Bug 1879492

Summary: 4.5: Post-Freeze 4.6 Feature Exception: Allow login audit logs for clusters with safe oauth storage
Product: OpenShift Container Platform Reporter: Stefan Schimanski <sttts>
Component: oauth-apiserverAssignee: Stefan Schimanski <sttts>
Status: CLOSED ERRATA QA Contact: pmali
Severity: high Docs Contact:
Priority: high    
Version: 4.5CC: anachand, aos-bugs, kewang, mfojtik, xxia
Target Milestone: ---   
Target Release: 4.5.z   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: 1878648
: 1880407 (view as bug list) Environment:
Last Closed: 2020-10-12 15:47:56 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1880407    
Bug Blocks: 1878648    

Description Stefan Schimanski 2020-09-16 12:16:12 UTC 
In 4.5 we have to remove the oauth-apiserver.openshift.io/secure-token-storage annotation from the config/v1 apiserver object via a controller.

+++ This bug was initially created as a clone of Bug #1878648 +++

Audit logs lack the information to trace logins of users because oauth access/authorize tokens are not logged. They cannot be logged by default because pre-4.6 there name was sensitive information.

Since 4.6 new tokens are hashed with sha256. We can audit log them without leaking sensitive information. Customers with strong audit requirements need this to adopt the 4.x platform.

--- Additional comment from Anand on 2020-09-15 00:00:02 CEST ---

BU has agreed to fix this in 4.6, however, it cannot breach the Oct 22 GA date
Comment 7 errata-xmlrpc 2020-10-12 15:47:56 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (OpenShift Container Platform 4.5.14 bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:3843