Description of problem: We provide an option openshift_master_audit_config > https://github.com/openshift/openshift-ansible/blob/openshift-ansible-3.4.71-1/inventory/byo/hosts.ose.example#L638-L639 To enable audit logging, but don't document it: https://bugzilla.redhat.com/show_bug.cgi?id=1447773 That said, we need to provide a way at install time to enable the following configuration: https://docs.openshift.com/container-platform/3.5/install_config/master_node_configuration.html#master-node-config-audit-config
This should be addressed, because if oc adm diagnostics (run as root|system:admin) run after a cluster install will report: >[Note] Running diagnostic: MasterConfigCheck > Description: Check the master config file >WARN: [DH0005 from diagnostic MasterConfigCheck@openshift/origin/pkg/diagnostics/host/check_master_config.go:52] > Validation of master config file '/etc/origin/master/master-config.yaml' warned: > ... > auditConfig.auditFilePath: Required value: audit can now be logged to a separate file
The full configurability of audit logging has always been possible, you just need to convert the full key value into json. Only action for cluster lifecycle here is to update the example inventories with an example that uses all the options in the docs link from comment 0.
https://github.com/openshift/openshift-ansible/pull/4458 community contribution
verify this with openshift-ansible-3.6.116-1.git.0.e2840e8.el7.noarch In /usr/share/doc/openshift-ansible-docs-3.6.116/docs/example-inventories/hosts.ose.example we have more options added. [root@gpei-test-ansible ]# grep openshift_master_audit_config /usr/share/doc/openshift-ansible-docs-3.6.116/docs/example-inventories/hosts.ose.example #openshift_master_audit_config={"enabled": true} #openshift_master_audit_config={"enabled": true, "auditFilePath": "/var/log/openpaas-oscp-audit/openpaas-oscp-audit.log", "maximumFileRetentionDays": 14, "maximumFileSizeMegabytes": 500, "maximumRetainedFiles": 5}}
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2017:1716