Configuring IBM Cloud Private services to generate audit logs

You can configure your IBM® Cloud Private to generate audit logs.

IBM Cloud Private provides two types of audit logs:

• icp-audit is generated by IBM Cloud Private platform services
• kube-audit is generated by Kubernetes

You can enable or disable only kube-audit during installation of your cluster by updating the config.yaml file. You can enable or disable both types of audit logs after installation. By default, platform services do not generate any audit logs. You must enable audit logging for each service for which you need the logs.

IBM Cloud Private generates icp-audit logs for all create, read, update, and delete operations. You cannot configure log level for icp-audit logs. However, you can configure log level for kube-audit logs by updating the audit-policy.yaml file.

Enabling and disabling audit logging for various IBM Cloud Private services

1. Navigate to the ConfigMap. Click Navigation Menu > Configuration > ConfigMap.
2. Search for the ConfigMap of the service for which audit logging needs to be enabled.
3. From the options menu, click Edit.
4. Set the key that is related to auditing to true or false to enable or disable audit logging for that service.
5. Click Submit.
6. Remove all the pods that belong to that service. The pods are re-created with auditing enabled or disabled. Find your service.
   • Services are found in DaemonSets. Click Navigation Menu > Workload > DaemonSets.
   • Services are also found in Deployments. Click Navigation Menu > Workload > Deployments.

The following table lists the IBM Cloud Private services and the ConfigMaps where the audit-related keys are set.

Note: Some IBM Cloud Private services such as auth-idp, auth-pdp, and auth-pap can generate more detailed audit data. This detailed logging can be enabled by setting the AUDIT_DETAIL key to true in the respective ConfigMap.

Enabling Kubernetes auditing

Kubernetes auditing (kube-audit) can be enabled by updating the master.json file.

1. Use Secure Shell (SSH) to connect to the master node as a root user.

2. Copy master.json file to tmp location.

   cp /etc/cfc/pods/master.json /tmp/
   

3. Edit copied master.json file by using any editor.

   vim /tmp/master.json
   

4. Add audit policy file path and audit log file path under apiserver config section in the command list after the last element.

   "--audit-policy-file=/etc/cfc/conf/audit-policy.yaml",
   "--audit-log-path=/var/log/k8saudit/audit.log",
   "--audit-log-maxage=3",
   "--audit-log-maxbackup=10",
   "--audit-log-maxsize=10"
   

   Note: Put a comma , after the last element of the command list before you add the previous two fields.

5. Replace original master.json with the updated one.

   cp /tmp/master.json /etc/cfc/pods/master.json
   

6. The master pod picks up the changes and the kube-apiserver is restarted with auditing enabled.

For more information, see Auditing .

Disabling Kubernetes auditing

Kubernetes auditing (kube-audit) can be disabled by updating the master.json file.

1. Use SSH to connect to the master node as a root user.

2. Copy master.json file to tmp location.

   cp /etc/cfc/pods/master.json /tmp/
   

3. Edit copied master.json file by using any editor.

   vim /tmp/master.json
   

4. Remove "--audit-policy-file=/etc/cfc/conf/audit-policy.yaml" from the apiserver config section.
   Note: To re-enable kube-audit, follow all the steps in Enabling Kubernetes auditing section.

5. Replace original master.json with an updated one.

   cp /tmp/master.json /etc/cfc/pods/master.json
   

6. The master pod picks up the changes and the kube-apiserver is restarted with auditing disabled.

For more information, see Audit Policy .