You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: modules/nw-networkpolicy-audit-concept.adoc
+65-9Lines changed: 65 additions & 9 deletions
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,14 @@
9
9
You can configure the destination for audit logs, such as a syslog server or a UNIX domain socket.
10
10
Regardless of any additional configuration, an audit log is always saved to `/var/log/ovn/acl-audit-log.log` on each OVN-Kubernetes pod in the cluster.
11
11
12
-
Audit logging is enabled per namespace by annotating the namespace with the `k8s.ovn.org/acl-logging` key as in the following example:
12
+
You can enable audit logging for each namespace by annotating each namespace configuration with a `k8s.ovn.org/acl-logging` section. In the `k8s.ovn.org/acl-logging` section, you must specify `allow`, `deny`, or both values to enable audit logging for a namespace.
13
+
14
+
[NOTE]
15
+
====
16
+
A network policy does not support setting the `Pass` action set as a rule.
17
+
====
18
+
19
+
The ACL-logging implementation logs access control list (ACL) events for a network. You can view these logs to analyze any potential security issues.
13
20
14
21
.Example namespace annotation
15
22
[source,yaml]
@@ -26,7 +33,55 @@ metadata:
26
33
}
27
34
----
28
35
29
-
The logging format is compatible with syslog as defined by RFC5424. The syslog facility is configurable and defaults to `local0`. An example log entry might resemble the following:
36
+
To view the default ACL logging configuration values, see the `policyAuditConfig` object in the `cluster-network-03-config.yml` file. If required, you can change the ACL logging configuration values for log file parameters in this file.
37
+
38
+
The logging message format is compatible with syslog as defined by RFC5424. The syslog facility is configurable and defaults to `local0`. The following example shows key parameters and their values outputted in a log message:
39
+
40
+
.Example logging message that outputs parameters and their values
* `<timestamp>` states the time and date for the creation of a log message.
49
+
* `<message_serial>` lists the serial number for a log message.
50
+
* `acl_log(ovn_pinctrl0)` is a literal string that prints the location of the log message in the OVN-Kubernetes plugin.
51
+
* `<severity>` sets the severity level for a log message. If you enable audit logging that supports `allow` and `deny` tasks then two severity levels show in the log message output.
52
+
* `<name>` states the name of the ACL-logging implementation in the OVN Network Bridging Database (`nbdb`) that was created by the network policy.
53
+
* `<verdict>` can be either `allow` or `drop`.
54
+
* `<direction>` can be either `to-lport` or `from-lport` to indicate that the policy was applied to traffic going to or away from a pod.
55
+
* `<flow>` shows packet information in a format equivalent to the `OpenFlow` protocol. This parameter comprises Open vSwitch (OVS) fields.
56
+
57
+
The following example shows OVS fields that the `flow` parameter uses to extract packet information from system memory:
58
+
59
+
.Example of OVS fields used by the `flow` parameter to extract packet information
* `<proto>` states the protocol. Valid values are `tcp` and `udp`.
68
+
* `vlan_tci=0x0000` states the VLAN header as `0` because a VLAN ID is not set for internal pod network traffic.
69
+
* `<src_mac>` specifies the source for the Media Access Control (MAC) address.
70
+
* `<source_mac>` specifies the destination for the MAC address.
71
+
* `<source_ip>` lists the source IP address
72
+
* `<target_ip>` lists the target IP address.
73
+
* `<tos_dscp>` states Differentiated Services Code Point (DSCP) values to classify and prioritize certain network traffic over other traffic.
74
+
* `<tos_ecn>` states Explicit Congestion Notification (ECN) values that indicate any congested traffic in your network.
75
+
* `<ip_ttl>` states the Time To Live (TTP) information for an packet.
76
+
* `<fragment>` specifies what type of IP fragments or IP non-fragments to match.
77
+
* `<tcp_src_port>` shows the source for the port for TCP and UDP protocols.
78
+
* `<tcp_dst_port>` lists the destination port for TCP and UDP protocols.
79
+
* `<tcp_flags>` supports numerous flags such as `SYN`, `ACK`, `PSH` and so on. If you need to set multiple values then each value is separated by a vertical bar (`|`). The UDP protocol does not support this parameter.
80
+
81
+
[NOTE]
82
+
====
83
+
For more information about the previous field descriptions, go to the OVS manual page for `ovs-fields`.
84
+
====
30
85
31
86
.Example ACL deny log entry for a network policy
32
87
[source,text]
@@ -38,16 +93,17 @@ The logging format is compatible with syslog as defined by RFC5424. The syslog f
38
93
39
94
The following table describes namespace annotation values:
40
95
41
-
.Audit logging namespace annotation
96
+
.Audit logging namespace annotation for `k8s.ovn.org/acl-logging`
42
97
[cols=".^4,.^6a",options="header"]
43
98
|====
44
-
|Annotation|Value
99
+
|Field|Description
45
100
46
-
|`k8s.ovn.org/acl-logging`
47
-
|
48
-
You must specify at least one of `allow`, `deny`, or both to enable audit logging for a namespace.
101
+
|`deny`
102
+
|Blocks namespace access to any traffic that matches an ACL rule with the `deny` action. The field supports `alert`, `warning`, `notice`, `info`, or `debug` values.
49
103
50
-
`deny`:: Optional: Specify `alert`, `warning`, `notice`, `info`, or `debug`.
51
-
`allow`:: Optional: Specify `alert`, `warning`, `notice`, `info`, or `debug`.
104
+
|`allow`
105
+
|Permits namespace access to any traffic that matches an ACL rule with the `allow` action. The field supports `alert`, `warning`, `notice`, `info`, or `debug` values.
52
106
107
+
|`pass`
108
+
|A `pass` action applies to an admin network policy's ACL rule. A `pass` action allows either the network policy in the namespace or the baseline admin network policy rule to evaluate all incoming and outgoing traffic. A network policy does not support a `pass` action.
0 commit comments