Rancher 中给集群开启日志审计

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

      # Enable audit logging
      # Available as of v1.0.0
      audit_log:
        enabled: true
        configuration:
          # 最多保留 6 天
          max_age: 6
          # 最多保留 6 个文件
          max_backup: 6
          # 单个文件最大 110M
          max_size: 110
          path: /var/log/kube-audit/audit-log.json
          format: json
          policy:                  
            apiVersion: audit.k8s.io/v1
            kind: Policy
            # Don't generate audit events for all requests in RequestReceived stage.
            omitStages:
              - "RequestReceived"
            rules:
              # get list watch 不记录日志
              - level: None
                verbs: ["get","list","watch"]

              # 其他类型的只记录Metadata日志
              - level: Metadata