diff --git a/roles/kubernetes/master/defaults/main.yml b/roles/kubernetes/master/defaults/main.yml index e31809bbdb7b3373d4f4ba7e920829c8f864bbc0..bfd09619b4c9976c0b96af09b05ac84d4ece8421 100644 --- a/roles/kubernetes/master/defaults/main.yml +++ b/roles/kubernetes/master/defaults/main.yml @@ -36,6 +36,12 @@ audit_log_maxbackups: 1 audit_log_maxsize: 100 # policy file audit_policy_file: "{{ kube_config_dir }}/audit-policy/apiserver-audit-policy.yaml" +# custom audit policy rules (to replace the default ones) +# audit_policy_custom_rules: > +# - level: None +# users: [] +# verbs: [] +# resources: [] # audit log hostpath audit_log_name: audit-logs diff --git a/roles/kubernetes/master/templates/apiserver-audit-policy.yaml.j2 b/roles/kubernetes/master/templates/apiserver-audit-policy.yaml.j2 index 40d6a8bb52c8a936c2ff2e89757dc691047393a3..6f304a0da4126899057f712cee55c2f36b49762d 100644 --- a/roles/kubernetes/master/templates/apiserver-audit-policy.yaml.j2 +++ b/roles/kubernetes/master/templates/apiserver-audit-policy.yaml.j2 @@ -1,6 +1,9 @@ apiVersion: audit.k8s.io/v1beta1 kind: Policy rules: +{% if audit_policy_custom_rules is defined and audit_policy_custom_rules != "" -%} +{{ audit_policy_custom_rules | indent(2, true) }} +{% else %} # The following requests were manually identified as high-volume and low-risk, # so drop them. - level: None @@ -123,3 +126,4 @@ rules: - level: Metadata omitStages: - "RequestReceived" +{% endif %}