Audit prerequisites

Auditing can be enabled with a prerequisite of supported services available in the cluster:

Fluentd configuration

Add HTTP input plugin

You first have to add the HTTP Input plugin to the fluent.conf file to retrieve records from HTTP POST

  • Add HTTP Plugin to Fluentd

    <source>
      @type http
      port 8888
      bind 0.0.0.0
      body_size_limit 32m
      keepalive_timeout 10s
      # tag is part of the URL, e.g.,
      # curl -X POST -d 'json={"action":"login","user":2}' http://localhost:8888/tag.here
    </source>
  • API Binding secret k5-auditlog-settings needs to be created in the namespace with this service url.

  • The path in the above url is used to create the tag for the log event. And can be used to filter logs.

Add ElasticSearch plugin

You also need to add the plugin to fluentd.conf for transferring logs data to elasticsearch

<match tag.here>
  @type elasticsearch
  logstash_format true
  host <hostname> #(optional; default="localhost")
  port <port> #(optional; default=9200)
  index_name <index name> #(optional; default=fluentd)
  type_name <type name> #(optional; default=fluentd)
</match>

Add the above plugin in fluent.conf to enable fluentd to send all logs with tag tag.here to the elasticsearch instance configured.

Note: Make sure that a Fluentd service is available in cluster before enabling Audit.