金山云-文档中心-集群审计

参数	说明
None	不记录这个级别的日志。
Metadata	记录请求的元数据（如请求的用户、时间、资源、操作等），不记录请求和响应的消息体。
Request	记录元数据与请求消息体，不记录响应消息体。
RequestResponse	记录所有信息（元数据、请求和响应的消息体）。

审计阶段

审计阶段（Audit stage）用来定义请求被记录的阶段。相关参数如下：

参数	说明
RequestReceived	收到请求后马上记录。
ResponseStarted	在发送完响应消息的头部后记录，只有如watch这样的长时间运行的请求才会生成这个阶段。
ResponseComplete	在发送完全部响应体后记录。
Panic	在panic发生时记录。

参数配置说明

托管集群开启审计功能后，相关的参数配置及说明如下（其中参数不支持自定义，若有修改需要请提交工单）：

配置参数	说明
audit-log-maxage	审计日志最多保存日期为3天。
audit-log-maxbackup	审计日志最大分片存储3个日志文件。
audit-log-maxsize	单个审计日志最大内存为10M。

审计策略规则

KCE 审计策略遵循以下原则：

在 RequestReceived 阶段不会为任何请求生成审计日志。
在日志中用 RequestResponse 级别记录 Pod 变化。
“pods/log”、“pods/status” 请求以及所有其他名字空间中的 configmap 和 secret 变更。将以 Metadata 级别记录日志。
所有其他 core 和 extensions 组中的资源操作。如get、list 和 watch 会记录 Request 级别的日志。
对于/healthz，/version, /swagger* 匹配的网址发出的请求，只读url不会记录日志。
system:kube-proxy 发出的对端点或服务的监测请求不会记录日志。
对名为 “controller-leader” 的 configmap 的请求不会记录日志。
不会记录对某些非资源 URL 路径的已认证请求的日志。

以下为policy.yaml示例：

# policy.yaml
apiVersion: audit.k8s.io/v1 # This is required.
kind: Policy
# Don't generate audit events for all requests in RequestReceived stage.
omitStages:
  - "RequestReceived"
rules:
  # Log pod changes at RequestResponse level
  - level: RequestResponse
    resources:
      - group: ""
        # Resource "pods" doesn't match requests to any subresource of pods,
        # which is consistent with the RBAC policy.
        resources: ["pods"]
  # Log "pods/log", "pods/status" at Metadata level
  - level: Metadata
    resources:
      - group: ""
        resources: ["pods/log", "pods/status"]
        
  # Don't log requests to a configmap called "controller-leader"
  - level: None
    resources:
      - group: ""
        resources: ["configmaps"]
        resourceNames: ["controller-leader"]

  # Don't log watch requests by the "system:kube-proxy" on endpoints or services
  - level: None
    users: ["system:kube-proxy"]
    verbs: ["watch"]
    resources:
      - group: "" # core API group
        resources: ["endpoints", "services"]

  # Don't log authenticated requests to certain non-resource URL paths.
  - level: None
    userGroups: ["system:authenticated"]
    nonResourceURLs:
      - "/api*" # Wildcard matching.
      - "/version"

  # Log the request body of configmap changes in kube-system.
  - level: Request
    resources:
      - group: "" # core API group
        resources: ["configmaps"]
    # This rule only applies to resources in the "kube-system" namespace.
    # The empty string "" can be used to select non-namespaced resources.
    namespaces: ["kube-system"]

  # Log configmap and secret changes in all other namespaces at the Metadata level.
  - level: Metadata
    resources:
      - group: "" # core API group
        resources: ["secrets", "configmaps"]

  # Log all other resources in core and extensions at the Request level.
  - level: Request
    resources:
      - group: "" # core API group
      - group: "extensions" # Version of group should NOT be included.

  # A catch-all rule to log all other requests at the Metadata level.
  - level: Metadata
    # Long-running requests like watches that fall under this rule will not
    # generate an audit event in RequestReceived.
    omitStages:
      - "RequestReceived"

审计日志示例

开通审计功能后，可在 KLog >ClusterID >日志搜索中查看原始日志，原始日志结构如下所示：

{
    cluster_version:" "
    cluster_name:" "
    verb:"get"
    objectRefName:"xxxx"
    userAgent:"xxxx"
    objectRefResource:"leases"
    requestURI:" "
    message:"{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"c1443f6a-xxxx-xxxx-afac-e8654e1xxxxx","stage":"ResponseComplete","requestURI":"xxxx","verb":"get","user":{"username":"xxxx","uid":"e77fa9ac-xxxx-xxxx-xxxx-96beeadxxxxx","groups":["system:serviceaccounts","system:serviceaccounts:kube-system","system:authenticated"]},"sourceIPs":["10.x.x.x"],"userAgent":"xxxx","objectRef":{"resource":"leases","namespace":"kube-system","name":"xxxx","apiGroup":"xxxx","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":200},"requestReceivedTimestamp":"2023-06-29T09:46:29.906639Z","stageTimestamp":"2023-06-29T09:46:29.922133Z","annotations":{"authentication.k8s.io/legacy-token":"xxxx","authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"xxxx" }}",
    responseStatusCode:"200"
    _timestamp_:1688031992489
    sourceIP:"10.x.x.x"
    cluster_uuid:" "
    objectRefNamespace:"kube-system"
    user:"xxxx"
    timestamp:"2023-06-29T17:46:31.299+0800"
}

其中，message 包含审计日志信息，以下为审计日志示例：

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "c1443f6a-xxxx-xxxx-afac-e8654e1xxxxx",
  "stage": "ResponseComplete",
  // 发生了什么
  "requestURI": "xxxx",
  "verb": "get",
  // 发起人信息
  "user": {
    "username": "xxxx",
    "uid": "xxxx",
    "groups": [
      "system:serviceaccounts",
      "system:serviceaccounts:kube-system",
      "system:authenticated"
    ]
  },
  // 发起人IP
  "sourceIPs": [
    "10.x.x.x"
  ],
  // 发生对象信息
  "userAgent": "xxxx",
  "objectRef": {
    "resource": "leases",
    "namespace": "kube-system",
    "name": "xxxx",
    "apiGroup": "xxxx",
    "apiVersion": "v1"
  },
  // 发生对象结果
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  // 发生起始和结束时间
  "requestReceivedTimestamp": "2023-06-29T09:46:29.906639Z",
  "stageTimestamp": "2023-06-29T09:46:29.922133Z",
  // 请求被接收/拒绝的原因是什么
  "annotations": {
    "authentication.k8s.io/legacy-token": "xxxx",
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "xxxx"
  }
}