kubernetes
/
website
mirror of https://github.com/kubernetes/website.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Document log sanitization feature (#24845) 

* Document log sanitization feature

* Fill in log sanitization documentation

* Update content/en/docs/concepts/cluster-administration/system-logs.md

Co-authored-by: Marek Siarkowicz <marek.siarkowicz@protonmail.com>

Co-authored-by: Rob Franken <rfranken@google.com>
Co-authored-by: Rob Franken <rob@rob-franken.nl>
This commit is contained in:
Marek Siarkowicz 2020-11-24 08:49:00 +01:00 committed by GitHub
parent 6616a8359e
commit d7a3f5d409
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
content/en/docs/concepts/cluster-administration/system-logs.md
View File

@ -91,6 +91,27 @@ List of components currently supporting JSON format:
* {{< glossary_tooltip term_id="kube-scheduler" text="kube-scheduler" >}}
* {{< glossary_tooltip term_id="kubelet" text="kubelet" >}}
### Log sanitization
{{< feature-state for_k8s_version="v1.20" state="alpha" >}}
{{<warning >}}
Log sanitization might incur significant computation overhead and therefore should not be enabled in production.
{{< /warning >}}
The `--experimental-logging-sanitization` controls if a sanitization filter will be installed in klog.
If enabled all log arguments are inspected for fields tagged as sensitive data (e.g. passwords, keys, tokens) and logging of these fields will be prevented.
List of components currently supporting log sanitization:
* {{< glossary_tooltip term_id="kube-controller-manager" text="kube-controller-manager" >}}
* {{< glossary_tooltip term_id="kube-apiserver" text="kube-apiserver" >}}
* {{< glossary_tooltip term_id="kube-scheduler" text="kube-scheduler" >}}
* {{< glossary_tooltip term_id="kubelet" text="kubelet" >}}
{{< note >}}
This is not interacting with user workload logs, so it won't prevent users workloads from leaking sensitive data.
{{< /note >}}
### Log verbosity level
The `-v` flag controls log verbosity. Increasing the value increases the number of logged events. Decreasing the value decreases the number of logged events.