Chapter 8. Configuring the audit log policy

1. Sensitive resources, such as

   Secret

   ,

   Route

   , and

   OAuthClient

   objects, are never logged past the metadata level.

Procedure

1. Edit the

   APIServer

   resource:

   $ oc edit apiserver cluster

2. Update the

   spec.audit.profile

   field:

     apiVersion: config.openshift.io/v1
     kind: APIServer
     metadata:
     ...
     spec:
       audit:
         profile: WriteRequestBodies 

   1

   1

   Set to Default, WriteRequestBodies, or AllRequestBodies. The default profile is Default.

3. Save the file to apply the changes.

4. Verify that a new revision of the Kubernetes API server pods has rolled out. This will take several minutes.

   $ oc get kubeapiserver -o=jsonpath='{range .items[0].status.conditions[?(@.type=="NodeInstallerProgressing")]}{.reason}{"\n"}{.message}{"\n"}'

   Review the

   NodeInstallerProgressing

   status condition for the Kubernetes API server to verify that all nodes are at the latest revision. The output shows

   AllNodesAtLatestRevision

   upon successful update:

   AllNodesAtLatestRevision
   3 nodes are at revision 12 

   1

   1

   In this example, the latest revision number is 12.

   If the output shows a message similar to one of the following, this means that the update is still in progress. Wait a few minutes and try again.

   • 3 nodes are at revision 11; 0 nodes have achieved new revision 12

   • 2 nodes are at revision 11; 1 nodes are at revision 12