Ensure that the --audit-log-path argument is set

MediumLevel 1Manual reviewopenshift

Description

Enable auditing on the Kubernetes API Server and set the desired audit log path. The benchmark marks this recommendation Manual.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

OpenShift audit works at the API server level, logging all requests coming to the server. API server audit is on by default. Run the following command to find the Kubernetes API audit log path: oc get configmap config -n openshift-kube-apiserver -ojson | jq -r '.data["config.yaml"]' | jq '.apiServerArguments["audit-log-path"]' Verify the path is /var/log/kube-apiserver/audit.log.

How it is fixed

Fix method: Guidance or infrastructure patch

Set the --audit-log-path argument

Properties

Operating systems: Any
Tags: openshiftapi-serverlogging
Reference: CIS Red Hat OpenShift Container Platform Benchmark v2.0.0 - 1.2.18 Ensure that the --audit-log-path argument is set