Chapter 8. Configuring the audit log policy

1. Sensitive resources, such as Secret, Route, and OAuthClient objects, are never logged past the metadata level. OAuth tokens are not logged at all if your cluster was upgraded from OpenShift Container Platform 4.5, because their object names might contain secret information.

Procedure

1. Edit the APIServer resource:

   $ oc edit apiserver cluster

2. Update the spec.audit.profile field:

     apiVersion: config.openshift.io/v1
     kind: APIServer
     metadata:
     ...
     spec:
       audit:
         profile: WriteRequestBodies 1

   1

   Set to Default, WriteRequestBodies, or AllRequestBodies. The default profile is Default.

3. Save the file to apply the changes.

4. Verify that a new revision of the Kubernetes API server pods has rolled out. This will take several minutes.

   $ oc get kubeapiserver -o=jsonpath='{range .items[0].status.conditions[?(@.type=="NodeInstallerProgressing")]}{.reason}{"\n"}{.message}{"\n"}'

   Review the NodeInstallerProgressing status condition for the Kubernetes API server to verify that all nodes are at the latest revision. The output shows AllNodesAtLatestRevision upon successful update:

   AllNodesAtLatestRevision
   3 nodes are at revision 12 1

   1

   In this example, the latest revision number is 12.

   If the output shows a message similar to one of the following, this means that the update is still in progress. Wait a few minutes and try again.

   • 3 nodes are at revision 11; 0 nodes have achieved new revision 12
   • 2 nodes are at revision 11; 1 nodes are at revision 12