New audit profiles AllRequestBodies and WriteRequestBodies generate log entries that are too big
Issue
- The new profiles
AllRequestBodiesandWriteRequestBodiesstore an huge amount of data in the audit logs. For a single request listing pods and returning ~30 instances:
$ oc get pods -n openshift-kube-apiserver
- A json content of 296KB was stored in the logs. As list commands happen all the time in a cluster (reconciliation loops) and thousands of requests per second may be processed in big clusters under load this may be a significant amount of storage that gets consumed very quickly.
- SIEM Consumers may also not be able to cope.
Environment
- Red Hat OpenShift Container Platform 4.6
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.