設定 Openshift audit log 透過 openshift-logging 拋轉到 Elasticsearch

1. 先決條件

• 已在 openshift 叢集中安裝好以下工具
  • Elasticsearch + Kibana
  • Openshift logging operator

2. 開始設定

1. 幫 log collector 建立 service account

   oc create sa logging-collector -n openshift-logging

2. 請將必要的權限指派給服務帳號，以便 collector 能夠收集並轉發日誌。在此範例中，收集器將被授予權限，以同時收集來自基礎架構、應用程式和審計的日誌。

   oc adm policy add-cluster-role-to-user logging-collector-logs-writer -z logging-collector -n openshift-logging
   oc adm policy add-cluster-role-to-user collect-application-logs -z logging-collector -n openshift-logging
   oc adm policy add-cluster-role-to-user collect-infrastructure-logs -z logging-collector -n openshift-logging
   oc adm policy add-cluster-role-to-user collect-audit-logs -z logging-collector -n openshift-logging

3. 建立 elasticsearch tls secret

   oc -n elastic get secret elasticsearch-es-http-certs-internal -o json | \
     jq 'del(.metadata.namespace, .metadata.uid, .metadata.resourceVersion, .metadata.creationTimestamp, .metadata.managedFields, .metadata.ownerReferences, .metadata.annotations."kubectl.kubernetes.io/last-applied-configuration")' | \
     oc -n openshift-logging create -f -

4. 打開瀏覽器連線並登入 kibana 網站

   oc -n elastic get route

   執行結果如下：

   NAME                   HOST/PORT                                              PATH   SERVICES                PORT    TERMINATION            WILDCARD
   elasticsearch-sample   elasticsearch-sample-elastic.apps.topgun.example.com          elasticsearch-es-http   <all>   passthrough/Redirect   None
   kibana-sample          kibana-sample-elastic.apps.topgun.example.com                 kibana-kb-http          <all>   passthrough/Redirect   None

   我的範例是：kibana-sample-elastic.apps.topgun.example.com

5. 在 左側選單 -> Management/Dev tools，執行以下語法，建立一個名為 openshift_log_forwarder 的角色，這個角色只對 app-*, infra-*, audit-* 這些 OpenShift 常用的索引名稱開頭的索引有寫入權限。

   PUT /_security/role/openshift_log_forwarder
   {
     "cluster": [
       "monitor",
       "manage_index_templates"
     ],
     "indices": [
       {
         "names": [
           "app-*",
           "infra-*",
           "audit-*"
         ],
         "privileges": [
           "write",
           "create_index"
         ],
         "allow_restricted_indices": false
       }
     ]
   }

6. 在 左側選單 -> Management/Stack Management -> Security/Users -> Create user，建立一個使用者 (例如 ocp-forwarder-user)，並將剛才建立的角色 openshift_log_forwarder 指派給它。

   

7. 設定帳號資訊

   • Username: ocp-forwarder-user
   • Full name: ocp-forwarder-user
   • Password: password
   • Confirm password: password
   • Roles: 將下拉選單展開選擇剛剛自建的 openshift_log_forwarder role

   

8. 建立 elasticsearch user secret yaml 檔

   cat <<EOF > es-userinfo.yaml
   apiVersion: v1
   kind: Secret
   metadata:
     name: elasticsearch-user
     namespace: openshift-logging
   type: Opaque
   stringData:
     username: ocp-forwarder-user
     password: password
   EOF

9. 建立 secret

   oc apply -f es-userinfo.yaml

10. 建立 ClusterLogForwarder CR YAML 檔

    cat <<EOF > clf_elasticsearch.yaml
    apiVersion: observability.openshift.io/v1
    kind: ClusterLogForwarder
    metadata:
      name: collector
      namespace: openshift-logging
    spec:
      managementState: Managed
      outputs:
      - name: audit-elasticsearch
        type: elasticsearch
        elasticsearch:
          url: https://elasticsearch-es-http.elastic.svc.cluster.local:9200
          version: 8
          index: audit-write
          authentication:
            username:
              key: username
              secretName: elasticsearch-user
            password:
              key: password
              secretName: elasticsearch-user
        tls:
          insecureSkipVerify: true
      pipelines:
      - name: audit
        inputRefs:
        - audit
        outputRefs:
        - audit-elasticsearch
      serviceAccount:
        name: logging-collector
    EOF

11. 建立 ClusterLogForwarder

    oc apply -f clf_elasticsearch.yaml

12. 確認 pod 狀態

    oc get pods

    正確執行結果：

    NAME                                        READY   STATUS    RESTARTS   AGE
    cluster-logging-operator-86bf5bc9b6-b27wh   1/1     Running   0          127m
    collector-5qvt4                             1/1     Running   0          26m
    collector-6vpxt                             1/1     Running   0          26m
    collector-hnzhm                             1/1     Running   0          26m
    collector-s8z9g                             1/1     Running   0          26m
    collector-tz2lm                             1/1     Running   0          26m
    collector-x5l5t                             1/1     Running   0          26m

13. 檢視 collector pod log 是否有異常

    oc logs collector-x5l5t

    正確執行結果：

    Creating the directory used for persisting Vector state /var/lib/vector/openshift-logging/collector
    Starting Vector process...
    2025-09-12T09:02:20.158032Z  WARN sink{component_kind="sink" component_id=output_audit_elasticsearch component_type=elasticsearch}: vector_core::tls::settings: The `verify_certificate` option is DISABLED, this may lead to security vulnerabilities.
    2025-09-12T09:02:20.158081Z  WARN sink{component_kind="sink" component_id=output_audit_elasticsearch component_type=elasticsearch}: vector_core::tls::settings: The `verify_hostname` option is DISABLED, this may lead to security vulnerabilities.
    2025-09-12T09:02:20.287291Z  WARN vector::internal_events::file::source: Currently ignoring file too small to fingerprint. file=/var/log/ovn/acl-audit-log.log

14. Lab 內部測試可把資料副本調成 1

    在 左側選單 -> Management/Dev tools，執行以下語法

    PUT /your-index-name/_settings
    {
      "index": {
        "number_of_replicas": 0
      }
    }

15. 打開瀏覽器連到 Kibana UI 檢視是否有收到 log