From d7a3f5d40963f61cb1340da1a1d940537f6aca75 Mon Sep 17 00:00:00 2001 From: Marek Siarkowicz Date: Tue, 24 Nov 2020 08:49:00 +0100 Subject: [PATCH] Document log sanitization feature (#24845) * Document log sanitization feature * Fill in log sanitization documentation * Update content/en/docs/concepts/cluster-administration/system-logs.md Co-authored-by: Marek Siarkowicz Co-authored-by: Rob Franken Co-authored-by: Rob Franken --- .../cluster-administration/system-logs.md | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/content/en/docs/concepts/cluster-administration/system-logs.md b/content/en/docs/concepts/cluster-administration/system-logs.md index 106711561c..68aab4f86d 100644 --- a/content/en/docs/concepts/cluster-administration/system-logs.md +++ b/content/en/docs/concepts/cluster-administration/system-logs.md @@ -91,6 +91,27 @@ List of components currently supporting JSON format: * {{< glossary_tooltip term_id="kube-scheduler" text="kube-scheduler" >}} * {{< glossary_tooltip term_id="kubelet" text="kubelet" >}} +### Log sanitization + +{{< feature-state for_k8s_version="v1.20" state="alpha" >}} + +{{}} +Log sanitization might incur significant computation overhead and therefore should not be enabled in production. +{{< /warning >}} + +The `--experimental-logging-sanitization` controls if a sanitization filter will be installed in klog. +If enabled all log arguments are inspected for fields tagged as sensitive data (e.g. passwords, keys, tokens) and logging of these fields will be prevented. + +List of components currently supporting log sanitization: +* {{< glossary_tooltip term_id="kube-controller-manager" text="kube-controller-manager" >}} +* {{< glossary_tooltip term_id="kube-apiserver" text="kube-apiserver" >}} +* {{< glossary_tooltip term_id="kube-scheduler" text="kube-scheduler" >}} +* {{< glossary_tooltip term_id="kubelet" text="kubelet" >}} + +{{< note >}} +This is not interacting with user workload logs, so it won't prevent users workloads from leaking sensitive data. +{{< /note >}} + ### Log verbosity level The `-v` flag controls log verbosity. Increasing the value increases the number of logged events. Decreasing the value decreases the number of logged events.