K8S开启/关闭审计日志

李南想做条咸鱼

已于 2025-03-06 14:29:25 修改

阅读量776

点赞数 6

文章标签： kubernetes java 容器

于 2025-01-15 11:23:29 首次发布

本文链接：https://blog.youkuaiyun.com/m0_53683186/article/details/145156774

版权

K8S默认禁用审计

在这里插入图片描述

开启/关闭 k8s 审计日志

默认 Kubernetes 集群不会输出审计日志信息。通过以下配置，可以开启 Kubernetes 的审计日志功能。

准备审计日志的 Policy 文件
配置 API 服务器，开启审计日志
重启并验证

准备审计日志 Policy 文件

准备/etc/kubernetes/audit-policy.yaml文件

apiVersion: audit.k8s.io/v1
kind: Policy
rules:
- level: Request

配置 API 服务器

打开 API 服务器的配置文件 kube-apiserver.yaml，一般会在 /etc/kubernetes/manifests/ 文件夹下，并添加以下配置信息：

这一步操作前请备份 kube-apiserver.yaml，并且备份的文件不能放在 /etc/kubernetes/manifests/ 下，建议放在 /etc/kubernetes/tmp。

在 spec.containers.command 下添加命令：

--audit-policy-file=/etc/kubernetes/audit-policy.yaml
--audit-log-path=/var/log/kubernetes/audit/audit.log

在 spec.containers.volumeMounts 下添加：

volumeMounts:
  - mountPath: /etc/kubernetes/audit-policy.yaml
    name: audit
    readOnly: true
  - mountPath: /var/log/kubernetes/audit/
    name: audit-log
    readOnly: false

在 spec.volumes 下添加：

volumes:
- name: audit
  hostPath:
    path: /etc/kubernetes/audit-policy.yaml
    type: File
- name: audit-log
  hostPath:
    path: /var/log/kubernetes/audit/
    type: DirectoryOrCreate

测试并验证

稍等一会，API 服务器会自动重启，如果不重启，手动执行systemctl restart kubelet，执行以下命令查看/var/log/kubernetes/audit 目录下是否有审计日志生成，若有，则表示 k8s 审计日志成功开启。

ls /var/log/kubernetes/audit/

审计日志样例

{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"0d3e03f1-2c7b-4c55-a457-8153ca3053c7","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/kube-system/pods","verb":"create","user":{"username":"system:node:test3","groups":["system:nodes","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["X509SHA256=f624d02c9b496b091c035973fdebaa49445bc661126811e9e3e0d5254f6a61b5"]}},"sourceIPs":["10.0.2.18"],"userAgent":"kubelet/v1.32.0 (linux/amd64) kubernetes/70d3cc9","objectRef":{"resource":"pods","namespace":"kube-system","name":"etcd-test3","uid":"37d309b452af10f21285eec4372382b6","apiVersion":"v1"},"responseStatus":{"metadata":{},"status":"Failure","message":"pods \"etcd-test3\" already exists","reason":"AlreadyExists","details":{"name":"etcd-test3","kind":"pods"},"code":409},"requestReceivedTimestamp":"2025-01-15T03:04:00.960498Z","stageTimestamp":"2025-01-15T03:04:01.014779Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"","pod-security.kubernetes.io/enforce-policy":"privileged:latest"}}

如果想关闭，去掉 spec.containers.command 中的相关命令即可。