Skip to content

Commit cc87c30

Browse files
JoeAldingerJoeAldinger
authored
Merge pull request #75310 from JoeAldinger/OSDOCS-10396
OSDOCS-10396:ANP audit logging
2 parents 03a6caf + d77fbdb commit cc87c30

24 files changed

+413
-68
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1280,10 +1280,16 @@ Topics:
12801280
Dir: openshift_network_security
12811281
Distros: openshift-enterprise,openshift-origin
12821282
Topics:
1283-
- Name: About OVN-Kubernetes network policy
1284-
File: ovn-k-network-policy
1285-
- Name: AdminNetworkPolicy
1286-
File: ovn-k-anp
1283+
- Name: Understanding network policy APIs
1284+
File: network-policy-apis
1285+
- Name: Admin network policy
1286+
Dir: AdminNetworkPolicy
1287+
Distros: openshift-enterprise, openshift-origin
1288+
Topics:
1289+
- Name: About AdminNetworkPolicy
1290+
File: ovn-k-anp
1291+
- Name: About BaselineAdminNetworkPolicy
1292+
File: ovn-k-banp
12871293
- Name: Network policy
12881294
Dir: network_policy
12891295
Distros: openshift-enterprise, openshift-origin
@@ -1302,8 +1308,8 @@ Topics:
13021308
File: default-network-policy
13031309
- Name: Configuring multitenant isolation with network policy
13041310
File: multitenant-network-policy
1305-
- Name: BaselineAdminNetworkPolicy
1306-
File: ovn-k-banp
1311+
- Name: Audit logging for network security
1312+
File: logging-network-security
13071313
- Name: Understanding the Ingress Node Firewall Operator
13081314
File: ingress-node-firewall-operator
13091315
- Name: Egress Firewall
@@ -1479,8 +1485,6 @@ Topics:
14791485
File: rollback-to-openshift-sdn
14801486
- Name: Converting to IPv4/IPv6 dual stack networking
14811487
File: converting-to-dual-stack
1482-
- Name: Logging for egress firewall and network policy rules
1483-
File: logging-network-policy
14841488
- Name: Configure an external gateway on the default network
14851489
File: configuring-secondary-external-gateway
14861490
- Name: Configuring an egress IP address

‎_topic_maps/_topic_map_osd.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -837,8 +837,8 @@ Topics:
837837
Dir: openshift_network_security
838838
Distros: openshift-dedicated
839839
Topics:
840-
- Name: About OVN-Kubernetes network policy
841-
File: ovn-k-network-policy
840+
- Name: Understanding network policy APIs
841+
File: network-policy-apis
842842
- Name: Network policy
843843
Dir: network_policy
844844
Distros: openshift-dedicated

‎_topic_maps/_topic_map_rosa.yml

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1060,10 +1060,16 @@ Topics:
10601060
- Name: OpenShift network security
10611061
Dir: openshift_network_security
10621062
Topics:
1063-
- Name: About OVN-Kubernetes network policy
1064-
File: ovn-k-network-policy
1065-
- Name: AdminNetworkPolicy
1066-
File: ovn-k-anp
1063+
- Name: Understanding network policy APIs
1064+
File: network-policy-apis
1065+
- Name: Admin network policy
1066+
Dir: AdminNetworkPolicy
1067+
Distros: openshift-rosa
1068+
Topics:
1069+
- Name: About AdminNetworkPolicy
1070+
File: ovn-k-anp
1071+
- Name: About BaselineAdminNetworkPolicy
1072+
File: ovn-k-banp
10671073
- Name: Network policy
10681074
Dir: network_policy
10691075
Distros: openshift-rosa
@@ -1082,8 +1088,6 @@ Topics:
10821088
File: default-network-policy
10831089
- Name: Configuring multitenant isolation with network policy
10841090
File: multitenant-network-policy
1085-
- Name: BaselineAdminNetworkPolicy
1086-
File: ovn-k-banp
10871091
- Name: OVN-Kubernetes network plugin
10881092
Dir: ovn_kubernetes_network_provider
10891093
Topics:

‎modules/nw-anp-audit-logging-concept.adoc

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/openshift_network_security/AdminNetworkPolicy/logging-anp-policy.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="nw-anp-audit-logging_{context}"]
7+
= AdminNetworkPolicy audit logging
8+
9+
Audit logging is enabled per `AdminNetworkPolicy` CR by annotating an ANP policy with the `k8s.ovn.org/acl-logging` key such as in the following example:
10+
11+
.Example of annotation for `AdminNetworkPolicy` CR
12+
[%collapsible]
13+
====
14+
[source,yaml]
15+
----
16+
apiVersion: policy.networking.k8s.io/v1alpha1
17+
kind: AdminNetworkPolicy
18+
metadata:
19+
annotations:
20+
k8s.ovn.org/acl-logging: '{ "deny": "alert", "allow": "alert", "pass" : "warning" }'
21+
name: anp-tenant-log
22+
spec:
23+
priority: 5
24+
subject:
25+
namespaces:
26+
matchLabels:
27+
tenant: backend-storage # Selects all pods owned by storage tenant.
28+
ingress:
29+
- name: "allow-all-ingress-product-development-and-customer" # Product development and customer tenant ingress to backend storage.
30+
action: "Allow"
31+
from:
32+
- pods:
33+
namespaceSelector:
34+
matchExpressions:
35+
- key: tenant
36+
operator: In
37+
values:
38+
- product-development
39+
- customer
40+
podSelector: {}
41+
- name: "pass-all-ingress-product-security"
42+
action: "Pass"
43+
from:
44+
- namespaces:
45+
matchLabels:
46+
tenant: product-security
47+
- name: "deny-all-ingress" # Ingress to backend from all other pods in the cluster.
48+
action: "Deny"
49+
from:
50+
- namespaces: {}
51+
egress:
52+
- name: "allow-all-egress-product-development"
53+
action: "Allow"
54+
to:
55+
- pods:
56+
namespaceSelector:
57+
matchLabels:
58+
tenant: product-development
59+
podSelector: {}
60+
- name: "pass-egress-product-security"
61+
action: "Pass"
62+
to:
63+
- namespaces:
64+
matchLabels:
65+
tenant: product-security
66+
- name: "deny-all-egress" # Egress from backend denied to all other pods.
67+
action: "Deny"
68+
to:
69+
- namespaces: {}
70+
----
71+
====
72+
73+
Logs are generated whenever a specific OVN ACL is hit and meets the action criteria set in your logging annotation. For example, an event in which any of the namespaces with the label `tenant: product-development` accesses the namespaces with the label `tenant: backend-storage`, a log is generated.
74+
75+
76+
[NOTE]
77+
====
78+
ACL logging is limited to 60 characters. If your ANP `name` field is long, the rest of the log will be truncated.
79+
====
80+
81+
The following is a direction index for the examples log entries that follow:
82+
83+
[cols=".^4,.^6a",options="header"]
84+
|====
85+
|Direction|Rule
86+
87+
|Ingress
88+
|
89+
Rule0:: Allow from tenant `product-development` and `customer` to tenant `backend-storage`; Ingress0: `Allow`
90+
Rule1:: Pass from `product-security`to tenant `backend-storage`; Ingress1: `Pass`
91+
Rule2:: Deny ingress from all pods; Ingress2: `Deny`
92+
93+
|Egress
94+
|
95+
Rule0:: Allow to `product-development`; Egress0: `Allow`
96+
Rule1:: Pass to `product-security`; Egress1: `Pass`
97+
Rule2:: Deny egress to all other pods; Egress2: `Deny`
98+
99+
|====
100+
101+
.Example ACL log entry for `Allow` action of the `AdminNetworkPolicy` named `anp-tenant-log` with `Ingress:0` and `Egress:0`
102+
103+
[%collapsible]
104+
====
105+
[source,text]
106+
----
107+
2024-06-10T16:27:45.194Z|00052|acl_log(ovn_pinctrl0)|INFO|name="ANP:anp-tenant-log:Ingress:0", verdict=allow, severity=alert, direction=to-lport: tcp,vlan_tci=0x0000,dl_src=0a:58:0a:80:02:1a,dl_dst=0a:58:0a:80:02:19,nw_src=10.128.2.26,nw_dst=10.128.2.25,nw_tos=0,nw_ecn=0,nw_ttl=64,nw_frag=no,tp_src=57814,tp_dst=8080,tcp_flags=syn
108+
2024-06-10T16:28:23.130Z|00059|acl_log(ovn_pinctrl0)|INFO|name="ANP:anp-tenant-log:Ingress:0", verdict=allow, severity=alert, direction=to-lport: tcp,vlan_tci=0x0000,dl_src=0a:58:0a:80:02:18,dl_dst=0a:58:0a:80:02:19,nw_src=10.128.2.24,nw_dst=10.128.2.25,nw_tos=0,nw_ecn=0,nw_ttl=64,nw_frag=no,tp_src=38620,tp_dst=8080,tcp_flags=ack
109+
2024-06-10T16:28:38.293Z|00069|acl_log(ovn_pinctrl0)|INFO|name="ANP:anp-tenant-log:Egress:0", verdict=allow, severity=alert, direction=from-lport: tcp,vlan_tci=0x0000,dl_src=0a:58:0a:80:02:19,dl_dst=0a:58:0a:80:02:1a,nw_src=10.128.2.25,nw_dst=10.128.2.26,nw_tos=0,nw_ecn=0,nw_ttl=64,nw_frag=no,tp_src=47566,tp_dst=8080,tcp_flags=fin|ack=0,nw_ecn=0,nw_ttl=64,nw_frag=no,tp_src=55704,tp_dst=8080,tcp_flags=ack
110+
----
111+
====
112+
113+
.Example ACL log entry for `Pass` action of the `AdminNetworkPolicy` named `anp-tenant-log` with `Ingress:1` and `Egress:1`
114+
115+
[%collapsible]
116+
====
117+
[source,text]
118+
----
119+
2024-06-10T16:33:12.019Z|00075|acl_log(ovn_pinctrl0)|INFO|name="ANP:anp-tenant-log:Ingress:1", verdict=pass, severity=warning, direction=to-lport: tcp,vlan_tci=0x0000,dl_src=0a:58:0a:80:02:1b,dl_dst=0a:58:0a:80:02:19,nw_src=10.128.2.27,nw_dst=10.128.2.25,nw_tos=0,nw_ecn=0,nw_ttl=64,nw_frag=no,tp_src=37394,tp_dst=8080,tcp_flags=ack
120+
2024-06-10T16:35:04.209Z|00081|acl_log(ovn_pinctrl0)|INFO|name="ANP:anp-tenant-log:Egress:1", verdict=pass, severity=warning, direction=from-lport: tcp,vlan_tci=0x0000,dl_src=0a:58:0a:80:02:19,dl_dst=0a:58:0a:80:02:1b,nw_src=10.128.2.25,nw_dst=10.128.2.27,nw_tos=0,nw_ecn=0,nw_ttl=64,nw_frag=no,tp_src=34018,tp_dst=8080,tcp_flags=ack
121+
----
122+
====
123+
124+
.Example ACL log entry for `Deny` action of the `AdminNetworkPolicy` named `anp-tenant-log` with `Egress:2` and `Ingress2`
125+
126+
[%collapsible]
127+
====
128+
[source,text]
129+
----
130+
2024-06-10T16:43:05.287Z|00087|acl_log(ovn_pinctrl0)|INFO|name="ANP:anp-tenant-log:Egress:2", verdict=drop, severity=alert, direction=from-lport: tcp,vlan_tci=0x0000,dl_src=0a:58:0a:80:02:19,dl_dst=0a:58:0a:80:02:18,nw_src=10.128.2.25,nw_dst=10.128.2.24,nw_tos=0,nw_ecn=0,nw_ttl=64,nw_frag=no,tp_src=51598,tp_dst=8080,tcp_flags=syn
131+
2024-06-10T16:44:43.591Z|00090|acl_log(ovn_pinctrl0)|INFO|name="ANP:anp-tenant-log:Ingress:2", verdict=drop, severity=alert, direction=to-lport: tcp,vlan_tci=0x0000,dl_src=0a:58:0a:80:02:1c,dl_dst=0a:58:0a:80:02:19,nw_src=10.128.2.28,nw_dst=10.128.2.25,nw_tos=0,nw_ecn=0,nw_ttl=64,nw_frag=no,tp_src=33774,tp_dst=8080,tcp_flags=syn
132+
----
133+
====
134+
135+
The following table describes ANP annotation:
136+
137+
.Audit logging AdminNetworkPolicy annotation
138+
[cols=".^4,.^6a",options="header"]
139+
|====
140+
|Annotation|Value
141+
142+
|`k8s.ovn.org/acl-logging`
143+
|
144+
You must specify at least one of `Allow`, `Deny`, or `Pass` to enable audit logging for a namespace.
145+
146+
`Deny`:: Optional: Specify `alert`, `warning`, `notice`, `info`, or `debug`.
147+
`Allow`:: Optional: Specify `alert`, `warning`, `notice`, `info`, or `debug`.
148+
`Pass`:: Optional: Specify `alert`, `warning`, `notice`, `info`, or `debug`.
149+
|====
150+

‎modules/nw-anp-np-reference.adoc

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/openshift_network_security/logging-network-security.adoc
4+
5+
:_mod-docs-content-type: REFERENCE
6+
[id="nw-anp-differences-networkpolicy_{context}"]
7+
= Key differences between AdminNetworkPolicy and NetworkPolicy custom resources
8+
9+
The following table explains key differences between the cluster scoped `AdminNetworkPolicy` API and the namespace scoped `NetworkPolicy` API.
10+
11+
[cols="1,1,1"]
12+
|===
13+
|Policy elements | AdminNetworkPolicy | NetworkPolicy
14+
15+
|Applicable user
16+
|Cluster administrator or equivalent
17+
|Namespace owners
18+
19+
|Scope
20+
|Cluster
21+
|Namespaced
22+
23+
|Drop traffic
24+
|Supported with an explicit `Deny` action set as a rule.
25+
|Supported via implicit `Deny` isolation at policy creation time.
26+
27+
|Delegate traffic
28+
|Supported with an `Pass` action set as a rule.
29+
|Not applicable
30+
31+
|Allow traffic
32+
|Supported with an explicit `Allow` action set as a rule.
33+
|The default action for all rules is to allow.
34+
35+
|Rule precedence within the policy
36+
|Depends on the order in which they appear within an ANP. The higher the rule's position the higher the precedence.
37+
|Rules are additive
38+
39+
|Policy precedence
40+
|Among ANPs the `priority` field sets the order for evaluation. The lower the priority number higher the policy precedence.
41+
|There is no policy ordering between policies.
42+
43+
|Feature precedence
44+
|Evaluated first via tier 1 ACL and BANP is evaluated last via tier 3 ACL.
45+
|Enforced after ANP and before BANP, they are evaluated in tier 2 of the ACL.
46+
47+
|Matching pod selection
48+
|Can apply different rules across namespaces.
49+
|Can apply different rules across pods in single namespace.
50+
51+
|Cluster egress traffic
52+
|Supported via `nodes` and `networks` peers
53+
|Supported through `ipBlock` field along with accepted CIDR syntax.
54+
55+
|Cluster ingress traffic
56+
|Not supported
57+
|Not supported
58+
59+
|Fully qualified domain names (FQDN) peer support
60+
|Not supported
61+
|Not supported
62+
63+
|Namespace selectors
64+
|Supports advanced selection of Namespaces with the use of `namespaces.matchLabels` field
65+
|Supports label based namespace selection with the use of `namespaceSelector` field
66+
67+
|===

‎modules/nw-audit-configuration.adoc

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/openshift_network_security/logging-network-security.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="network-policy-audit-configuration-{context}"]
7+
= Audit configuration
8+
9+
The configuration for audit logging is specified as part of the OVN-Kubernetes cluster network provider configuration. The following YAML illustrates the default values for the audit logging:
10+
11+
.Audit logging configuration
12+
[source,yaml]
13+
----
14+
apiVersion: operator.openshift.io/v1
15+
kind: Network
16+
metadata:
17+
name: cluster
18+
spec:
19+
defaultNetwork:
20+
ovnKubernetesConfig:
21+
policyAuditConfig:
22+
destination: "null"
23+
maxFileSize: 50
24+
rateLimit: 20
25+
syslogFacility: local0
26+
----
27+
28+
The following table describes the configuration fields for audit logging.

0 commit comments

Comments
 (0)