一、安裝Logtail組件

具體操作，請參見安裝Logtail組件（自建Kubernetes集群）的安裝Logtail章節。

二、開啟集群審計功能

以下步驟供您參考。更多信息，請參見啟用集群API Server審計功能。

1. 已創建注冊集群，并將自建Kubernetes集群接入注冊集群。具體操作，請參見通過控制臺創建注冊集群。

2. 在Master節點上配置審計配置策略文件。

   依次登錄所有Master節點，在審計配置策略文件的路徑/etc/kubernetes/audit-policy.yaml，請根據以下內容修改審計配置策略：

   apiVersion: audit.k8s.io/v1beta1 # This is required.
   kind: Policy
   # Don't generate audit events for all requests in RequestReceived stage.
   omitStages:
     - "RequestReceived"
   rules:
     # The following requests were manually identified as high-volume and low-risk,
     # so drop them.
     - level: None
       users: ["system:kube-proxy"]
       verbs: ["watch"]
       resources:
         - group: "" # core
           resources: ["endpoints", "services"]
     - level: None
       users: ["system:unsecured"]
       namespaces: ["kube-system"]
       verbs: ["get"]
       resources:
         - group: "" # core
           resources: ["configmaps"]
     - level: None
       users: ["kubelet"] # legacy kubelet identity
       verbs: ["get"]
       resources:
         - group: "" # core
           resources: ["nodes"]
     - level: None
       userGroups: ["system:nodes"]
       verbs: ["get"]
       resources:
         - group: "" # core
           resources: ["nodes"]
     - level: None
       users:
         - system:kube-controller-manager
         - system:kube-scheduler
         - system:serviceaccount:kube-system:endpoint-controller
       verbs: ["get", "update"]
       namespaces: ["kube-system"]
       resources:
         - group: "" # core
           resources: ["endpoints"]
     - level: None
       users: ["system:apiserver"]
       verbs: ["get"]
       resources:
         - group: "" # core
           resources: ["namespaces"]
     # Don't log these read-only URLs.
     - level: None
       nonResourceURLs:
         - /healthz*
         - /version
         - /swagger*
     # Don't log events requests.
     - level: None
       resources:
         - group: "" # core
           resources: ["events"]
     # Secrets, ConfigMaps, and TokenReviews can contain sensitive & binary data,
     # so only log at the Metadata level.
     - level: Metadata
       resources:
         - group: "" # core
           resources: ["secrets", "configmaps"]
         - group: authentication.k8s.io
           resources: ["tokenreviews"]
     # Get repsonses can be large; skip them.
     - level: Request
       verbs: ["get", "list", "watch"]
       resources:
         - group: "" # core
         - group: "admissionregistration.k8s.io"
         - group: "apps"
         - group: "authentication.k8s.io"
         - group: "authorization.k8s.io"
         - group: "autoscaling"
         - group: "batch"
         - group: "certificates.k8s.io"
         - group: "extensions"
         - group: "networking.k8s.io"
         - group: "policy"
         - group: "rbac.authorization.k8s.io"
         - group: "settings.k8s.io"
         - group: "storage.k8s.io"
     # Default level for known APIs
     - level: RequestResponse
       resources:
         - group: "" # core
         - group: "admissionregistration.k8s.io"
         - group: "apps"
         - group: "authentication.k8s.io"
         - group: "authorization.k8s.io"
         - group: "autoscaling"
         - group: "batch"
         - group: "certificates.k8s.io"
         - group: "extensions"
         - group: "networking.k8s.io"
         - group: "policy"
         - group: "rbac.authorization.k8s.io"
         - group: "settings.k8s.io"
         - group: "storage.k8s.io"
     # Default level for all other requests.
     - level: Metadata

3. 在Master節點上配置Kube API Server文件。

   依次登錄所有Master節點機器，在Kube API Server文件的路徑/etc/kubernetes/manifests/kube-apiserver.yaml，完成以下相關配置：

   • 根據以下示例添加command參數--audit-log-*：

     ...
     spec:
       containers:
       - command:
         - kube-apiserver
         - --audit-log-maxbackup=10
         - --audit-log-maxsize=100
         - --audit-log-path=/var/log/kubernetes/kubernetes.audit
         - --audit-log-maxage=30
         - --audit-policy-file=/etc/kubernetes/audit-policy.yaml
         ...

   • 根據以下示例添加env參數aliyun_logs_audit-*：

     您需要將以下示例中的{cluster_id}替換為您集群的Cluster ID。您可以登錄云安全中心控制臺，在容器資產頁面獲取集群的Cluster ID，具體位置請參見下圖。

     ...
     spec:
       containers:
       - command:
         - kube-apiserver
         - --audit-log-maxbackup=10
         - --audit-log-maxsize=100
         - --audit-log-path=/var/log/kubernetes/kubernetes.audit
         - --audit-log-maxage=30
         - --audit-policy-file=/etc/kubernetes/audit-policy.yaml
         ...
         ...
         env:
         - name: aliyun_logs_audit-${cluster_id}
           value: /var/log/kubernetes/kubernetes.audit
         - name: aliyun_logs_audit-${cluster_id}_tags
           value: audit=apiserver
         - name: aliyun_logs_audit-${cluster_id}_product
           value: k8s-audit
         - name: aliyun_logs_audit-${cluster_id}_jsonfile
           value: "true"
         image: registry-vpc.cn-shenzhen.aliyuncs.com/acs/kube-apiserver:v1.20.4-aliyun.1

   • 根據以下示例掛載/etc/kubernetes/audit-policy.yaml到API Server Pod。

     ...
     spec:
       containers:
       - command:
         - kube-apiserver
         - --audit-log-maxbackup=10
         - --audit-log-maxsize=100
         - --audit-log-path=/var/log/kubernetes/kubernetes.audit
         - --audit-log-maxage=30
         - --audit-policy-file=/etc/kubernetes/audit-policy.yaml
         ...
         ...
         env:
         - name: aliyun_logs_audit-${cluster_id}
           value: /var/log/kubernetes/kubernetes.audit
         - name: aliyun_logs_audit-${cluster_id}_tags
           value: audit=apiserver
         - name: aliyun_logs_audit-${cluster_id}_product
           value: k8s-audit
         - name: aliyun_logs_audit-${cluster_id}_jsonfile
           value: "true"
         image: registry-vpc.cn-shenzhen.aliyuncs.com/acs/kube-apiserver:v1.20.4-aliyun.1
         ...
         ...
         volumeMounts:
         - mountPath: /var/log/kubernetes
           name: k8s-audit
         - mountPath: /etc/kubernetes/audit-policy.yaml
           name: audit-policy
           readOnly: true
         ...
         ...
       volumes:
       - hostPath:
           path: /var/log/kubernetes
           type: DirectoryOrCreate
         name: k8s-audit
       - hostPath:
           path: /etc/kubernetes/audit-policy.yaml
           type: FileOrCreate
         name: audit-policy
       ...

三、驗證日志采集結果

1. 登錄日志服務控制臺。

2. 單擊目標Project名稱。

3. 查看相關日志是否已采集到目標Project下的日志庫（Logstore）。

四、開啟威脅檢測

1. 登錄云安全中心控制臺。在控制臺左上角，選擇需防護資產所在的區域：中國或全球（不含中國）。

2. 在左側導航欄，選擇資產中心 > 容器資產。

3. 在集群頁簽，單擊自建集群接入。

4. 找到需要開啟K8s日志威脅檢測的自建集群，在操作列單擊編輯。

5. 在開啟日志頁簽，選中開啟K8S日志上報進行威脅檢測，配置審計日志信息，然后單擊保存。

   • 審計日志Region：選擇審計日志的存儲地域。

   • 審計日志Project：輸入一、安裝Logtail組件中創建的Project名稱。例如：如k8s-log-custom-sd89ehdq。

   • 審計日志LogStore：輸入一、安裝Logtail組件中自動創建的LogStore名稱。例如：audit-027b007a7dd11967a9f7e2449d8dc497。