github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
c9a46a0806
kubernetes/cluster/gce/gci
History
Kubernetes Submit Queue ea4764bf47 Merge pull request #46897 from timstclair/audit-policy 
Automatic merge from submit-queue (batch tested with PRs 46897, 46899, 46864, 46854, 46875)

Write audit policy file for GCE/GKE configuration

Setup the audit policy configuration for GCE & GKE. Here is the high level summary of the policy:

- Default logging everything at `Metadata`
- Known write APIs default to `RequestResponse`
- Known read-only APIs default to `Request`
- Except secrets & configmaps are logged at `Metadata`
- Don't log events
- Don't log `/version`, swagger or healthchecks

In addition to the above, I spent time analyzing the noisiest lines in the audit log from a cluster that soaked for 24 hours (and ran a batch of e2e tests). Of those top requests, those that were identified as low-risk (all read-only, except update kube-system endpoints by controllers) are dropped.

I suspect we'll want to tweak this a bit more once we've had a time to soak it on some real clusters.

For kubernetes/features#22

/cc @sttts @ericchiang
2017-06-06 05:22:40 -07:00
..
mounter mounter.go: format return err. 2017-05-01 10:40:42 +08:00
nvidia-gpus Adding an installer script that installs Nvidia drivers in Container Optimized OS 2017-05-20 21:17:19 -07:00
configure-helper.sh Merge pull request #46897 from timstclair/audit-policy 2017-06-06 05:22:40 -07:00
configure.sh Configure NPD version through env variable 2017-05-31 16:40:09 -07:00
health-monitor.sh Fix the output of health-mointor.sh 2017-02-15 18:08:27 -08:00
helper.sh Ensure the GCI metadata files do not have whitespace at the end 2016-12-13 13:41:54 -08:00
master-helper.sh Add KUBE_GCE_ENABLE_IP_ALIASES flag to the cluster turn up scripts. 2017-04-11 14:07:50 -07:00
master.yaml Makes cluster/gce/ubuntu to be a symlink to cluster/gce/gci and changes the gci's [master|node].yaml to enable kubernetes.target. 2017-04-25 16:19:00 -07:00
node-helper.sh Splitting OS_DISTRIBUTION into NODE_OS_DISTRIBUTION and 2016-07-15 12:02:31 -07:00
node.yaml Makes cluster/gce/ubuntu to be a symlink to cluster/gce/gci and changes the gci's [master|node].yaml to enable kubernetes.target. 2017-04-25 16:19:00 -07:00
README.md Update Container-VM Image product name in docs 2016-09-09 10:08:56 -07:00

README.md

Container-VM Image

Container-VM Image is a container-optimized OS image for the Google Cloud Platform (GCP). It is primarily for running Google services on GCP. Unlike the open preview version of container-vm, the new Container-VM Image is based on the open source ChromiumOS project, allowing us greater control over the build management, security compliance, and customizations for GCP.

Analytics