From 9adc2c7c6c0347dc88ebd3a8fbdcfba100e5711b Mon Sep 17 00:00:00 2001 From: Richard Mokua Date: Fri, 19 Jun 2020 03:36:56 +0200 Subject: [PATCH 1/4] Update audit.md --- .../tasks/debug-application-cluster/audit.md | 33 +++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/content/en/docs/tasks/debug-application-cluster/audit.md b/content/en/docs/tasks/debug-application-cluster/audit.md index 600af51d00..5e435ba32d 100644 --- a/content/en/docs/tasks/debug-application-cluster/audit.md +++ b/content/en/docs/tasks/debug-application-cluster/audit.md @@ -133,6 +133,39 @@ log audit backend using the following [kube-apiserver][kube-apiserver] flags: - `--audit-log-maxbackup` defines the maximum number of audit log files to retain - `--audit-log-maxsize` defines the maximum size in megabytes of the audit log file before it gets rotated +{{< note >}} +In case kube-apiserver is configured as a Pod,remember to mount the hostPath to the localtion of the policy file and log file. For example, +` +--audit-policy-file=/etc/kubernetes/audit-policy.yaml +--audit-log-path=/var/log/audit.log +` +then mount the volumes: + + +``` +- mountPath: /etc/kubernetes/audit-policy.yaml + name: audit + readOnly: true + - mountPath: /var/log/audit.log + name: audit-log + readOnly: false +``` +finally the hostPath: + +``` +- hostPath: + path: /etc/kubernetes/audit-policy.yaml + type: File + name: audit + - hostPath: + path: /var/log/audit.log + type: FileOrCreate + name: audit-log + +``` + + +{{< /note >}} ### Webhook backend Webhook backend sends audit events to a remote API, which is assumed to be the From f5d6481d3d1b78e8240203d0778b14e5c5ca8f34 Mon Sep 17 00:00:00 2001 From: Richard Mokua Date: Wed, 1 Jul 2020 07:50:46 +0200 Subject: [PATCH 2/4] Update audit.md removed comment tag and indentation --- content/en/docs/tasks/debug-application-cluster/audit.md | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/content/en/docs/tasks/debug-application-cluster/audit.md b/content/en/docs/tasks/debug-application-cluster/audit.md index 5e435ba32d..8c81f2c1c9 100644 --- a/content/en/docs/tasks/debug-application-cluster/audit.md +++ b/content/en/docs/tasks/debug-application-cluster/audit.md @@ -133,8 +133,7 @@ log audit backend using the following [kube-apiserver][kube-apiserver] flags: - `--audit-log-maxbackup` defines the maximum number of audit log files to retain - `--audit-log-maxsize` defines the maximum size in megabytes of the audit log file before it gets rotated -{{< note >}} -In case kube-apiserver is configured as a Pod,remember to mount the hostPath to the localtion of the policy file and log file. For example, +In case kube-apiserver is configured as a Pod,remember to mount the hostPath to the location of the policy file and log file. For example, ` --audit-policy-file=/etc/kubernetes/audit-policy.yaml --audit-log-path=/var/log/audit.log @@ -146,7 +145,7 @@ then mount the volumes: - mountPath: /etc/kubernetes/audit-policy.yaml name: audit readOnly: true - - mountPath: /var/log/audit.log +- mountPath: /var/log/audit.log name: audit-log readOnly: false ``` @@ -157,7 +156,7 @@ finally the hostPath: path: /etc/kubernetes/audit-policy.yaml type: File name: audit - - hostPath: +- hostPath: path: /var/log/audit.log type: FileOrCreate name: audit-log @@ -165,7 +164,7 @@ finally the hostPath: ``` -{{< /note >}} + ### Webhook backend Webhook backend sends audit events to a remote API, which is assumed to be the From 8e69d20a2fba16da901433f2d1beb8ecd679d3b4 Mon Sep 17 00:00:00 2001 From: Richard Mokua Date: Mon, 27 Jul 2020 08:02:20 +0200 Subject: [PATCH 3/4] Update audit.md correct indentation on the policy file and log file hostPath volumes --- .../tasks/debug-application-cluster/audit.md | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/content/en/docs/tasks/debug-application-cluster/audit.md b/content/en/docs/tasks/debug-application-cluster/audit.md index 8c81f2c1c9..3addb29be2 100644 --- a/content/en/docs/tasks/debug-application-cluster/audit.md +++ b/content/en/docs/tasks/debug-application-cluster/audit.md @@ -152,14 +152,15 @@ then mount the volumes: finally the hostPath: ``` -- hostPath: - path: /etc/kubernetes/audit-policy.yaml - type: File - name: audit -- hostPath: - path: /var/log/audit.log - type: FileOrCreate - name: audit-log +- name: audit + hostPath: + path: /etc/kubernetes/audit-policy.yaml + type: File + +- name: audit-log + hostPath: + path: /var/log/audit.log + type: FileOrCreate ``` From 9c24d968856372a428174accd476fd8c8371c56b Mon Sep 17 00:00:00 2001 From: Richard Mokua Date: Mon, 27 Jul 2020 12:54:43 +0200 Subject: [PATCH 4/4] Update audit.md volume mount indentation correction --- .../docs/tasks/debug-application-cluster/audit.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/content/en/docs/tasks/debug-application-cluster/audit.md b/content/en/docs/tasks/debug-application-cluster/audit.md index 3addb29be2..de4f965932 100644 --- a/content/en/docs/tasks/debug-application-cluster/audit.md +++ b/content/en/docs/tasks/debug-application-cluster/audit.md @@ -142,12 +142,13 @@ then mount the volumes: ``` -- mountPath: /etc/kubernetes/audit-policy.yaml - name: audit - readOnly: true -- mountPath: /var/log/audit.log - name: audit-log - readOnly: false +volumeMounts: + - mountPath: /etc/kubernetes/audit-policy.yaml + name: audit + readOnly: true + - mountPath: /var/log/audit.log + name: audit-log + readOnly: false ``` finally the hostPath: