github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
bc3434c084
kubernetes/cluster
History
Kubernetes Submit Queue ea4764bf47 Merge pull request #46897 from timstclair/audit-policy 
Automatic merge from submit-queue (batch tested with PRs 46897, 46899, 46864, 46854, 46875)

Write audit policy file for GCE/GKE configuration

Setup the audit policy configuration for GCE & GKE. Here is the high level summary of the policy:

- Default logging everything at `Metadata`
- Known write APIs default to `RequestResponse`
- Known read-only APIs default to `Request`
- Except secrets & configmaps are logged at `Metadata`
- Don't log events
- Don't log `/version`, swagger or healthchecks

In addition to the above, I spent time analyzing the noisiest lines in the audit log from a cluster that soaked for 24 hours (and ran a batch of e2e tests). Of those top requests, those that were identified as low-risk (all read-only, except update kube-system endpoints by controllers) are dropped.

I suspect we'll want to tweak this a bit more once we've had a time to soak it on some real clusters.

For kubernetes/features#22

/cc @sttts @ericchiang
2017-06-06 05:22:40 -07:00
..
addons Merge pull request #46787 from crassirostris/fluentd-gcp-update 2017-06-06 01:53:40 -07:00
aws hack/cluster: consolidate cluster/ utils to hack/lib/util.sh 2017-03-30 22:34:46 -05:00
centos Add Initializers to all admission control paths by default 2017-06-02 22:09:04 -04:00
gce Merge pull request #46897 from timstclair/audit-policy 2017-06-06 05:22:40 -07:00
gke Plumb through the ENABLE_LEGACY_ABAC flag for GKE kube-up. 2017-05-30 17:18:45 -07:00
images Bump etcd base image to go1.7.6 2017-05-29 09:38:27 -07:00
juju Add Initializers to all admission control paths by default 2017-06-02 22:09:04 -04:00
kubemark Enable DefaultTolerationSeconds and PodPreset admission plugins for kubemark 2017-06-04 19:52:57 +02:00
lib hack/cluster: consolidate cluster/ utils to hack/lib/util.sh 2017-03-30 22:34:46 -05:00
libvirt-coreos Add Initializers to all admission control paths by default 2017-06-02 22:09:04 -04:00
local
openstack-heat Add Initializers to all admission control paths by default 2017-06-02 22:09:04 -04:00
photon-controller Add Initializers to all admission control paths by default 2017-06-02 22:09:04 -04:00
saltbase Merge pull request #46799 from mikedanese/gce-3 2017-06-05 17:46:52 -07:00
skeleton
vagrant Add Initializers to all admission control paths by default 2017-06-02 22:09:04 -04:00
vsphere Update generated for 2017 2017-01-01 23:11:09 -08:00
windows Fixed the issue with log rotation 2016-12-12 11:08:41 -05:00
BUILD Replace git_repository with http_archive and use ixdy's fork of bazel tools for pkg_tar 2017-05-03 10:13:06 -07:00
clientbin.sh Refactor the common parts of cluster/kube{ctl,adm}.sh into a util script. 2017-01-26 21:29:49 -08:00
common.sh Merge pull request #46524 from ajitak/npd_version 2017-06-02 23:37:45 -07:00
get-kube-binaries.sh Make get-kube.sh work properly the "ci/latest" pointer 2017-04-05 15:02:10 -07:00
get-kube-local.sh hack/cluster: map /run/xtables.lock into containerized kubelet filesystem 2017-05-05 23:34:06 -05:00
get-kube.sh Merge pull request #44062 from ixdy/semver-regexes 2017-05-01 12:54:44 -07:00
kube-down.sh Automatically download missing kube binaries in kube-up/kube-down. 2016-12-13 14:59:13 -08:00
kube-push.sh Automatically download missing kube binaries in kube-up/kube-down. 2016-12-13 14:59:13 -08:00
kube-up.sh Add KUBE_GCE_ENABLE_IP_ALIASES flag to the cluster turn up scripts. 2017-04-11 14:07:50 -07:00
kube-util.sh Add KUBE_GCE_ENABLE_IP_ALIASES flag to the cluster turn up scripts. 2017-04-11 14:07:50 -07:00
kubeadm.sh Refactor the common parts of cluster/kube{ctl,adm}.sh into a util script. 2017-01-26 21:29:49 -08:00
kubectl.sh Fix failing kubectl skew tests 2017-03-08 16:08:47 -03:00
log-dump.sh Switch gcloud compute copy-files to scp 2017-05-30 10:19:33 -07:00
options.md
OWNERS Updated top level owners file to match new format 2017-01-19 11:29:16 -08:00
README.md
restore-from-backup.sh Fix restore-from-backup.sh script 2017-03-21 11:58:13 +01:00
test-e2e.sh
test-network.sh
test-smoke.sh
update-storage-objects.sh Support storageclass storage upgrades to v1 2017-05-24 10:43:56 -04:00
validate-cluster.sh hack/cluster: consolidate cluster/ utils to hack/lib/util.sh 2017-03-30 22:34:46 -05:00

README.md

Cluster Configuration

Deprecation Notice: This directory has entered maintenance mode and will not be accepting new providers. Please submit new automation deployments to kube-deploy. Deployments in this directory will continue to be maintained and supported at their current level of support.

The scripts and data in this directory automate creation and configuration of a Kubernetes cluster, including networking, DNS, nodes, and master components.

See the getting-started guides for examples of how to use the scripts.

cloudprovider/config-default.sh contains a set of tweakable definitions/parameters for the cluster.

The heavy lifting of configuring the VMs is done by SaltStack.

Analytics