Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Restarting rke2-server with a different audit policy does not send audit logs #718

Closed
rancher-max opened this issue Feb 23, 2021 · 2 comments

Comments

@rancher-max
Copy link
Contributor

Description:
After updating the audit policy, restarting the rke2 server process, and performing requests on the cluster, I still do not any audit logs generated.
I'm not sure if this is expected behavior or not as I could not find upstream documentation about changing this.

Steps:

  1. Create an rke2 server in cis mode
  2. Update the data located in the audit policy file, located at: /etc/rancher/rke2/audit-policy.yaml, to log everything:
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
- level: RequestResponse
  1. Restart rke2-server process: sudo systemctl restart rke2-server
  2. When the apiserver pod is running again, submit requests on the server. I applied the following yaml:
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: othertest-deploy
  labels:
    app: othertest
spec:
  selector:
    matchLabels:
      app: othertest
  template:
    metadata:
      labels:
        app: othertest
    spec:
      containers:
      - name: othertest
        image: maxross/mytestcontainer:unprivileged
        imagePullPolicy: Always

Notice there is no log file created: sudo ls /var/lib/rancher/rke2/server/logs/

@brandond
Copy link
Contributor

brandond commented Feb 23, 2021

I think we already have an issue for this, at #692. The issue is that our selinux policy doesn't allow the apiserver pod to access the policy and log files.

@brandond
Copy link
Contributor

Closing in favor of the existing issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants