documentation_complete: true


title: 'Configure the Audit Log Path'

{{% set default_jqfilter = '.data."config.yaml" | fromjson' %}}
{{% set default_api_path = '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config' %}}
{{% set hypershift_path = '/api/v1/namespaces/{{.hypershift_namespace_prefix}}-{{.hypershift_cluster}}/configmaps/kas-config' %}}
{{% set hypershift_jqfilter = '.data."config.json" | fromjson' %}}
{{% set custom_api_path = '{{if ne .hypershift_cluster "None"}}' ~ hypershift_path ~ '{{else}}' ~  default_api_path ~ '{{end}}' %}}
{{% set custom_jqfilter = '{{if ne .hypershift_cluster "None"}}' ~ hypershift_jqfilter ~ '{{else}}' ~  default_jqfilter ~ '{{end}}' %}}
{{% set dump_path = default_api_path ~ ',' ~ default_jqfilter ~ ',' ~ custom_jqfilter %}}

description: |-
    To enable auditing on the Kubernetes API Server, the audit log path must be set.
    Edit the <tt>openshift-kube-apiserver</tt> configmap
    and set the <tt>audit-log-path</tt> to a suitable path and file
    where audit logs should be written. For example:
    <pre>
    "apiServerArguments":{
      ...
      "audit-log-path":"/var/log/kube-apiserver/audit.log",
      ...
    </pre>

rationale: |-
    Auditing of the Kubernetes API Server is not enabled by default. Auditing the API Server
    provides a security-relevant chronological set of records documenting the sequence
    of activities that have affected the system by users, administrators, or other
    system components.

identifiers:
  cce@ocp4: CCE-84020-7


severity: high

references:
    cis@ocp4: 1.2.20
    nerc-cip: CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R6.1
    nist: CM-6,CM-6(1)
    pcidss: Req-2.2
    srg: SRG-APP-000516-CTR-001325

platform: not ocp4-on-hypershift-hosted

ocil_clause: '<tt>audit-log-path</tt> does not contain a valid audit file path'

ocil: |-
    Run the following command:
    <pre>$ oc get configmap config -n openshift-kube-apiserver -ojson | jq -r '.data["config.yaml"]' | jq '.apiServerArguments["audit-log-path"]'</pre>
    The output should return a valid audit log path.

warnings:
    - general: |-
        {{{ openshift_filtered_cluster_setting({custom_api_path: dump_path}) | indent(8) }}}

template:
    name: yamlfile_value
    vars:
        ocp_data: "true"
        filepath: {{{ openshift_filtered_path(default_api_path, default_jqfilter) }}}
        yamlpath: '.apiServerArguments["audit-log-path"][:]'
        entity_check: "at least one"
        values:
            - value: '.+'
              type: "string"
              operation: "pattern match"
              entity_check: "at least one"
