressDeadlineSeconds": 600, - "revisionHistoryLimit": 10, - "strategy": "RollingUpdate" + "Accept-Language": [ + "en-US,en;q=0.5" + ], + "Connection": [ + "keep-alive" + ], + "Cookie": [ + "[redacted]" + ], + "Referer": [ + "https://localhost:8443/dashboard/c/local/explorer/apps.deployment" + ], + "Sec-Fetch-Dest": [ + "empty" + ], + "Sec-Fetch-Mode": [ + "cors" + ], + "Sec-Fetch-Site": [ + "same-origin" + ], + "User-Agent": [ + "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0" + ], + "X-Api-Csrf": [ + "fccc690cab7b0c169b3fc6527edadef3" + ] }, - "deploymentStatus": { - "availableReplicas": 1, - "conditions": [ - { - "lastTransitionTime": "2018-07-18T07:34:38Z", - "lastTransitionTimeTS": 1531899278000, - "lastUpdateTime": "2018-07-18T07:34:38Z", - "lastUpdateTimeTS": 1531899278000, - "message": "Deployment has minimum availability.", - "reason": "MinimumReplicasAvailable", - "status": "True", - "type": "Available" - }, - { - "lastTransitionTime": "2018-07-18T07:34:16Z", - "lastTransitionTimeTS": 1531899256000, - "lastUpdateTime": "2018-07-18T07:34:38Z", - "lastUpdateTimeTS": 1531899278000, - "message": "ReplicaSet \"nginx-64d85666f9\" has successfully progressed.", - "reason": "NewReplicaSetAvailable", - "status": "True", - "type": "Progressing" - } - ], - "observedGeneration": 2, - "readyReplicas": 1, - "replicas": 1, - "type": "/v3/project/schemas/deploymentStatus", - "unavailableReplicas": 0, - "updatedReplicas": 1 - }, - "dnsPolicy": "ClusterFirst", - "hostIPC": false, - "hostNetwork": false, - "hostPID": false, - "id": "deployment:default:nginx", - "labels": { - "workload.user.cattle.io/workloadselector": "deployment-default-nginx" - }, - "links": { - "remove": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx", - "revisions": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx/revisions", - "self": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx", - "update": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx", - "yaml": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx/yaml" - }, - "name": "nginx", - "namespaceId": "default", - "paused": false, - "projectId": "c-bcz5t:p-fdr4s", - "publicEndpoints": [ - { - "addresses": ["10.64.3.58"], - "allNodes": true, - "ingressId": null, - "nodeId": null, - "podId": null, - "port": 30917, - "protocol": "TCP", - "serviceId": "default:nginx-nodeport" - } - ], - "restartPolicy": "Always", - "scale": 1, - "schedulerName": "default-scheduler", - "selector": { - "matchLabels": { - "workload.user.cattle.io/workloadselector": "deployment-default-nginx" - }, - "type": "/v3/project/schemas/labelSelector" - }, - "state": "active", - "terminationGracePeriodSeconds": 30, - "transitioning": "no", - "transitioningMessage": "", - "type": "deployment", - "uuid": "f998037d-8a5c-11e8-a4cf-0245a7ebb0fd", - "workloadAnnotations": { - "deployment.kubernetes.io/revision": "1", - "field.cattle.io/creatorId": "user-f4tt2" - }, - "workloadLabels": { - "workload.user.cattle.io/workloadselector": "deployment-default-nginx" + "responseHeader": { + "Cache-Control": [ + "no-cache, no-store, must-revalidate" + ], + "Content-Encoding": [ + "gzip" + ], + "Content-Type": [ + "application/json" + ], + "Expires": [ + "Wed 24 Feb 1982 18:42:00 GMT" + ], + "X-Api-Cattle-Auth": [ + "true" + ], + "X-Api-Schemas": [ + "https://localhost:8443/v1/schemas" + ], + "X-Content-Type-Options": [ + "nosniff" + ] } - } } ``` + +### Metadata, headers and Request Body Level + +If you set your `AUDIT_LEVEL` to `2`, Rancher logs the metadata, the request and response headers and the request body for every API request. + +The code sample below depicts an API request, with both its metadata, headers and request body. + +```json +{ + "auditID": "d1088a09-2a13-4450-970e-0d44bd2c49ee", + "requestURI": "/v3/projects", + "user": { + "name": "user-6j5s6", + "group": [ + "system:authenticated", + "system:cattle:authenticated" + ], + "extra": { + "principalid": [ + "local://user-6j5s6" + ], + "requesthost": [ + "localhost:8443" + ], + "requesttokenid": [ + "token-zs42h" + ], + "username": [ + "admin" + ] + } + }, + "method": "POST", + "remoteAddr": "127.0.0.1:49966", + "responseCode": 201, + "requestTimestamp": "2025-06-30T12:32:13-04:00", + "responseTimestamp": "2025-06-30T12:32:13-04:00", + "requestHeader": { + "Accept": [ + "application/json" + ], + "Accept-Encoding": [ + "gzip, deflate, br, zstd" + ], + "Accept-Language": [ + "en-US,en;q=0.5" + ], + "Connection": [ + "keep-alive" + ], + "Content-Length": [ + "214" + ], + "Content-Type": [ + "application/json" + ], + "Cookie": [ + "[redacted]" + ], + "Impersonate-Extra-Principalid": [ + "local://user-6j5s6" + ], + "Impersonate-Extra-Requesthost": [ + "localhost:8443" + ], + "Impersonate-Extra-Requesttokenid": [ + "token-zs42h" + ], + "Impersonate-Extra-Username": [ + "admin" + ], + "Impersonate-Group": [ + "system:authenticated", + "system:cattle:authenticated" + ], + "Impersonate-User": [ + "user-6j5s6" + ], + "Origin": [ + "https://localhost:8443" + ], + "Priority": [ + "u=0" + ], + "Referer": [ + "https://localhost:8443/dashboard/c/local/explorer/management.cattle.io.project/create" + ], + "Sec-Fetch-Dest": [ + "empty" + ], + "Sec-Fetch-Mode": [ + "cors" + ], + "Sec-Fetch-Site": [ + "same-origin" + ], + "User-Agent": [ + "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0" + ], + "X-Api-Csrf": [ + "fccc690cab7b0c169b3fc6527edadef3" + ] + }, + "responseHeader": { + "Cache-Control": [ + "no-cache, no-store, must-revalidate" + ], + "Content-Encoding": [ + "gzip" + ], + "Content-Type": [ + "application/json" + ], + "Expires": [ + "Wed 24 Feb 1982 18:42:00 GMT" + ], + "X-Api-Cattle-Auth": [ + "true" + ], + "X-Api-Schemas": [ + "https://localhost:8443/v3/project/schemas" + ], + "X-Content-Type-Options": [ + "nosniff" + ] + }, + "requestBody": { + "annotations": {}, + "clusterId": "local", + "containerDefaultResourceLimit": {}, + "creatorId": "local://user-6j5s6", + "labels": {}, + "name": "example-project", + "namespaceDefaultResourceQuota": {}, + "resourceQuota": {}, + "type": "project" + } +} +``` + +### Metadata, Headers, Request Body and Response Body Level + +If you set your `AUDIT_LEVEL` to `3`, Rancher logs the metadata, request and response headers and request body and response. + +The code sample below depicts an example of an API request with that information logged. + +```json +{ + "auditID": "a9549a5b-4351-4bd5-adcd-12f7ec667a6b", + "requestURI": "/v3/projects", + "user": { + "name": "user-6j5s6", + "group": [ + "system:authenticated", + "system:cattle:authenticated" + ], + "extra": { + "principalid": [ + "local://user-6j5s6" + ], + "requesthost": [ + "localhost:8443" + ], + "requesttokenid": [ + "token-zs42h" + ], + "username": [ + "admin" + ] + } + }, + "method": "POST", + "remoteAddr": "127.0.0.1:50454", + "responseCode": 201, + "requestTimestamp": "2025-06-30T12:42:24-04:00", + "responseTimestamp": "2025-06-30T12:42:24-04:00", + "requestHeader": { + "Accept": [ + "application/json" + ], + "Accept-Encoding": [ + "gzip, deflate, br, zstd" + ], + "Accept-Language": [ + "en-US,en;q=0.5" + ], + "Connection": [ + "keep-alive" + ], + "Content-Length": [ + "214" + ], + "Content-Type": [ + "application/json" + ], + "Cookie": [ + "[redacted]" + ], + "Impersonate-Extra-Principalid": [ + "local://user-6j5s6" + ], + "Impersonate-Extra-Requesthost": [ + "localhost:8443" + ], + "Impersonate-Extra-Requesttokenid": [ + "token-zs42h" + ], + "Impersonate-Extra-Username": [ + "admin" + ], + "Impersonate-Group": [ + "system:authenticated", + "system:cattle:authenticated" + ], + "Impersonate-User": [ + "user-6j5s6" + ], + "Origin": [ + "https://localhost:8443" + ], + "Priority": [ + "u=0" + ], + "Referer": [ + "https://localhost:8443/dashboard/c/local/explorer/management.cattle.io.project/create" + ], + "Sec-Fetch-Dest": [ + "empty" + ], + "Sec-Fetch-Mode": [ + "cors" + ], + "Sec-Fetch-Site": [ + "same-origin" + ], + "User-Agent": [ + "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0" + ], + "X-Api-Csrf": [ + "fccc690cab7b0c169b3fc6527edadef3" + ] + }, + "responseHeader": { + "Cache-Control": [ + "no-cache, no-store, must-revalidate" + ], + "Content-Encoding": [ + "gzip" + ], + "Content-Type": [ + "application/json" + ], + "Expires": [ + "Wed 24 Feb 1982 18:42:00 GMT" + ], + "X-Api-Cattle-Auth": [ + "true" + ], + "X-Api-Schemas": [ + "https://localhost:8443/v3/project/schemas" + ], + "X-Content-Type-Options": [ + "nosniff" + ] + }, + "requestBody": { + "annotations": {}, + "clusterId": "local", + "containerDefaultResourceLimit": {}, + "creatorId": "local://user-6j5s6", + "labels": {}, + "name": "example-project", + "namespaceDefaultResourceQuota": {}, + "resourceQuota": {}, + "type": "project" + }, + "responseBody": { + "actions": { + "exportYaml": "https://localhost:8443/v3/projects/local:p-qt6tq?action=exportYaml" + }, + "annotations": { + "authz.management.cattle.io/creator-role-bindings": "{\"required\":[\"project-owner\"]}" + }, + "backingNamespace": "local-p-qt6tq", + "baseType": "project", + "clusterId": "local", + "containerDefaultResourceLimit": { + "type": "/v3/schemas/containerResourceLimit" + }, + "created": "2025-06-30T16:42:24Z", + "createdTS": 1751301744000, + "creatorId": "user-6j5s6", + "id": "local:p-qt6tq", + "labels": { + "cattle.io/creator": "norman" + }, + "links": { + "basicAuths": "https://localhost:8443/v3/projects/local:p-qt6tq/basicauths", + "certificates": "https://localhost:8443/v3/projects/local:p-qt6tq/certificates", + "configMaps": "https://localhost:8443/v3/projects/local:p-qt6tq/configmaps", + "cronJobs": "https://localhost:8443/v3/projects/local:p-qt6tq/cronjobs", + "daemonSets": "https://localhost:8443/v3/projects/local:p-qt6tq/daemonsets", + "deployments": "https://localhost:8443/v3/projects/local:p-qt6tq/deployments", + "dnsRecords": "https://localhost:8443/v3/projects/local:p-qt6tq/dnsrecords", + "dockerCredentials": "https://localhost:8443/v3/projects/local:p-qt6tq/dockercredentials", + "horizontalPodAutoscalers": "https://localhost:8443/v3/projects/local:p-qt6tq/horizontalpodautoscalers", + "ingresses": "https://localhost:8443/v3/projects/local:p-qt6tq/ingresses", + "jobs": "https://localhost:8443/v3/projects/local:p-qt6tq/jobs", + "namespacedBasicAuths": "https://localhost:8443/v3/projects/local:p-qt6tq/namespacedbasicauths", + "namespacedCertificates": "https://localhost:8443/v3/projects/local:p-qt6tq/namespacedcertificates", + "namespacedDockerCredentials": "https://localhost:8443/v3/projects/local:p-qt6tq/namespaceddockercredentials", + "namespacedSecrets": "https://localhost:8443/v3/projects/local:p-qt6tq/namespacedsecrets", + "namespacedServiceAccountTokens": "[redacted]", + "namespacedSshAuths": "https://localhost:8443/v3/projects/local:p-qt6tq/namespacedsshauths", + "persistentVolumeClaims": "https://localhost:8443/v3/projects/local:p-qt6tq/persistentvolumeclaims", + "pods": "https://localhost:8443/v3/projects/local:p-qt6tq/pods", + "projectNetworkPolicies": "https://localhost:8443/v3/projects/local:p-qt6tq/projectnetworkpolicies", + "projectRoleTemplateBindings": "https://localhost:8443/v3/projects/local:p-qt6tq/projectroletemplatebindings", + "remove": "https://localhost:8443/v3/projects/local:p-qt6tq", + "replicaSets": "https://localhost:8443/v3/projects/local:p-qt6tq/replicasets", + "replicationControllers": "https://localhost:8443/v3/projects/local:p-qt6tq/replicationcontrollers", + "secrets": "https://localhost:8443/v3/projects/local:p-qt6tq/secrets", + "self": "https://localhost:8443/v3/projects/local:p-qt6tq", + "serviceAccountTokens": "[redacted]", + "services": "https://localhost:8443/v3/projects/local:p-qt6tq/services", + "sshAuths": "https://localhost:8443/v3/projects/local:p-qt6tq/sshauths", + "statefulSets": "https://localhost:8443/v3/projects/local:p-qt6tq/statefulsets", + "subscribe": "https://localhost:8443/v3/projects/local:p-qt6tq/subscribe", + "update": "https://localhost:8443/v3/projects/local:p-qt6tq", + "workloads": "https://localhost:8443/v3/projects/local:p-qt6tq/workloads" + }, + "name": "example-project", + "namespaceDefaultResourceQuota": { + "limit": { + "type": "/v3/schemas/resourceQuotaLimit" + }, + "type": "/v3/schemas/namespaceResourceQuota" + }, + "namespaceId": null, + "resourceQuota": { + "limit": { + "type": "/v3/schemas/resourceQuotaLimit" + }, + "type": "/v3/schemas/projectResourceQuota", + "usedLimit": { + "type": "/v3/schemas/resourceQuotaLimit" + } + }, + "state": "active", + "transitioning": "no", + "transitioningMessage": "", + "type": "project", + "uuid": "b582603b-7826-4302-8393-792df2611265" + } +} +``` \ No newline at end of file diff --git a/versioned_docs/version-2.12/reference-guides/single-node-rancher-in-docker/advanced-options.md b/versioned_docs/version-2.12/reference-guides/single-node-rancher-in-docker/advanced-options.md index c4dcde046d9..18cadd15b4c 100644 --- a/versioned_docs/version-2.12/reference-guides/single-node-rancher-in-docker/advanced-options.md +++ b/versioned_docs/version-2.12/reference-guides/single-node-rancher-in-docker/advanced-options.md @@ -44,6 +44,7 @@ Privileged access is [required.](../../getting-started/installation-and-upgrade/ docker run -d --restart=unless-stopped \ -p 80:80 -p 443:443 \ -v /var/log/rancher/auditlog:/var/log/auditlog \ + -e AUDIT_LOG_ENABLED=true \ -e AUDIT_LEVEL=1 \ --privileged \ rancher/rancher:latest diff --git a/versioned_docs/version-2.12/troubleshooting/other-troubleshooting-tips/user-id-tracking-in-audit-logs.md b/versioned_docs/version-2.12/troubleshooting/other-troubleshooting-tips/user-id-tracking-in-audit-logs.md index adecdecde12..24fba32d46b 100644 --- a/versioned_docs/version-2.12/troubleshooting/other-troubleshooting-tips/user-id-tracking-in-audit-logs.md +++ b/versioned_docs/version-2.12/troubleshooting/other-troubleshooting-tips/user-id-tracking-in-audit-logs.md @@ -23,4 +23,4 @@ A Rancher Admin should now be able to view Rancher audit logs and follow through ## Feature Description - When Kubernetes Audit logs are enabled on the downstream cluster, in each event that is logged, the external Identity Provider's username is now logged for each request, at the "metadata" level. -- When Rancher API Audit logs are enabled on the Rancher installation, the external Identity Provider's username is also logged now at the `auditLog.level=1` for each request that hits the Rancher API server, including the login requests. +- When you enable Rancher API Audit logs for a Rancher installation, the external Identity Provider's username is also logged now at the `auditLog.level=0` for each request that hits the Rancher API server, including login requests.