Kube Audit log of RKE2

[cloudcafetech]

Not able to find Kube Audit log in Masters node.

Do I need to enable, if yes then how? Let me know where it store?

[brandond]

Audit logging must be configured manually, as there are many options to configure in terms of what events get logged and at what level of detail. See #1183 (comment) for an example.

[cloudcafetech]

Did as per your reference link but NO sucess.

Steps as follows, am I missing something ..

• Stop rke2 server

• Edit the config.yaml to include:

audit-policy-file: /etc/rancher/rke2/audit-policy.yaml

• Create audit-policy.yaml in /etc/rancher/rke2 folder with below content

apiVersion: audit.k8s.io/v1
kind: Policy
rules:
- level: RequestResponse

• Restart rke2 server

• Delete couple of Pods

• Not able to see any files in /var/lib/rancher/rke2/server/logs/

ll /var/lib/rancher/rke2/server/logs/
total 0

• Reference output from servers

[root@prancp01 ~]# ll /etc/rancher/rke2/
total 12
-rw-r--r--. 1 root root   73 Oct 17 21:35 audit-policy.yaml
-rw-r--r--. 1 root root  635 Oct 17 21:36 config.yaml
-rw-r--r--. 1 root root 2977 Oct 17 21:37 rke2.yaml

[root@prancp01 ~]# cat /etc/rancher/rke2/audit-policy.yaml
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
- level: RequestResponse

[root@prancp01 ~]# cat /etc/rancher/rke2/config.yaml
token: rancher-secret
write-kubeconfig-mode: "0644"
node-label:
- "region=master"
# add ips/hostname of hosts and loadbalancer
tls-san:
  - "rancher.example.com"
  - "172.26.33.80"
  - "172.26.33.171"
  - "prancp01.plk.local"
  - "172.26.33.172"
  - "prancp02.plk.local"
  - "172.26.33.173"
  - "prancp03.plk.local"
# Make a etcd snapshot every 12 hours
etcd-snapshot-schedule-cron: "0 */12 * * *"
# Keep 56 etcd snapshorts (equals to 2 weeks with 6 a day)
etcd-snapshot-retention: 56
# Disable Nginx Ingress
#disable: rke2-ingress-nginx
# Kube Audit Log
audit-policy-file: /etc/rancher/rke2/audit-policy.yaml

[root@prancp01 ~]# ll /var/lib/rancher/rke2/server/logs/
total 0
[root@prancp01 ~]#

[brandond]

Note the fixed version on the linked issue - the steps only work on 1.22. alternately, you could enable one of our CIS profiles, although that comes with a lot of other hardening as well.

[cloudcafetech]

the steps only work on 1.22

You want to say RKE 1.22 ?

Any alternative for 1.21 ?

you could enable one of our CIS profiles, although that comes with a lot of other hardening as well.

How to add in config file?