Skip to content
Projects
Groups
Snippets
Help
This project
Loading...
Sign in / Register
Toggle navigation
K
k3s
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Registry
Registry
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Jacklull
k3s
Commits
25926056
Commit
25926056
authored
Sep 28, 2017
by
Mik Vyatskov
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Fix basic audit in GCE deploy scripts
Signed-off-by:
Mik Vyatskov
<
vmik@google.com
>
parent
208ae55f
Hide whitespace changes
Inline
Side-by-side
Showing
3 changed files
with
14 additions
and
0 deletions
+14
-0
config-default.sh
cluster/gce/config-default.sh
+4
-0
config-test.sh
cluster/gce/config-test.sh
+4
-0
configure-helper.sh
cluster/gce/gci/configure-helper.sh
+6
-0
No files found.
cluster/gce/config-default.sh
View file @
25926056
...
@@ -293,6 +293,10 @@ METADATA_CLOBBERS_CONFIG="${METADATA_CLOBBERS_CONFIG:-false}"
...
@@ -293,6 +293,10 @@ METADATA_CLOBBERS_CONFIG="${METADATA_CLOBBERS_CONFIG:-false}"
ENABLE_BIG_CLUSTER_SUBNETS
=
"
${
ENABLE_BIG_CLUSTER_SUBNETS
:-
false
}
"
ENABLE_BIG_CLUSTER_SUBNETS
=
"
${
ENABLE_BIG_CLUSTER_SUBNETS
:-
false
}
"
if
[[
"
${
ENABLE_APISERVER_BASIC_AUDIT
:-}
"
==
"true"
]]
;
then
echo
"Warning: Basic audit logging is deprecated and will be removed. Please use advanced auditing instead."
fi
if
[[
-n
"
${
LOGROTATE_FILES_MAX_COUNT
:-}
"
]]
;
then
if
[[
-n
"
${
LOGROTATE_FILES_MAX_COUNT
:-}
"
]]
;
then
PROVIDER_VARS
=
"
${
PROVIDER_VARS
:-}
LOGROTATE_FILES_MAX_COUNT"
PROVIDER_VARS
=
"
${
PROVIDER_VARS
:-}
LOGROTATE_FILES_MAX_COUNT"
fi
fi
...
...
cluster/gce/config-test.sh
View file @
25926056
...
@@ -345,6 +345,10 @@ if [[ "${ENABLE_APISERVER_ADVANCED_AUDIT}" == "true" ]]; then
...
@@ -345,6 +345,10 @@ if [[ "${ENABLE_APISERVER_ADVANCED_AUDIT}" == "true" ]]; then
FEATURE_GATES
=
"
${
FEATURE_GATES
}
,AdvancedAuditing=true"
FEATURE_GATES
=
"
${
FEATURE_GATES
}
,AdvancedAuditing=true"
fi
fi
if
[[
"
${
ENABLE_APISERVER_BASIC_AUDIT
:-}
"
==
"true"
]]
;
then
echo
"Warning: Basic audit logging is deprecated and will be removed. Please use advanced auditing instead."
fi
ENABLE_BIG_CLUSTER_SUBNETS
=
"
${
ENABLE_BIG_CLUSTER_SUBNETS
:-
false
}
"
ENABLE_BIG_CLUSTER_SUBNETS
=
"
${
ENABLE_BIG_CLUSTER_SUBNETS
:-
false
}
"
if
[[
-n
"
${
LOGROTATE_FILES_MAX_COUNT
:-}
"
]]
;
then
if
[[
-n
"
${
LOGROTATE_FILES_MAX_COUNT
:-}
"
]]
;
then
...
...
cluster/gce/gci/configure-helper.sh
View file @
25926056
...
@@ -1365,6 +1365,12 @@ function start-kube-apiserver {
...
@@ -1365,6 +1365,12 @@ function start-kube-apiserver {
# grows at 10MiB/s (~30K QPS), it will rotate after ~6 years if apiserver
# grows at 10MiB/s (~30K QPS), it will rotate after ~6 years if apiserver
# never restarts. Please manually restart apiserver before this time.
# never restarts. Please manually restart apiserver before this time.
params+
=
" --audit-log-maxsize=2000000000"
params+
=
" --audit-log-maxsize=2000000000"
# Disable AdvancedAuditing enabled by default
if
[[
-z
"
${
FEATURE_GATES
:-}
"
]]
;
then
FEATURE_GATES
=
"AdvancedAuditing=false"
else
FEATURE_GATES
=
"
${
FEATURE_GATES
}
,AdvancedAuditing=false"
fi
elif
[[
"
${
ENABLE_APISERVER_ADVANCED_AUDIT
:-}
"
==
"true"
]]
;
then
elif
[[
"
${
ENABLE_APISERVER_ADVANCED_AUDIT
:-}
"
==
"true"
]]
;
then
local
-r
audit_policy_file
=
"/etc/audit_policy.config"
local
-r
audit_policy_file
=
"/etc/audit_policy.config"
params+
=
" --audit-policy-file=
${
audit_policy_file
}
"
params+
=
" --audit-policy-file=
${
audit_policy_file
}
"
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment