API Audit Logging

[roberthbailey]

API Audit Logging

• The Kubernetes apiserver can generate audit logs for all requests, and export to a pluggable backend.
• Primary contact (assignee): Tim Allclair @tallclair
• Responsible SIGs: sig-auth
• Design proposal link (community repo): https://github.com/kubernetes/community/blob/master/contributors/design-proposals/auditing.md
• Reviewer(s) - (for LGTM) recommend having 2+ reviewers (at least one from code-area OWNERS file) agreed to review. Reviewers from multiple companies preferred: @sttts @soltysh @x13n
• Approver (likely from SIG/area to which feature belongs): @sttts @tallclair
• Feature target (which target equals to which milestone):
  • Alpha release target (1.7)
  • Beta release target (1.8) - Advanced Auditing Beta Changes kubernetes#48561
  • Stable release target (1.12) - upgrade Audit api version to stable kubernetes#65891
• Docs: https://github.com/kubernetes/kubernetes.github.io/blob/master/docs/tasks/debug-application-cluster/audit.md

[amouat]

What's the current status of this? It's not clear to me who's working on what or what the next steps are. @soltysh came up with a working PR that has had a lot of feedback and discussion: kubernetes/kubernetes#27087

[sttts]

@amouat in the mentioned PR @soltysh introduces what we call "basic auditing", basically access.log-style logging only without any deeper api knowledge. To my knowledge mainly log-rotation is an open issue.

kubernetes/kubernetes#29443 is the continuation by me and @soltysh describing more "advanced auditing" where the basic audit output would just be a special case. This feature issue is about the latter and will link to that proposal PR once it's more complete.

[amouat]

Thanks!

I have to say this process is very confusing. The discussion has moved from issue #2203, to PR #27087 to this issue and then to #29443, with no clear indication on each where the current discussion is happening, or what the next steps are :(

Many thanks for you work on this though, I don't mean to sound ungrateful towards a great OS project. I just wanted to check that this issue was still moving forward.

[janetkuo]

@soltysh @sttts Are the docs ready? Please update the docs to https://github.com/kubernetes/kubernetes.github.io, and then add PR numbers and have the docs box checked in the issue description

[sttts]

@janetkuo this feature is postponed to 1.5, in 1.4 we only have kubernetes/kubernetes#27087 as a first step. Unfortunately, I lack the permissions to change the milestone.