Skip to content

Commit d77fbdb

Browse files
JoeAldingerJoeAldinger
committed
OSDOCS-10396:ANP audit logging
in-flight restructure of (B)ANP loggin fixing xrefs and removing the assembly file for (B)ANP adds example outputs
1 parent 5c65465 commit d77fbdb

24 files changed

+413
-68
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1277,10 +1277,16 @@ Topics:
12771277
Dir: openshift_network_security
12781278
Distros: openshift-enterprise,openshift-origin
12791279
Topics:
1280-
- Name: About OVN-Kubernetes network policy
1281-
File: ovn-k-network-policy
1282-
- Name: AdminNetworkPolicy
1283-
File: ovn-k-anp
1280+
- Name: Understanding network policy APIs
1281+
File: network-policy-apis
1282+
- Name: Admin network policy
1283+
Dir: AdminNetworkPolicy
1284+
Distros: openshift-enterprise, openshift-origin
1285+
Topics:
1286+
- Name: About AdminNetworkPolicy
1287+
File: ovn-k-anp
1288+
- Name: About BaselineAdminNetworkPolicy
1289+
File: ovn-k-banp
12841290
- Name: Network policy
12851291
Dir: network_policy
12861292
Distros: openshift-enterprise, openshift-origin
@@ -1299,8 +1305,8 @@ Topics:
12991305
File: default-network-policy
13001306
- Name: Configuring multitenant isolation with network policy
13011307
File: multitenant-network-policy
1302-
- Name: BaselineAdminNetworkPolicy
1303-
File: ovn-k-banp
1308+
- Name: Audit logging for network security
1309+
File: logging-network-security
13041310
- Name: Understanding the Ingress Node Firewall Operator
13051311
File: ingress-node-firewall-operator
13061312
- Name: Configuring an egress firewall for a project
@@ -1464,8 +1470,6 @@ Topics:
14641470
File: rollback-to-openshift-sdn
14651471
- Name: Converting to IPv4/IPv6 dual stack networking
14661472
File: converting-to-dual-stack
1467-
- Name: Logging for egress firewall and network policy rules
1468-
File: logging-network-policy
14691473
- Name: Configure an external gateway on the default network
14701474
File: configuring-secondary-external-gateway
14711475
- Name: Viewing an egress firewall for a project

‎_topic_maps/_topic_map_osd.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -775,8 +775,8 @@ Topics:
775775
Dir: openshift_network_security
776776
Distros: openshift-dedicated
777777
Topics:
778-
- Name: About OVN-Kubernetes network policy
779-
File: ovn-k-network-policy
778+
- Name: Understanding network policy APIs
779+
File: network-policy-apis
780780
- Name: Network policy
781781
Dir: network_policy
782782
Distros: openshift-dedicated

‎_topic_maps/_topic_map_rosa.yml

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1000,10 +1000,16 @@ Topics:
10001000
- Name: OpenShift network security
10011001
Dir: openshift_network_security
10021002
Topics:
1003-
- Name: About OVN-Kubernetes network policy
1004-
File: ovn-k-network-policy
1005-
- Name: AdminNetworkPolicy
1006-
File: ovn-k-anp
1003+
- Name: Understanding network policy APIs
1004+
File: network-policy-apis
1005+
- Name: Admin network policy
1006+
Dir: AdminNetworkPolicy
1007+
Distros: openshift-rosa
1008+
Topics:
1009+
- Name: About AdminNetworkPolicy
1010+
File: ovn-k-anp
1011+
- Name: About BaselineAdminNetworkPolicy
1012+
File: ovn-k-banp
10071013
- Name: Network policy
10081014
Dir: network_policy
10091015
Distros: openshift-rosa
@@ -1022,8 +1028,6 @@ Topics:
10221028
File: default-network-policy
10231029
- Name: Configuring multitenant isolation with network policy
10241030
File: multitenant-network-policy
1025-
- Name: BaselineAdminNetworkPolicy
1026-
File: ovn-k-banp
10271031
- Name: OVN-Kubernetes network plugin
10281032
Dir: ovn_kubernetes_network_provider
10291033
Topics:

‎modules/nw-anp-audit-logging-concept.adoc

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/openshift_network_security/AdminNetworkPolicy/logging-anp-policy.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="nw-anp-audit-logging_{context}"]
7+
= AdminNetworkPolicy audit logging
8+
9+
Audit logging is enabled per `AdminNetworkPolicy` CR by annotating an ANP policy with the `k8s.ovn.org/acl-logging` key such as in the following example:
10+
11+
.Example of annotation for `AdminNetworkPolicy` CR
12+
[%collapsible]
13+
====
14+
[source,yaml]
15+
----
16+
apiVersion: policy.networking.k8s.io/v1alpha1
17+
kind: AdminNetworkPolicy
18+
metadata:
19+
annotations:
20+
k8s.ovn.org/acl-logging: '{ "deny": "alert", "allow": "alert", "pass" : "warning" }'
21+
name: anp-tenant-log
22+
spec:
23+
priority: 5
24+
subject:
25+
namespaces:
26+
matchLabels:
27+
tenant: backend-storage # Selects all pods owned by storage tenant.
28+
ingress:
29+
- name: "allow-all-ingress-product-development-and-customer" # Product development and customer tenant ingress to backend storage.
30+
action: "Allow"
31+
from:
32+
- pods:
33+
namespaceSelector:
34+
matchExpressions:
35+
- key: tenant
36+
operator: In
37+
values:
38+
- product-development
39+
- customer
40+
podSelector: {}
41+
- name: "pass-all-ingress-product-security"
42+
action: "Pass"
43+
from:
44+
- namespaces:
45+
matchLabels:
46+
tenant: product-security
47+
- name: "deny-all-ingress" # Ingress to backend from all other pods in the cluster.
48+
action: "Deny"
49+
from:
50+
- namespaces: {}
51+
egress:
52+
- name: "allow-all-egress-product-development"
53+
action: "Allow"
54+
to:
55+
- pods:
56+
namespaceSelector:
57+
matchLabels:
58+
tenant: product-development
59+
podSelector: {}
60+
- name: "pass-egress-product-security"
61+
action: "Pass"
62+
to:
63+
- namespaces:
64+
matchLabels:
65+
tenant: product-security
66+
- name: "deny-all-egress" # Egress from backend denied to all other pods.
67+
action: "Deny"
68+
to:
69+
- namespaces: {}
70+
----
71+
====
72+
73+
Logs are generated whenever a specific OVN ACL is hit and meets the action criteria set in your logging annotation. For example, an event in which any of the namespaces with the label `tenant: product-development` accesses the namespaces with the label `tenant: backend-storage`, a log is generated.
74+
75+
76+
[NOTE]
77+
====
78+
ACL logging is limited to 60 characters. If your ANP `name` field is long, the rest of the log will be truncated.
79+
====
80+
81+
The following is a direction index for the examples log entries that follow:
82+
83+
[cols=".^4,.^6a",options="header"]
84+
|====
85+
|Direction|Rule
86+
87+
|Ingress
88+
|
89+
Rule0:: Allow from tenant `product-development` and `customer` to tenant `backend-storage`; Ingress0: `Allow`
90+
Rule1:: Pass from `product-security`to tenant `backend-storage`; Ingress1: `Pass`
91+
Rule2:: Deny ingress from all pods; Ingress2: `Deny`
92+
93+
|Egress
94+
|
95+
Rule0:: Allow to `product-development`; Egress0: `Allow`
96+
Rule1:: Pass to `product-security`; Egress1: `Pass`
97+
Rule2:: Deny egress to all other pods; Egress2: `Deny`
98+
99+
|====
100+
101+
.Example ACL log entry for `Allow` action of the `AdminNetworkPolicy` named `anp-tenant-log` with `Ingress:0` and `Egress:0`
102+
103+
[%collapsible]
104+
====
105+
[source,text]
106+
----
107+
2024-06-10T16:27:45.194Z|00052|acl_log(ovn_pinctrl0)|INFO|name="ANP:anp-tenant-log:Ingress:0", verdict=allow, severity=alert, direction=to-lport: tcp,vlan_tci=0x0000,dl_src=0a:58:0a:80:02:1a,dl_dst=0a:58:0a:80:02:19,nw_src=10.128.2.26,nw_dst=10.128.2.25,nw_tos=0,nw_ecn=0,nw_ttl=64,nw_frag=no,tp_src=57814,tp_dst=8080,tcp_flags=syn
108+
2024-06-10T16:28:23.130Z|00059|acl_log(ovn_pinctrl0)|INFO|name="ANP:anp-tenant-log:Ingress:0", verdict=allow, severity=alert, direction=to-lport: tcp,vlan_tci=0x0000,dl_src=0a:58:0a:80:02:18,dl_dst=0a:58:0a:80:02:19,nw_src=10.128.2.24,nw_dst=10.128.2.25,nw_tos=0,nw_ecn=0,nw_ttl=64,nw_frag=no,tp_src=38620,tp_dst=8080,tcp_flags=ack
109+
2024-06-10T16:28:38.293Z|00069|acl_log(ovn_pinctrl0)|INFO|name="ANP:anp-tenant-log:Egress:0", verdict=allow, severity=alert, direction=from-lport: tcp,vlan_tci=0x0000,dl_src=0a:58:0a:80:02:19,dl_dst=0a:58:0a:80:02:1a,nw_src=10.128.2.25,nw_dst=10.128.2.26,nw_tos=0,nw_ecn=0,nw_ttl=64,nw_frag=no,tp_src=47566,tp_dst=8080,tcp_flags=fin|ack=0,nw_ecn=0,nw_ttl=64,nw_frag=no,tp_src=55704,tp_dst=8080,tcp_flags=ack
110+
----
111+
====
112+
113+
.Example ACL log entry for `Pass` action of the `AdminNetworkPolicy` named `anp-tenant-log` with `Ingress:1` and `Egress:1`
114+
115+
[%collapsible]
116+
====
117+
[source,text]
118+
----
119+
2024-06-10T16:33:12.019Z|00075|acl_log(ovn_pinctrl0)|INFO|name="ANP:anp-tenant-log:Ingress:1", verdict=pass, severity=warning, direction=to-lport: tcp,vlan_tci=0x0000,dl_src=0a:58:0a:80:02:1b,dl_dst=0a:58:0a:80:02:19,nw_src=10.128.2.27,nw_dst=10.128.2.25,nw_tos=0,nw_ecn=0,nw_ttl=64,nw_frag=no,tp_src=37394,tp_dst=8080,tcp_flags=ack
120+
2024-06-10T16:35:04.209Z|00081|acl_log(ovn_pinctrl0)|INFO|name="ANP:anp-tenant-log:Egress:1", verdict=pass, severity=warning, direction=from-lport: tcp,vlan_tci=0x0000,dl_src=0a:58:0a:80:02:19,dl_dst=0a:58:0a:80:02:1b,nw_src=10.128.2.25,nw_dst=10.128.2.27,nw_tos=0,nw_ecn=0,nw_ttl=64,nw_frag=no,tp_src=34018,tp_dst=8080,tcp_flags=ack
121+
----
122+
====
123+
124+
.Example ACL log entry for `Deny` action of the `AdminNetworkPolicy` named `anp-tenant-log` with `Egress:2` and `Ingress2`
125+
126+
[%collapsible]
127+
====
128+
[source,text]
129+
----
130+
2024-06-10T16:43:05.287Z|00087|acl_log(ovn_pinctrl0)|INFO|name="ANP:anp-tenant-log:Egress:2", verdict=drop, severity=alert, direction=from-lport: tcp,vlan_tci=0x0000,dl_src=0a:58:0a:80:02:19,dl_dst=0a:58:0a:80:02:18,nw_src=10.128.2.25,nw_dst=10.128.2.24,nw_tos=0,nw_ecn=0,nw_ttl=64,nw_frag=no,tp_src=51598,tp_dst=8080,tcp_flags=syn
131+
2024-06-10T16:44:43.591Z|00090|acl_log(ovn_pinctrl0)|INFO|name="ANP:anp-tenant-log:Ingress:2", verdict=drop, severity=alert, direction=to-lport: tcp,vlan_tci=0x0000,dl_src=0a:58:0a:80:02:1c,dl_dst=0a:58:0a:80:02:19,nw_src=10.128.2.28,nw_dst=10.128.2.25,nw_tos=0,nw_ecn=0,nw_ttl=64,nw_frag=no,tp_src=33774,tp_dst=8080,tcp_flags=syn
132+
----
133+
====
134+
135+
The following table describes ANP annotation:
136+
137+
.Audit logging AdminNetworkPolicy annotation
138+
[cols=".^4,.^6a",options="header"]
139+
|====
140+
|Annotation|Value
141+
142+
|`k8s.ovn.org/acl-logging`
143+
|
144+
You must specify at least one of `Allow`, `Deny`, or `Pass` to enable audit logging for a namespace.
145+
146+
`Deny`:: Optional: Specify `alert`, `warning`, `notice`, `info`, or `debug`.
147+
`Allow`:: Optional: Specify `alert`, `warning`, `notice`, `info`, or `debug`.
148+
`Pass`:: Optional: Specify `alert`, `warning`, `notice`, `info`, or `debug`.
149+
|====
150+

‎modules/nw-anp-np-reference.adoc

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/openshift_network_security/logging-network-security.adoc
4+
5+
:_mod-docs-content-type: REFERENCE
6+
[id="nw-anp-differences-networkpolicy_{context}"]
7+
= Key differences between AdminNetworkPolicy and NetworkPolicy custom resources
8+
9+
The following table explains key differences between the cluster scoped `AdminNetworkPolicy` API and the namespace scoped `NetworkPolicy` API.
10+
11+
[cols="1,1,1"]
12+
|===
13+
|Policy elements | AdminNetworkPolicy | NetworkPolicy
14+
15+
|Applicable user
16+
|Cluster administrator or equivalent
17+
|Namespace owners
18+
19+
|Scope
20+
|Cluster
21+
|Namespaced
22+
23+
|Drop traffic
24+
|Supported with an explicit `Deny` action set as a rule.
25+
|Supported via implicit `Deny` isolation at policy creation time.
26+
27+
|Delegate traffic
28+
|Supported with an `Pass` action set as a rule.
29+
|Not applicable
30+
31+
|Allow traffic
32+
|Supported with an explicit `Allow` action set as a rule.
33+
|The default action for all rules is to allow.
34+
35+
|Rule precedence within the policy
36+
|Depends on the order in which they appear within an ANP. The higher the rule's position the higher the precedence.
37+
|Rules are additive
38+
39+
|Policy precedence
40+
|Among ANPs the `priority` field sets the order for evaluation. The lower the priority number higher the policy precedence.
41+
|There is no policy ordering between policies.
42+
43+
|Feature precedence
44+
|Evaluated first via tier 1 ACL and BANP is evaluated last via tier 3 ACL.
45+
|Enforced after ANP and before BANP, they are evaluated in tier 2 of the ACL.
46+
47+
|Matching pod selection
48+
|Can apply different rules across namespaces.
49+
|Can apply different rules across pods in single namespace.
50+
51+
|Cluster egress traffic
52+
|Supported via `nodes` and `networks` peers
53+
|Supported through `ipBlock` field along with accepted CIDR syntax.
54+
55+
|Cluster ingress traffic
56+
|Not supported
57+
|Not supported
58+
59+
|Fully qualified domain names (FQDN) peer support
60+
|Not supported
61+
|Not supported
62+
63+
|Namespace selectors
64+
|Supports advanced selection of Namespaces with the use of `namespaces.matchLabels` field
65+
|Supports label based namespace selection with the use of `namespaceSelector` field
66+
67+
|===

‎modules/nw-audit-configuration.adoc

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/openshift_network_security/logging-network-security.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="network-policy-audit-configuration-{context}"]
7+
= Audit configuration
8+
9+
The configuration for audit logging is specified as part of the OVN-Kubernetes cluster network provider configuration. The following YAML illustrates the default values for the audit logging:
10+
11+
.Audit logging configuration
12+
[source,yaml]
13+
----
14+
apiVersion: operator.openshift.io/v1
15+
kind: Network
16+
metadata:
17+
name: cluster
18+
spec:
19+
defaultNetwork:
20+
ovnKubernetesConfig:
21+
policyAuditConfig:
22+
destination: "null"
23+
maxFileSize: 50
24+
rateLimit: 20
25+
syslogFacility: local0
26+
----
27+
28+
The following table describes the configuration fields for audit logging.

0 commit comments

Comments
 (0)