Description

Ensure the Kubernetes API server audit logs of each Managed Kubernetes cluster are forwarded to a Logs Data Platform data stream, so every request to the cluster API is recorded and can be searched.

Rationale

Audit logs show who accessed or changed the cluster, such as creating pods, reading secrets, or changing RBAC. Without them, it is very hard to detect misuse or investigate an incident. Forwarding them to Logs Data Platform keeps a searchable record for security and compliance.

Impact

  • Every API request to the cluster is recorded

  • Supports investigations and alerts

  • Logs Data Platform storage is billed

Default Value

By default, Kubernetes audit logs are not forwarded.

Pre-Requisites

  • Permission to manage the Kubernetes cluster

  • A Logs Data Platform account with an active data stream

Test Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the left-hand menu, select Managed Kubernetes Service, then click the cluster name to open it.

  4. Open the cluster's Audit Logs tab and check the subscription panel for an active subscription to a data stream.

  5. If no subscription exists, follow the implementation steps.

Implementation Steps

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In Identity, Security & Operations, select Logs Data Platform, open your LDP account, go to the Data stream tab, and click Copy stream ID on the target stream.

  3. In the left-hand menu, select Public Cloud and choose your project.

  4. In the left-hand menu, select Managed Kubernetes Service, then click the cluster name to open it.

  5. Open the Audit Logs tab and, in the subscription panel, select your Logs Data Platform account and click Subscribe on the target data stream.

  6. Confirm that audit logs appear in the data stream.

Backout Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the left-hand menu, select Managed Kubernetes Service, then click the cluster name to open it.

  4. Open the Audit Logs tab and click Unsubscribe on the data stream.

Reference