Auditing Rules

    After you enable KubeSphere Auditing Logs, log in to the console with a user of platform-admin role. In CRDs on the Cluster Management page, enter rules.auditing.kubesphere.io in the search bar. Click the result Rule and you can see the two CRD rules.

    Below are examples of part of the rules.

    alerting-rule

    1. apiVersion: auditing.kubesphere.io/v1alpha1
    2. kind: Rule
    3. metadata:
    4.   labels:
    5.     type: alerting
    6.     workspace: system-workspace
    7.   name: alerting-rule
    8. spec:
    9.   rules:
    10.   - desc: all operator need to be audit
    11.     list:
    12.     - create
    13.     - update
    14.     - patch
    15.     name: action
    16.     type: list
    17.   - condition: Verb in ${action}
    18.     desc: audit the change of resource
    19.     enable: true
    20.     name: ResourceChange
    21.     priority: INFO
    22.     type: rule

    When an auditing log matches a rule in archiving-rule and the rule priority is no less than archivingPriority, it will be stored for further use. When an auditing log matches a rule in alerting-rule, if the priority of the rule is less than alertingPriority, it will be stored for further use; otherwise it will generate an alert which will be sent to the user.

    A Condition is a filtering expression that can use comparison operators (=, !=, <, <=, >, >=, contains, in, like, and regex) and can be combined using Boolean operators (and, or and not) and parentheses. Here are the supported filters.

    FilterDescription
    WorkspaceThe workspace where the audit event happens.
    DevopsThe DevOps project where the audit event happens.
    LevelThe level of auditing logs.
    RequestURIRequestURI is the request URI as sent by the client to a server.
    VerbThe verb associated with the request.
    User.UsernameThe name that uniquely identifies this user among all active users.
    User.GroupsThe names of groups this user is a part of.
    SourceIPsThe source IP from where the request originated and intermediate proxies.
    ObjectRef.ResourceThe resource of the object associated with the request.
    ObjectRef.NamespaceThe namespace of the object associated with the request.
    ObjectRef.NameThe name of the object associated with the request.
    ObjectRef.SubresourceThe subresource of the object associated with the request.
    ResponseStatus.codeThe suggested HTTP return code for the request.
    ResponseStatus.StatusThe status of the operation.
    RequestReceivedTimestampThe time the request reaches the apiserver.
    StageTimestampThe time the request reaches the current audit stage.
    1. ObjectRef.Namespace = "test"

    To match all logs in the namespaces that start with test:

    To match all logs happening in the latest one hour:

    1. RequestReceivedTimestamp >= "2020-06-12T09:23:28.359896Z" and RequestReceivedTimestamp <= "2020-06-12T10:23:28.359896Z"

    Macro

    A macro is a rule condition snippet that can be re-used inside rules and even other macros. Macros provide a way to name common patterns and factor out redundancies in rules. Here is an example of a macro.

    1. apiVersion: auditing.kubesphere.io/v1alpha1
    2. kind: Rule
    4.   name: alerting-rule
    5.   labels:
    6.     workspace: system-workspace
    7.     type: alerting
    8.   rules:
    9.   - name: pod
    10.     type: macro
    11.     desc: pod
    12.     macro: ObjectRef.Resource="pods"

    Note

    A list is a collection of items that can be included in rules, macros, or other lists. Unlike rules and macros, lists cannot be parsed as filtering expressions. Here is an example of a list.

    Alias

    An alias is a short name of a filter field. It can be included in rules, macros, lists, and output strings. Here is an example of an alias.

    1. apiVersion: auditing.kubesphere.io/v1alpha1
    2. kind: Rule
    3. metadata:
    4.   name: alerting-rule
    5.   labels:
    6.     workspace: system-workspace
    7.     type: alerting
    8. spec:
    9.   rules:
    10.   - name: namespace
    11.     type: alias
    12.     desc: the alias of the resource namespace
    13.     alias: ObjectRef.Namespace

    The Output string is used to format the alerting message when an auditing log triggers an alert. The Output string can include lists and alias. Here is an example.

    1. Output: ${user} ${verb} a HostNetwork Pod ${name} in ${namespace}.

    Note