mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-26 13:08:11 +00:00
636 lines
31 KiB
JavaScript
636 lines
31 KiB
JavaScript
"use strict";
|
||
(self["webpackChunkrancher_docs"] = self["webpackChunkrancher_docs"] || []).push([[75713],{
|
||
|
||
/***/ 3905:
|
||
/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
|
||
|
||
/* harmony export */ __webpack_require__.d(__webpack_exports__, {
|
||
/* harmony export */ Zo: () => (/* binding */ MDXProvider),
|
||
/* harmony export */ kt: () => (/* binding */ createElement)
|
||
/* harmony export */ });
|
||
/* unused harmony exports MDXContext, useMDXComponents, withMDXComponents */
|
||
/* harmony import */ var react__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(67294);
|
||
|
||
|
||
function _defineProperty(obj, key, value) {
|
||
if (key in obj) {
|
||
Object.defineProperty(obj, key, {
|
||
value: value,
|
||
enumerable: true,
|
||
configurable: true,
|
||
writable: true
|
||
});
|
||
} else {
|
||
obj[key] = value;
|
||
}
|
||
|
||
return obj;
|
||
}
|
||
|
||
function _extends() {
|
||
_extends = Object.assign || function (target) {
|
||
for (var i = 1; i < arguments.length; i++) {
|
||
var source = arguments[i];
|
||
|
||
for (var key in source) {
|
||
if (Object.prototype.hasOwnProperty.call(source, key)) {
|
||
target[key] = source[key];
|
||
}
|
||
}
|
||
}
|
||
|
||
return target;
|
||
};
|
||
|
||
return _extends.apply(this, arguments);
|
||
}
|
||
|
||
function ownKeys(object, enumerableOnly) {
|
||
var keys = Object.keys(object);
|
||
|
||
if (Object.getOwnPropertySymbols) {
|
||
var symbols = Object.getOwnPropertySymbols(object);
|
||
if (enumerableOnly) symbols = symbols.filter(function (sym) {
|
||
return Object.getOwnPropertyDescriptor(object, sym).enumerable;
|
||
});
|
||
keys.push.apply(keys, symbols);
|
||
}
|
||
|
||
return keys;
|
||
}
|
||
|
||
function _objectSpread2(target) {
|
||
for (var i = 1; i < arguments.length; i++) {
|
||
var source = arguments[i] != null ? arguments[i] : {};
|
||
|
||
if (i % 2) {
|
||
ownKeys(Object(source), true).forEach(function (key) {
|
||
_defineProperty(target, key, source[key]);
|
||
});
|
||
} else if (Object.getOwnPropertyDescriptors) {
|
||
Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
|
||
} else {
|
||
ownKeys(Object(source)).forEach(function (key) {
|
||
Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
|
||
});
|
||
}
|
||
}
|
||
|
||
return target;
|
||
}
|
||
|
||
function _objectWithoutPropertiesLoose(source, excluded) {
|
||
if (source == null) return {};
|
||
var target = {};
|
||
var sourceKeys = Object.keys(source);
|
||
var key, i;
|
||
|
||
for (i = 0; i < sourceKeys.length; i++) {
|
||
key = sourceKeys[i];
|
||
if (excluded.indexOf(key) >= 0) continue;
|
||
target[key] = source[key];
|
||
}
|
||
|
||
return target;
|
||
}
|
||
|
||
function _objectWithoutProperties(source, excluded) {
|
||
if (source == null) return {};
|
||
|
||
var target = _objectWithoutPropertiesLoose(source, excluded);
|
||
|
||
var key, i;
|
||
|
||
if (Object.getOwnPropertySymbols) {
|
||
var sourceSymbolKeys = Object.getOwnPropertySymbols(source);
|
||
|
||
for (i = 0; i < sourceSymbolKeys.length; i++) {
|
||
key = sourceSymbolKeys[i];
|
||
if (excluded.indexOf(key) >= 0) continue;
|
||
if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
|
||
target[key] = source[key];
|
||
}
|
||
}
|
||
|
||
return target;
|
||
}
|
||
|
||
var isFunction = function isFunction(obj) {
|
||
return typeof obj === 'function';
|
||
};
|
||
|
||
var MDXContext = /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.createContext({});
|
||
var withMDXComponents = function withMDXComponents(Component) {
|
||
return function (props) {
|
||
var allComponents = useMDXComponents(props.components);
|
||
return /*#__PURE__*/React.createElement(Component, _extends({}, props, {
|
||
components: allComponents
|
||
}));
|
||
};
|
||
};
|
||
var useMDXComponents = function useMDXComponents(components) {
|
||
var contextComponents = react__WEBPACK_IMPORTED_MODULE_0__.useContext(MDXContext);
|
||
var allComponents = contextComponents;
|
||
|
||
if (components) {
|
||
allComponents = isFunction(components) ? components(contextComponents) : _objectSpread2(_objectSpread2({}, contextComponents), components);
|
||
}
|
||
|
||
return allComponents;
|
||
};
|
||
var MDXProvider = function MDXProvider(props) {
|
||
var allComponents = useMDXComponents(props.components);
|
||
return /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.createElement(MDXContext.Provider, {
|
||
value: allComponents
|
||
}, props.children);
|
||
};
|
||
|
||
var TYPE_PROP_NAME = 'mdxType';
|
||
var DEFAULTS = {
|
||
inlineCode: 'code',
|
||
wrapper: function wrapper(_ref) {
|
||
var children = _ref.children;
|
||
return /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.createElement(react__WEBPACK_IMPORTED_MODULE_0__.Fragment, {}, children);
|
||
}
|
||
};
|
||
var MDXCreateElement = /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.forwardRef(function (props, ref) {
|
||
var propComponents = props.components,
|
||
mdxType = props.mdxType,
|
||
originalType = props.originalType,
|
||
parentName = props.parentName,
|
||
etc = _objectWithoutProperties(props, ["components", "mdxType", "originalType", "parentName"]);
|
||
|
||
var components = useMDXComponents(propComponents);
|
||
var type = mdxType;
|
||
var Component = components["".concat(parentName, ".").concat(type)] || components[type] || DEFAULTS[type] || originalType;
|
||
|
||
if (propComponents) {
|
||
return /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.createElement(Component, _objectSpread2(_objectSpread2({
|
||
ref: ref
|
||
}, etc), {}, {
|
||
components: propComponents
|
||
}));
|
||
}
|
||
|
||
return /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.createElement(Component, _objectSpread2({
|
||
ref: ref
|
||
}, etc));
|
||
});
|
||
MDXCreateElement.displayName = 'MDXCreateElement';
|
||
function createElement (type, props) {
|
||
var args = arguments;
|
||
var mdxType = props && props.mdxType;
|
||
|
||
if (typeof type === 'string' || mdxType) {
|
||
var argsLength = args.length;
|
||
var createElementArgArray = new Array(argsLength);
|
||
createElementArgArray[0] = MDXCreateElement;
|
||
var newProps = {};
|
||
|
||
for (var key in props) {
|
||
if (hasOwnProperty.call(props, key)) {
|
||
newProps[key] = props[key];
|
||
}
|
||
}
|
||
|
||
newProps.originalType = type;
|
||
newProps[TYPE_PROP_NAME] = typeof type === 'string' ? type : mdxType;
|
||
createElementArgArray[1] = newProps;
|
||
|
||
for (var i = 2; i < argsLength; i++) {
|
||
createElementArgArray[i] = args[i];
|
||
}
|
||
|
||
return react__WEBPACK_IMPORTED_MODULE_0__.createElement.apply(null, createElementArgArray);
|
||
}
|
||
|
||
return react__WEBPACK_IMPORTED_MODULE_0__.createElement.apply(null, args);
|
||
}
|
||
|
||
|
||
|
||
|
||
/***/ }),
|
||
|
||
/***/ 91827:
|
||
/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
|
||
|
||
__webpack_require__.r(__webpack_exports__);
|
||
/* harmony export */ __webpack_require__.d(__webpack_exports__, {
|
||
/* harmony export */ assets: () => (/* binding */ assets),
|
||
/* harmony export */ contentTitle: () => (/* binding */ contentTitle),
|
||
/* harmony export */ "default": () => (/* binding */ MDXContent),
|
||
/* harmony export */ frontMatter: () => (/* binding */ frontMatter),
|
||
/* harmony export */ metadata: () => (/* binding */ metadata),
|
||
/* harmony export */ toc: () => (/* binding */ toc)
|
||
/* harmony export */ });
|
||
/* harmony import */ var react__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(67294);
|
||
/* harmony import */ var _mdx_js_react__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3905);
|
||
/* @jsxRuntime classic */ /* @jsx mdx */ /* @jsxFrag React.Fragment */ function _define_property(obj, key, value) {
|
||
if (key in obj) {
|
||
Object.defineProperty(obj, key, {
|
||
value: value,
|
||
enumerable: true,
|
||
configurable: true,
|
||
writable: true
|
||
});
|
||
} else {
|
||
obj[key] = value;
|
||
}
|
||
return obj;
|
||
}
|
||
function _object_spread(target) {
|
||
for(var i = 1; i < arguments.length; i++){
|
||
var source = arguments[i] != null ? arguments[i] : {};
|
||
var ownKeys = Object.keys(source);
|
||
if (typeof Object.getOwnPropertySymbols === "function") {
|
||
ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
|
||
return Object.getOwnPropertyDescriptor(source, sym).enumerable;
|
||
}));
|
||
}
|
||
ownKeys.forEach(function(key) {
|
||
_define_property(target, key, source[key]);
|
||
});
|
||
}
|
||
return target;
|
||
}
|
||
function ownKeys(object, enumerableOnly) {
|
||
var keys = Object.keys(object);
|
||
if (Object.getOwnPropertySymbols) {
|
||
var symbols = Object.getOwnPropertySymbols(object);
|
||
if (enumerableOnly) {
|
||
symbols = symbols.filter(function(sym) {
|
||
return Object.getOwnPropertyDescriptor(object, sym).enumerable;
|
||
});
|
||
}
|
||
keys.push.apply(keys, symbols);
|
||
}
|
||
return keys;
|
||
}
|
||
function _object_spread_props(target, source) {
|
||
source = source != null ? source : {};
|
||
if (Object.getOwnPropertyDescriptors) {
|
||
Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
|
||
} else {
|
||
ownKeys(Object(source)).forEach(function(key) {
|
||
Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
|
||
});
|
||
}
|
||
return target;
|
||
}
|
||
function _object_without_properties(source, excluded) {
|
||
if (source == null) return {};
|
||
var target = _object_without_properties_loose(source, excluded);
|
||
var key, i;
|
||
if (Object.getOwnPropertySymbols) {
|
||
var sourceSymbolKeys = Object.getOwnPropertySymbols(source);
|
||
for(i = 0; i < sourceSymbolKeys.length; i++){
|
||
key = sourceSymbolKeys[i];
|
||
if (excluded.indexOf(key) >= 0) continue;
|
||
if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
|
||
target[key] = source[key];
|
||
}
|
||
}
|
||
return target;
|
||
}
|
||
function _object_without_properties_loose(source, excluded) {
|
||
if (source == null) return {};
|
||
var target = {};
|
||
var sourceKeys = Object.keys(source);
|
||
var key, i;
|
||
for(i = 0; i < sourceKeys.length; i++){
|
||
key = sourceKeys[i];
|
||
if (excluded.indexOf(key) >= 0) continue;
|
||
target[key] = source[key];
|
||
}
|
||
return target;
|
||
}
|
||
|
||
|
||
const frontMatter = {
|
||
title: 'Enabling the API Audit Log in Downstream Clusters'
|
||
};
|
||
const contentTitle = undefined;
|
||
const metadata = {
|
||
"unversionedId": "how-to-guides/advanced-user-guides/enable-api-audit-log-in-downstream-clusters",
|
||
"id": "how-to-guides/advanced-user-guides/enable-api-audit-log-in-downstream-clusters",
|
||
"title": "Enabling the API Audit Log in Downstream Clusters",
|
||
"description": "Kubernetes auditing provides a security-relevant chronological set of records about a cluster. Kube-apiserver performs auditing. Requests generate an event at each stage of its execution, which is then preprocessed according to a certain policy and written to a backend. The policy determines what’s recorded and the backend persists the records.",
|
||
"source": "@site/docs/how-to-guides/advanced-user-guides/enable-api-audit-log-in-downstream-clusters.md",
|
||
"sourceDirName": "how-to-guides/advanced-user-guides",
|
||
"slug": "/how-to-guides/advanced-user-guides/enable-api-audit-log-in-downstream-clusters",
|
||
"permalink": "/how-to-guides/advanced-user-guides/enable-api-audit-log-in-downstream-clusters",
|
||
"draft": false,
|
||
"editUrl": "https://github.com/rancher/rancher-docs/edit/main/docs/how-to-guides/advanced-user-guides/enable-api-audit-log-in-downstream-clusters.md",
|
||
"tags": [],
|
||
"version": "current",
|
||
"lastUpdatedAt": 1716227001,
|
||
"formattedLastUpdatedAt": "May 20, 2024",
|
||
"frontMatter": {
|
||
"title": "Enabling the API Audit Log in Downstream Clusters"
|
||
},
|
||
"sidebar": "tutorialSidebar",
|
||
"previous": {
|
||
"title": "Enabling the API Audit Log to Record System Events",
|
||
"permalink": "/how-to-guides/advanced-user-guides/enable-api-audit-log"
|
||
},
|
||
"next": {
|
||
"title": "Docker Install with TLS Termination at Layer-7 NGINX Load Balancer",
|
||
"permalink": "/how-to-guides/advanced-user-guides/configure-layer-7-nginx-load-balancer"
|
||
}
|
||
};
|
||
const assets = {};
|
||
const toc = [
|
||
{
|
||
value: 'Method 1 (Recommended): Set <code>audit-policy-file</code> in <code>machineGlobalConfig</code>',
|
||
id: 'method-1-recommended-set-audit-policy-file-in-machineglobalconfig',
|
||
level: 3
|
||
},
|
||
{
|
||
value: 'Method 2: Use the Directives, <code>machineSelectorFiles</code> and <code>machineGlobalConfig</code>',
|
||
id: 'method-2-use-the-directives-machineselectorfiles-and-machineglobalconfig',
|
||
level: 3
|
||
}
|
||
];
|
||
const makeShortcode = (name)=>function MDXDefaultShortcode(props) {
|
||
console.warn("Component " + name + " was not imported, exported, or provided by MDXProvider as global scope");
|
||
return /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("div", props);
|
||
};
|
||
const Tabs = makeShortcode("Tabs");
|
||
const TabItem = makeShortcode("TabItem");
|
||
const layoutProps = {
|
||
toc
|
||
};
|
||
const MDXLayout = "wrapper";
|
||
function MDXContent(_param) {
|
||
var { components } = _param, props = _object_without_properties(_param, [
|
||
"components"
|
||
]);
|
||
return /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)(MDXLayout, _object_spread_props(_object_spread({}, layoutProps, props), {
|
||
components: components,
|
||
mdxType: "MDXLayout"
|
||
}), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("head", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("link", {
|
||
rel: "canonical",
|
||
href: "https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log-in-downstream-clusters"
|
||
})), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Kubernetes auditing provides a security-relevant chronological set of records about a cluster. Kube-apiserver performs auditing. Requests generate an event at each stage of its execution, which is then preprocessed according to a certain policy and written to a backend. The policy determines what’s recorded and the backend persists the records.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `You might want to configure the audit log as part of compliance with the Center for Internet Security (CIS) Kubernetes Benchmark controls.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `For configuration details, refer to the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
||
parentName: "p",
|
||
"href": "https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/"
|
||
}, `official Kubernetes documentation`), `.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)(Tabs, {
|
||
groupId: "k8s-distro",
|
||
mdxType: "Tabs"
|
||
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)(TabItem, {
|
||
value: "RKE2",
|
||
default: true,
|
||
mdxType: "TabItem"
|
||
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
|
||
"id": "method-1-recommended-set-audit-policy-file-in-machineglobalconfig"
|
||
}, `Method 1 (Recommended): Set `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||
parentName: "h3"
|
||
}, `audit-policy-file`), ` in `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||
parentName: "h3"
|
||
}, `machineGlobalConfig`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `You can set `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||
parentName: "p"
|
||
}, `audit-policy-file`), ` in the configuration file. Rancher delivers the file to the path `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||
parentName: "p"
|
||
}, `/var/lib/rancher/rke2/etc/config-files/audit-policy-file`), ` in control plane nodes, and sets the proper options in the RKE2 server.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Example:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("pre", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("code", {
|
||
parentName: "pre",
|
||
"className": "language-yaml"
|
||
}, `apiVersion: provisioning.cattle.io/v1
|
||
kind: Cluster
|
||
spec:
|
||
rkeConfig:
|
||
machineGlobalConfig:
|
||
audit-policy-file: |
|
||
apiVersion: audit.k8s.io/v1
|
||
kind: Policy
|
||
rules:
|
||
- level: RequestResponse
|
||
resources:
|
||
- group: ""
|
||
resources:
|
||
- pods
|
||
`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
|
||
"id": "method-2-use-the-directives-machineselectorfiles-and-machineglobalconfig"
|
||
}, `Method 2: Use the Directives, `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||
parentName: "h3"
|
||
}, `machineSelectorFiles`), ` and `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||
parentName: "h3"
|
||
}, `machineGlobalConfig`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("admonition", {
|
||
"type": "note"
|
||
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", {
|
||
parentName: "admonition"
|
||
}, `This feature is available in Rancher v2.7.2 and later.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `You can use `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||
parentName: "p"
|
||
}, `machineSelectorFiles`), ` to deliver the audit policy file to the control plane nodes, and `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||
parentName: "p"
|
||
}, `machineGlobalConfig`), ` to set the options on kube-apiserver.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `As a prerequisite, you must create a `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
||
parentName: "p",
|
||
"href": "/how-to-guides/new-user-guides/kubernetes-resources-setup/secrets"
|
||
}, `secret`), ` or `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
||
parentName: "p",
|
||
"href": "/how-to-guides/new-user-guides/kubernetes-resources-setup/configmaps"
|
||
}, `configmap`), ` to be the source of the audit policy.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `The secret or configmap must meet the following requirements:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("ol", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
|
||
parentName: "ol"
|
||
}, `It must be in the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||
parentName: "li"
|
||
}, `fleet-default`), ` namespace where the Cluster object exists.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
|
||
parentName: "ol"
|
||
}, `It must have the annotation `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||
parentName: "li"
|
||
}, `rke.cattle.io/object-authorized-for-clusters: <cluster-name1>,<cluster-name2>`), ` which permits the target clusters to use it.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("admonition", {
|
||
"type": "tip"
|
||
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", {
|
||
parentName: "admonition"
|
||
}, `Rancher Dashboard provides an easy-to-use form for creating the secret or configmap.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Example:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("pre", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("code", {
|
||
parentName: "pre",
|
||
"className": "language-yaml"
|
||
}, `apiVersion: v1
|
||
data:
|
||
audit-policy: >-
|
||
IyBMb2cgYWxsIHJlcXVlc3RzIGF0IHRoZSBNZXRhZGF0YSBsZXZlbC4KYXBpVmVyc2lvbjogYXVkaXQuazhzLmlvL3YxCmtpbmQ6IFBvbGljeQpydWxlczoKLSBsZXZlbDogTWV0YWRhdGE=
|
||
kind: Secret
|
||
metadata:
|
||
annotations:
|
||
rke.cattle.io/object-authorized-for-clusters: cluster1
|
||
name: <name1>
|
||
namespace: fleet-default
|
||
`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Enable and configure the audit log by editing the cluster in YAML, and utilizing the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||
parentName: "p"
|
||
}, `machineSelectorFiles`), ` and `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||
parentName: "p"
|
||
}, `machineGlobalConfig`), ` directives.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Example:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("pre", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("code", {
|
||
parentName: "pre",
|
||
"className": "language-yaml"
|
||
}, `apiVersion: provisioning.cattle.io/v1
|
||
kind: Cluster
|
||
spec:
|
||
rkeConfig:
|
||
machineGlobalConfig:
|
||
kube-apiserver-arg:
|
||
- audit-policy-file=<customized-path>/dev-audit-policy.yaml
|
||
- audit-log-path=<customized-path>/dev-audit.logs
|
||
machineSelectorFiles:
|
||
- fileSources:
|
||
- configMap:
|
||
name: ''
|
||
secret:
|
||
items:
|
||
- key: audit-policy
|
||
path: <customized-path>/dev-audit-policy.yaml
|
||
name: dev-audit-policy
|
||
machineLabelSelector:
|
||
matchLabels:
|
||
rke.cattle.io/control-plane-role: 'true'
|
||
`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("admonition", {
|
||
"type": "tip"
|
||
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", {
|
||
parentName: "admonition"
|
||
}, `You can also use the directive `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||
parentName: "p"
|
||
}, `machineSelectorConfig`), ` with proper machineLabelSelectors to achieve the same effect.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `For more information about cluster configuration, refer to the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
||
parentName: "p",
|
||
"href": "/reference-guides/cluster-configuration/rancher-server-configuration/rke2-cluster-configuration"
|
||
}, `RKE2 cluster configuration reference`), ` pages.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)(TabItem, {
|
||
value: "K3s",
|
||
mdxType: "TabItem"
|
||
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("admonition", {
|
||
"type": "note"
|
||
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", {
|
||
parentName: "admonition"
|
||
}, `This feature is available in Rancher v2.7.2 and later.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `You can use `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||
parentName: "p"
|
||
}, `machineSelectorFiles`), ` to deliver the audit policy file to the control plane nodes, and `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||
parentName: "p"
|
||
}, `machineGlobalConfig`), ` to set the options on kube-apiserver.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `As a prerequisite, you must create a `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
||
parentName: "p",
|
||
"href": "/how-to-guides/new-user-guides/kubernetes-resources-setup/secrets"
|
||
}, `secret`), ` or `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
||
parentName: "p",
|
||
"href": "/how-to-guides/new-user-guides/kubernetes-resources-setup/configmaps"
|
||
}, `configmap`), ` to be the source of the audit policy.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `The secret or configmap must meet the following requirements:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("ol", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
|
||
parentName: "ol"
|
||
}, `It must be in the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||
parentName: "li"
|
||
}, `fleet-default`), ` namespace where the Cluster object exists.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
|
||
parentName: "ol"
|
||
}, `It must have the annotation `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||
parentName: "li"
|
||
}, `rke.cattle.io/object-authorized-for-clusters: <cluster-name1>,<cluster-name2>`), ` which permits the target clusters to use it.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("admonition", {
|
||
"type": "tip"
|
||
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", {
|
||
parentName: "admonition"
|
||
}, `Rancher Dashboard provides an easy-to-use form for creating the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
||
parentName: "p",
|
||
"href": "/how-to-guides/new-user-guides/kubernetes-resources-setup/secrets"
|
||
}, `secret`), ` or `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
||
parentName: "p",
|
||
"href": "/how-to-guides/new-user-guides/kubernetes-resources-setup/configmaps"
|
||
}, `configmap`), `.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Example:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("pre", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("code", {
|
||
parentName: "pre",
|
||
"className": "language-yaml"
|
||
}, `apiVersion: v1
|
||
data:
|
||
audit-policy: >-
|
||
IyBMb2cgYWxsIHJlcXVlc3RzIGF0IHRoZSBNZXRhZGF0YSBsZXZlbC4KYXBpVmVyc2lvbjogYXVkaXQuazhzLmlvL3YxCmtpbmQ6IFBvbGljeQpydWxlczoKLSBsZXZlbDogTWV0YWRhdGE=
|
||
kind: Secret
|
||
metadata:
|
||
annotations:
|
||
rke.cattle.io/object-authorized-for-clusters: cluster1
|
||
name: <name1>
|
||
namespace: fleet-default
|
||
`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Enable and configure the audit log by editing the cluster in YAML, and utilizing the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||
parentName: "p"
|
||
}, `machineSelectorFiles`), ` and `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||
parentName: "p"
|
||
}, `machineGlobalConfig`), ` directives.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Example:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("pre", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("code", {
|
||
parentName: "pre",
|
||
"className": "language-yaml"
|
||
}, `apiVersion: provisioning.cattle.io/v1
|
||
kind: Cluster
|
||
spec:
|
||
rkeConfig:
|
||
machineGlobalConfig:
|
||
kube-apiserver-arg:
|
||
- audit-policy-file=<customized-path>/dev-audit-policy.yaml
|
||
- audit-log-path=<customized-path>/dev-audit.logs
|
||
machineSelectorFiles:
|
||
- fileSources:
|
||
- configMap:
|
||
name: ''
|
||
secret:
|
||
items:
|
||
- key: audit-policy
|
||
path: <customized-path>/dev-audit-policy.yaml
|
||
name: dev-audit-policy
|
||
machineLabelSelector:
|
||
matchLabels:
|
||
rke.cattle.io/control-plane-role: 'true'
|
||
`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("admonition", {
|
||
"type": "tip"
|
||
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", {
|
||
parentName: "admonition"
|
||
}, `You can also use the directive `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||
parentName: "p"
|
||
}, `machineSelectorConfig`), ` with proper machineLabelSelectors to achieve the same effect.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `For more information about cluster configuration, refer to the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
||
parentName: "p",
|
||
"href": "/reference-guides/cluster-configuration/rancher-server-configuration/k3s-cluster-configuration"
|
||
}, `K3s cluster configuration reference`), ` pages.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)(TabItem, {
|
||
value: "RKE1",
|
||
mdxType: "TabItem"
|
||
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `The audit log can be enabled and configured by editing the cluster with YAML.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `When the audit log is enabled, RKE1 default values will be applied.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("pre", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("code", {
|
||
parentName: "pre",
|
||
"className": "language-yaml"
|
||
}, `#
|
||
# Rancher Config
|
||
#
|
||
rancher_kubernetes_engine_config:
|
||
services:
|
||
kube-api:
|
||
audit_log:
|
||
enabled: true
|
||
`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `You can customize the audit log by using the configuration directive.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("pre", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("code", {
|
||
parentName: "pre",
|
||
"className": "language-yaml"
|
||
}, `#
|
||
# Rancher Config
|
||
#
|
||
rancher_kubernetes_engine_config:
|
||
services:
|
||
kube-api:
|
||
audit_log:
|
||
enabled: true
|
||
configuration:
|
||
max_age: 6
|
||
max_backup: 6
|
||
max_size: 110
|
||
path: /var/log/kube-audit/audit-log.json
|
||
format: json
|
||
policy:
|
||
apiVersion: audit.k8s.io/v1 # This is required.
|
||
kind: Policy
|
||
omitStages:
|
||
- "RequestReceived"
|
||
rules:
|
||
# Log pod changes at RequestResponse level
|
||
- level: RequestResponse
|
||
resources:
|
||
- group: ""
|
||
# Resource "pods" doesn't match requests to any subresource of pods,
|
||
# which is consistent with the RBAC policy.
|
||
resources: ["pods"]
|
||
# Log "pods/log", "pods/status" at Metadata level
|
||
- level: Metadata
|
||
resources:
|
||
- group: ""
|
||
resources: ["pods/log", "pods/status"]
|
||
`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `For configuration details, refer to the official `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
||
parentName: "p",
|
||
"href": "https://rke.docs.rancher.com/config-options/audit-log"
|
||
}, `RKE1 documentation`), `.`))));
|
||
}
|
||
MDXContent.isMDXComponent = true;
|
||
|
||
|
||
/***/ })
|
||
|
||
}]); |