Collecting Kubernetes Audit Logs

You can view the logs of master nodes. On the Control Plane Audit Logs tab, you can select the audit component whose logs to be reported to LTS.

Constraints

Huawei Cloud clusters must be of v1.21.7-r0 or later, v1.23.5-r0 or later, or v1.25.
There is required LTS resource quota. For details about the default LTS quota, see Basic Resources.

Kubernetes Audit Logs

**Table 1** Kubernetes audit logs
Log Type	Component	Log Stream	Description
Control plane audit logs	audit	audit-{{clusterID}}	An audit log is a chronological record of user operations on Kubernetes APIs and control plane activities for security.

Enabling Log Collection for an On-Premises Cluster

The Cloud Native Log Collection add-on is not installed in a cluster.

When installing the Cloud Native Log Collection add-on, you can select control plane audit logs to create a default log collection policy, so that this add-on collects component logs and reports them to LTS. For details about the add-on installation, see Log Collection.

The Cloud Native Log Collection add-on has been installed in a cluster.

Access the fleet console. In the navigation pane, choose Container Clusters. Then, click the cluster name to access the cluster console. In the navigation pane, choose Logging.
In the upper right corner, click View Log Collection Policies. All log collection policies in the current cluster are displayed.
Click Create Log Policy and configure parameters as required.

Policy Template: If no collection policy is enabled for collecting control plane audit logs during add-on installation or the log collection policy is deleted, you can use this option to create a default log collection policy.
On the Logging page, click the Control Plane Audit Logs tab. Select the log stream configured in the log policy to view the logs reported to LTS.

Enabling Log Collection for a Huawei Cloud Cluster

Enabling log collection during cluster creation

Log in to the CCE console.
Click Buy Cluster from the top menu.
On the Add-on Configuration page, check the box of Enable logging for Control Plane Audit Logs.

Enabling log collection for an existing cluster

Access the fleet console. In the navigation pane, choose Container Clusters. Then, click the cluster name to access the cluster console. In the navigation pane, choose Logging.
Click the Control Plane Audit Logs tab, select the audit component, and click Enable.

Viewing Control Plane Audit Logs

Viewing control plane audit logs on the UCS console

Access the fleet console. In the navigation pane, choose Container Clusters. Then, click the cluster name to access the cluster console. In the navigation pane, choose Logging.
Click the Control Plane Audit Logs tab and select a component for which you want to enable audit logs. For details about operations on LTS, see LTS User Guide.

Viewing control plane audit logs on the TLS console

Log in to the LTS console and choose Log Management.
Query the log group by cluster ID and click the log group name to view the log stream. For details, see LTS User Guide.

Disabling Log Collection of a Huawei Cloud Cluster

Access the fleet console. In the navigation pane, choose Container Clusters. Then, click the cluster name to access the cluster console. In the navigation pane, choose Logging.
Click the Control Plane Audit Logs tab and click Configure Control Plane Audit Logs to modify the log settings.
Deselect audit and click OK.

After you disable control plane audit logging, logs are no longer written to the original log stream, but the existing logs will not be deleted and expenditures may be incurred for this.