Container Service for Kubernetes：Gunakan audit kluster di kluster terdaftar

Masuk ke node master dan modifikasi file /etc/kubernetes/audit-policy.yaml sesuai dengan template berikut. Langkah ini juga harus dilakukan pada node master lainnya.

apiVersion: audit.k8s.io/v1beta1
kind: Policy
# Jangan buat peristiwa audit untuk semua permintaan dalam tahap RequestReceived.
omitStages:
  - "RequestReceived"
rules:
  # Permintaan berikut diidentifikasi secara manual sebagai volume tinggi dan risiko rendah,
  # jadi abaikan mereka.
  - level: None
    users: ["system:kube-proxy"]
    verbs: ["watch"]
    resources:
      - group: "" # core
        resources: ["endpoints", "services"]
  - level: None
    users: ["system:unsecured"]
    namespaces: ["kube-system"]
    verbs: ["get"]
    resources:
      - group: "" # core
        resources: ["configmaps"]
  - level: None
    users: ["kubelet"] # identitas kubelet lama
    verbs: ["get"]
    resources:
      - group: "" # core
        resources: ["nodes"]
  - level: None
    userGroups: ["system:nodes"]
    verbs: ["get"]
    resources:
      - group: "" # core
        resources: ["nodes"]
  - level: None
    users:
      - system:kube-controller-manager
      - system:kube-scheduler
      - system:serviceaccount:kube-system:endpoint-controller
    verbs: ["get", "update"]
    namespaces: ["kube-system"]
    resources:
      - group: "" # core
        resources: ["endpoints"]
  - level: None
    users: ["system:apiserver"]
    verbs: ["get"]
    resources:
      - group: "" # core
        resources: ["namespaces"]
  # Jangan catat URL baca saja ini.
  - level: None
    nonResourceURLs:
      - /healthz*
      - /version
      - /swagger*
  # Jangan catat permintaan acara.
  - level: None
    resources:
      - group: "" # core
        resources: ["events"]
  # Rahasia, ConfigMaps, dan TokenReviews dapat berisi data sensitif & biner,
  # jadi hanya catat pada tingkat Metadata.
  - level: Metadata
    resources:
      - group: "" # core
        resources: ["secrets", "configmaps"]
      - group: authentication.k8s.io
        resources: ["tokenreviews"]
  # Respon Get bisa besar; lewati mereka.
  - level: Request
    verbs: ["get", "list", "watch"]
    resources:
      - group: "" # core
      - group: "admissionregistration.k8s.io"
      - group: "apps"
      - group: "authentication.k8s.io"
      - group: "authorization.k8s.io"
      - group: "autoscaling"
      - group: "batch"
      - group: "certificates.k8s.io"
      - group: "extensions"
      - group: "networking.k8s.io"
      - group: "policy"
      - group: "rbac.authorization.k8s.io"
      - group: "settings.k8s.io"
      - group: "storage.k8s.io"
  # Tingkat default untuk API yang diketahui
  - level: RequestResponse
    resources:
      - group: "" # core
      - group: "admissionregistration.k8s.io"
      - group: "apps"
      - group: "authentication.k8s.io"
      - group: "authorization.k8s.io"
      - group: "autoscaling"
      - group: "batch"
      - group: "certificates.k8s.io"
      - group: "extensions"
      - group: "networking.k8s.io"
      - group: "policy"
      - group: "rbac.authorization.k8s.io"
      - group: "settings.k8s.io"
      - group: "storage.k8s.io"
  # Tingkat default untuk semua permintaan lainnya.
  - level: Metadata

Masuk ke node master dan modifikasi file /etc/kubernetes/manifests/kube-apiserver.yaml sesuai deskripsi berikut. Langkah ini juga harus dilakukan pada node master lainnya.

• Tambahkan parameter --audit-log-* ke bagian command:

  ...
  spec:
    containers:
    - command:
      - kube-apiserver
      - --audit-log-maxbackup=10
      - --audit-log-maxsize=100
      - --audit-log-path=/var/log/kubernetes/kubernetes.audit
      - --audit-log-maxage=30
      - --audit-policy-file=/etc/kubernetes/audit-policy.yaml
      ...

• Tambahkan parameter aliyun_logs_audit-* ke bagian env.

  ...
  spec:
    containers:
    - command:
      - kube-apiserver
      - --audit-log-maxbackup=10
      - --audit-log-maxsize=100
      - --audit-log-path=/var/log/kubernetes/kubernetes.audit
      - --audit-log-maxage=30
      - --audit-policy-file=/etc/kubernetes/audit-policy.yaml
      ...
      ...
      env:
      - name: aliyun_logs_audit-${cluster_id}
        value: /var/log/kubernetes/kubernetes.audit
      - name: aliyun_logs_audit-${cluster_id}_tags
        value: audit=apiserver
      - name: aliyun_logs_audit-${cluster_id}_product
        value: k8s-audit
      - name: aliyun_logs_audit-${cluster_id}_jsonfile
        value: "true"
      image: registry-vpc.cn-shenzhen.aliyuncs.com/acs/kube-apiserver:v1.20.4-aliyun.1

  Penting

  Ganti {cluster_id} dengan ID kluster Anda. Untuk informasi lebih lanjut tentang cara mendapatkan ID kluster, lihat Lihat informasi kluster.

• Gunakan template berikut untuk memasang /etc/kubernetes/audit-policy.yaml ke pod kube-apiserver:

  ...
  spec:
    containers:
    - command:
      - kube-apiserver
      - --audit-log-maxbackup=10
      - --audit-log-maxsize=100
      - --audit-log-path=/var/log/kubernetes/kubernetes.audit
      - --audit-log-maxage=30
      - --audit-policy-file=/etc/kubernetes/audit-policy.yaml
      ...
      ...
      env:
      - name: aliyun_logs_audit-${cluster_id}
        value: /var/log/kubernetes/kubernetes.audit
      - name: aliyun_logs_audit-${cluster_id}_tags
        value: audit=apiserver
      - name: aliyun_logs_audit-${cluster_id}_product
        value: k8s-audit
      - name: aliyun_logs_audit-${cluster_id}_jsonfile
        value: "true"
      image: registry-vpc.cn-shenzhen.aliyuncs.com/acs/kube-apiserver:v1.20.4-aliyun.1
      ...
      ...
      volumeMounts:
      - mountPath: /var/log/kubernetes
        name: k8s-audit
      - mountPath: /etc/kubernetes/audit-policy.yaml
        name: audit-policy
        readOnly: true
      ...
      ...
    volumes:
    - hostPath:
        path: /var/log/kubernetes
        type: DirectoryOrCreate
      name: k8s-audit
    - hostPath:
        path: /etc/kubernetes/audit-policy.yaml
        type: FileOrCreate
      name: audit-policy
    ...