Change auditing docs page for 1.9 release #6427

crassirostris · 2017-11-23T18:47:57Z

Docs PR for the API Audit Logging feature

Doesn't contain much new information, mostly refactoring and making sure new auditing mechanism is viewed as a default.

/cc @sttts @tallclair @CaoShuFeng @ericchiang

This change is

Signed-off-by: Mik Vyatskov <vmik@google.com>

k8sio-netlify-preview-bot · 2017-11-23T18:50:18Z

Deploy preview ready!

Built with commit ff1f784

https://deploy-preview-6427--kubernetes-io-vnext-staging.netlify.com

CaoShuFeng · 2017-11-24T01:09:43Z

docs/tasks/debug-application-cluster/audit.md

-[audit-api]: https://github.com/kubernetes/kubernetes/blob/v1.8.0-beta.1/staging/src/k8s.io/apiserver/pkg/apis/audit/v1beta1/types.go
+## Legacy Audit
+
+__Note:__ Legacy Audit is deprecated and is disabled by defaule since Kubernetes 1.8.


s/defaule/default/

Done, thanks

CaoShuFeng · 2017-11-24T01:17:40Z

docs/tasks/debug-application-cluster/audit.md

+they should include. When an event is processed, it's compared against the list
+of rules in order. The first matching rule sets the [audit level][auditing-level]
+of the event. The audit policy object structure is defined in the
+[`audit.k8s.io` API group][audit-api].


This will not be transformed I think.
Should it be [`audit.k8s.io` API group][auditing-api]?

A link would be very helpful here.

Thanks! Done

CaoShuFeng · 2017-11-24T01:21:15Z

docs/tasks/debug-application-cluster/audit.md

+using the `--audit-policy-file` flag. If the flag is omitted, no events are logged.
+__Note:__ `kind` and `apiVersion` fields along with `rules` __must__ be provided
+in the audit policy file. A policy with 0 rules, or a policy that doesn't
+provide valid `apiVersion` and `kind` values is treated as illgal.


Done, thanks

CaoShuFeng · 2017-11-24T01:37:55Z

docs/tasks/debug-application-cluster/audit.md

-```
+In both cases, audit events structure is defined by the API in the
+`audit.k8s.io` API group. The current version of the API is
+[`v1beta1`][auditing-beta-api].


This can't be transformed.

Done, thanks

CaoShuFeng · 2017-11-24T01:54:09Z

/cc @hzxuzhonghu

k8s-ci-robot · 2017-11-24T01:54:10Z

@CaoShuFeng: GitHub didn't allow me to request PR reviews from the following users: hzxuzhonghu.

Note that only kubernetes members can review this PR, and authors cannot review their own PRs.

In response to this:

/cc @hzxuzhonghu

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

tengqm · 2017-11-24T09:46:43Z

docs/tasks/debug-application-cluster/audit.md

+- `--audit-webhook-config-file` specifies the path to a file with a webhook
+  configuration. Webhook configuration is effectively a [kubeconfig][kubeconfig].
+- `--audit-webhook-mode` define the buffering strategy, one of the following:
+  - `batch` - buffer events and asynchronously send the set of events to the external service.


this is the default

Done, thanks

tengqm · 2017-11-24T09:47:01Z

docs/tasks/debug-application-cluster/audit.md

+  audit events. Not specifying this flag disables log backend.
+- `--audit-log-maxage` defined the maximum number of days to retain old audit log files.
+- `--audit-log-maxbackup` defines the maximum number of audit log files to retain.
+- `--audit-log-maxsize` defines the maximum size of the audit log file before it gets rotated.


in megabytes

Done, thanks

tengqm · 2017-11-24T09:47:12Z

docs/tasks/debug-application-cluster/audit.md

-`RequestResponse` levels are equivalent to `Metadata` for legacy format. This legacy format
-of advanced audit is different from the [Legacy Audit](# Legacy Audit) discussed above, such
-as changes to the method values and the introduction of a "stage" for each event.
+- `--audit-log-path` specifies the log file path, that log backend uses to write


Done, thanks

tengqm · 2017-11-24T09:48:09Z

docs/tasks/debug-application-cluster/audit.md

-    cluster: name-of-remote-audit-service
-    user: name-of-api-sever
-  name: webhook
-```


Should we retain the config file sample?

We have a kubeconfig file in logstash example.
I am OK to let this go.

That's the reason I removed it: an example is already present in another place

tengqm · 2017-11-24T09:50:03Z

docs/tasks/debug-application-cluster/audit.md

+[Kube-apiserver][kube-apiserver] provides the following options which are responsible
+for configuring where and how audit logs are handled:
+
+- `audit-log-path` - enables the audit log pointing to a file where the requests are being logged to, '-' means standard out.


when comparing the differences, I'm not sure if the "-" syntax is still supported?

Yes, it is. Added to the description above, thanks

sttts · 2017-11-24T10:47:51Z

/cc @soltysh ^^

hzxuzhonghu · 2017-11-25T01:15:05Z

docs/tasks/debug-application-cluster/audit.md

- `blocking` - block API server responses on sending each event to the external service.
+- `--audit-webhook-config-file` specifies the path to a file with a webhook
+  configuration. Webhook configuration is effectively a [kubeconfig][kubeconfig].
+- `--audit-webhook-mode` define the buffering strategy, one of the following:


Should we use --audit-webhook-buffered default is true?

Let's not deprecate this flag in this release, since it's too close. It'll be a TODO for the next release

Signed-off-by: Mik Vyatskov <vmik@google.com>

tallclair · 2017-11-28T21:00:29Z

docs/tasks/debug-application-cluster/audit.md

@@ -9,7 +9,7 @@ title: Auditing
 * TOC
 {:toc}


Maybe add the beta label, since you're removing the legacy section?

{% include feature-state-beta.md %}

tallclair · 2017-11-28T21:01:47Z

docs/tasks/debug-application-cluster/audit.md

+using the `--audit-policy-file` flag. If the flag is omitted, no events are logged.
+__Note:__ `kind` and `apiVersion` fields along with `rules` __must__ be provided
+in the audit policy file. A policy with 0 rules, or a policy that doesn't
+provide valid `apiVersion` and `kind` values is treated as illegal.

 Some example audit policy files:

 ```yaml


Consider moving this to a separate file so it can be tested, and including with

{% include code.html language="yaml" file="policy.yaml" ghlink="/docs/.../audit-policy.yaml" %}

tallclair · 2017-11-28T21:03:50Z

docs/tasks/debug-application-cluster/audit.md


-```
-{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":null},"level":"Metadata","timestamp":"2017-09-05T10:04:55Z","auditID":"77e58433-d345-40ac-b2d8-9866bd355cea","stage":"RequestReceived","requestURI":"/apis/rbac.authorization.k8s.io/v1/namespaces/default/roles","verb":"list","user":{"username":"kubecfg","groups":["system:masters","system:authenticated"]},"sourceIPs":["172.16.116.128"],"objectRef":{"resource":"roles","namespace":"default","apiGroup":"rbac.authorization.k8s.io","apiVersion":"v1"}}
-{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":null},"level":"Metadata","timestamp":"2017-09-05T10:04:55Z","auditID":"77e58433-d345-40ac-b2d8-9866bd355cea","stage":"ResponseComplete","requestURI":"/apis/rbac.authorization.k8s.io/v1/namespaces/default/roles","verb":"list","user":{"username":"kubecfg","groups":["system:masters","system:authenticated"]},"sourceIPs":["172.16.116.128"],"objectRef":{"resource":"roles","namespace":"default","apiGroup":"rbac.authorization.k8s.io","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":200}}


It looks like you cut out all the examples of actual audit lines? I think it would be good to retain an example, and maybe even document the API.

I'm not sure this particular example is useful. It duplicates a lot of info in a poorer format: user can look into its own logs or into the API definition for a much better picture. Additionally, it looks like a big human-unparsable blob, so I'm against keeping it in the current form anyway.

If you want to describe the API in this docs, that's going to encounter a problem of docs obsoletion. Having better docs in the API code seems better to me, it creates a single place where it's described.

This example does not have RequestReceivedTimestamp and StageTimestamp introduced here

steveperry-53 · 2017-11-29T19:00:54Z

This has tech approval from @tengqm. Waiting for tech approval from @tallclair.

zacharysarah

Good work. ✨ Small edits for syntax

zacharysarah · 2017-12-03T22:19:46Z

docs/tasks/debug-application-cluster/audit.md

+You can pass a file with the policy to [kube-apiserver][kube-apiserver]
+using the `--audit-policy-file` flag. If the flag is omitted, no events are logged.
+__Note:__ `kind` and `apiVersion` fields along with `rules` __must__ be provided
+in the audit policy file. A policy with 0 rules, or a policy that doesn't


+in the audit policy file. A policy with no (0) rules, or a policy that doesn't

zacharysarah · 2017-12-03T22:20:38Z

docs/tasks/debug-application-cluster/audit.md

-
-In alpha version, objectRef.apiVersion holds both the api group and version.
-In beta version these were break out into objectRef.apiGroup and objectRef.apiVersion.
+- Log backend, which writes events to a disk.


- Log backend, which writes events to a disk

zacharysarah · 2017-12-03T22:21:03Z

docs/tasks/debug-application-cluster/audit.md

-In alpha version, objectRef.apiVersion holds both the api group and version.
-In beta version these were break out into objectRef.apiGroup and objectRef.apiVersion.
+- Log backend, which writes events to a disk.
+- Webhook backend, which sends events to an external API.


- Webhook backend, which sends events to an external API

zacharysarah · 2017-12-03T22:27:21Z

docs/tasks/debug-application-cluster/audit.md

+- `--audit-log-path` specifies the log file path that log backend uses to write
+  audit events. Not specifying this flag disables log backend. `-` means standard out
+- `--audit-log-maxage` defined the maximum number of days to retain old audit log files.
+- `--audit-log-maxbackup` defines the maximum number of audit log files to retain.


No period at the end

zacharysarah · 2017-12-03T22:27:29Z

docs/tasks/debug-application-cluster/audit.md

+  audit events. Not specifying this flag disables log backend. `-` means standard out
+- `--audit-log-maxage` defined the maximum number of days to retain old audit log files.
+- `--audit-log-maxbackup` defines the maximum number of audit log files to retain.
+- `--audit-log-maxsize` defines the maximum size in megabytes of the audit log file before it gets rotated.


No period at the end

zacharysarah · 2017-12-03T22:28:19Z

docs/tasks/debug-application-cluster/audit.md

+- `--audit-webhook-config-file` specifies the path to a file with a webhook
+  configuration. Webhook configuration is effectively a [kubeconfig][kubeconfig].
+- `--audit-webhook-mode` define the buffering strategy, one of the following:
+  - `batch` - buffer events and asynchronously send the set of events to the external service.


No period at the end

zacharysarah · 2017-12-03T22:28:27Z

docs/tasks/debug-application-cluster/audit.md

+- `--audit-webhook-mode` define the buffering strategy, one of the following:
+  - `batch` - buffer events and asynchronously send the set of events to the external service.
+    This is the default.
+  - `blocking` - block API server responses on sending each event to the external service.


No period at the end

Signed-off-by: Mik Vyatskov <vmik@google.com>

crassirostris

@tallclair @zacharysarah Thanks a lot for the review! PTAL

crassirostris · 2017-12-04T13:51:36Z

docs/tasks/debug-application-cluster/audit.md

+You can pass a file with the policy to [kube-apiserver][kube-apiserver]
+using the `--audit-policy-file` flag. If the flag is omitted, no events are logged.
+__Note:__ `kind` and `apiVersion` fields along with `rules` __must__ be provided
+in the audit policy file. A policy with 0 rules, or a policy that doesn't


crassirostris · 2017-12-04T13:51:42Z

docs/tasks/debug-application-cluster/audit.md

+using the `--audit-policy-file` flag. If the flag is omitted, no events are logged.
+__Note:__ `kind` and `apiVersion` fields along with `rules` __must__ be provided
+in the audit policy file. A policy with 0 rules, or a policy that doesn't
+provide valid `apiVersion` and `kind` values is treated as illegal.

 Some example audit policy files:

 ```yaml


crassirostris · 2017-12-04T13:51:47Z

docs/tasks/debug-application-cluster/audit.md

@@ -9,7 +9,7 @@ title: Auditing
 * TOC
 {:toc}


crassirostris · 2017-12-04T13:56:45Z

docs/tasks/debug-application-cluster/audit.md


-```
-{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":null},"level":"Metadata","timestamp":"2017-09-05T10:04:55Z","auditID":"77e58433-d345-40ac-b2d8-9866bd355cea","stage":"RequestReceived","requestURI":"/apis/rbac.authorization.k8s.io/v1/namespaces/default/roles","verb":"list","user":{"username":"kubecfg","groups":["system:masters","system:authenticated"]},"sourceIPs":["172.16.116.128"],"objectRef":{"resource":"roles","namespace":"default","apiGroup":"rbac.authorization.k8s.io","apiVersion":"v1"}}
-{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":null},"level":"Metadata","timestamp":"2017-09-05T10:04:55Z","auditID":"77e58433-d345-40ac-b2d8-9866bd355cea","stage":"ResponseComplete","requestURI":"/apis/rbac.authorization.k8s.io/v1/namespaces/default/roles","verb":"list","user":{"username":"kubecfg","groups":["system:masters","system:authenticated"]},"sourceIPs":["172.16.116.128"],"objectRef":{"resource":"roles","namespace":"default","apiGroup":"rbac.authorization.k8s.io","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":200}}


I'm not sure this particular example is useful. It duplicates a lot of info in a poorer format: user can look into its own logs or into the API definition for a much better picture. Additionally, it looks like a big human-unparsable blob, so I'm against keeping it in the current form anyway.

If you want to describe the API in this docs, that's going to encounter a problem of docs obsoletion. Having better docs in the API code seems better to me, it creates a single place where it's described.

crassirostris · 2017-12-04T13:57:07Z

docs/tasks/debug-application-cluster/audit.md

-
-In alpha version, objectRef.apiVersion holds both the api group and version.
-In beta version these were break out into objectRef.apiGroup and objectRef.apiVersion.
+- Log backend, which writes events to a disk.


crassirostris · 2017-12-04T13:57:10Z

docs/tasks/debug-application-cluster/audit.md

-In alpha version, objectRef.apiVersion holds both the api group and version.
-In beta version these were break out into objectRef.apiGroup and objectRef.apiVersion.
+- Log backend, which writes events to a disk.
+- Webhook backend, which sends events to an external API.


crassirostris · 2017-12-04T13:57:23Z

docs/tasks/debug-application-cluster/audit.md

+- `--audit-log-path` specifies the log file path that log backend uses to write
+  audit events. Not specifying this flag disables log backend. `-` means standard out
+- `--audit-log-maxage` defined the maximum number of days to retain old audit log files.
+- `--audit-log-maxbackup` defines the maximum number of audit log files to retain.


crassirostris · 2017-12-04T13:57:26Z

docs/tasks/debug-application-cluster/audit.md

+  audit events. Not specifying this flag disables log backend. `-` means standard out
+- `--audit-log-maxage` defined the maximum number of days to retain old audit log files.
+- `--audit-log-maxbackup` defines the maximum number of audit log files to retain.
+- `--audit-log-maxsize` defines the maximum size in megabytes of the audit log file before it gets rotated.


crassirostris · 2017-12-04T13:57:48Z

docs/tasks/debug-application-cluster/audit.md

+- `--audit-webhook-config-file` specifies the path to a file with a webhook
+  configuration. Webhook configuration is effectively a [kubeconfig][kubeconfig].
+- `--audit-webhook-mode` define the buffering strategy, one of the following:
+  - `batch` - buffer events and asynchronously send the set of events to the external service.


crassirostris · 2017-12-04T13:57:53Z

docs/tasks/debug-application-cluster/audit.md

+- `--audit-webhook-mode` define the buffering strategy, one of the following:
+  - `batch` - buffer events and asynchronously send the set of events to the external service.
+    This is the default.
+  - `blocking` - block API server responses on sending each event to the external service.


Signed-off-by: Mik Vyatskov <vmik@google.com>

zacharysarah · 2017-12-06T21:27:07Z

@crassirostris 👋 It looks like the preview build is failing due to YAML file inclusion syntax:

12:42:25 PM: jekyll 3.6.0 | Error: Could not locate the included file 'policy.yaml' in any of ["/opt/build/repo/docs/tasks/debug-application-cluster"]. Ensure it exists in one of those directories and, if it is a symlink, does not point outside your site source.
12:42:25 PM: Liquid Exception: Could not locate the included file 'policy.yaml' in any of ["/opt/build/repo/docs/tasks/debug-application-cluster"]. Ensure it exists in one of those directories and, if it is a symlink, does not point outside your site source. in docs/tasks/debug-application-cluster/audit.md

zacharysarah · 2017-12-07T05:35:32Z

@tallclair 👋 Does this look Tech LGTM?

Signed-off-by: Mik Vyatskov <vmik@google.com>

crassirostris · 2017-12-07T10:52:23Z

@zacharysarah Oh, thanks a lot for pointing this out! Fixed the link

* Trivial change to open release branch * Undo trivial change * add service ipvs overview * Add instructions on how to setup kubectl * Document conntrack dependency for kube-proxy * Add an a This is kind of jarring / missing an article. I'm guessing it should either be ' to a rack of bare metal servers.' or '...to racks of bare metal servers.'. * adding example responses for common issues - support request - code bug report * Trivial change to open release branch * Undo trivial change * Signed-off-by: Ziqi Zhao <zhaoziqi@qiniu.com> (#5366) Fix the not-working test case yaml for /doc/concepts/storage/volumes.md * kubectl-overview * temp fix for broken pod and deployment links * Update Table of Solutions for Juju * Revise certificates documentation (#5965) * Update review-issues.md Some edits for clarity and condensed language. * Update init-containers.md Fix leading spaces in commands. * Update kubectl-overview.md Fix format. * Update clc.md Fix format. * Update openstack-heat.md The url no need. just highlight. * Typo I believe this should be "users" not "uses" * making explicit hostname uniq requirement * Update scheduling-hugepages.md * Update update-daemon-set.md * fix redirection of PersistentVolume * Update hpa.md * update kubectl instruction * Use the format of kubeadm init * fix spelling error guarnatees to guarantees * add matchLabels description (#6020) * search and replace for k8s.github.io to website (#6019) * fix scale command of object-management (#6011) * Update replicaset.md (#6009) * Update secret.md (#6008) * specify password for mysql image (#5990) * specify password for mysql image * specify password for mysql image * link error for run-stateless-application-deployment.md (#5985) * link error for run-stateless-application-deployment.md * link error for run-stateless-application-deployment.md * Add performance implications of inter-pod affinity/anti-affinity (#5979) * 404 monthly maintenance - October 2017 (#5977) * Updated redirects * More redirects * Add conjure-up to Turnkey Cloud Solutions list (#5973) * Add conjure-up to Turnkey Cloud Solutions list * Changed wording slightly * change the StatefulSet to ReplicaSet in reference (#5968) * Clarification of failureThreshold of probes (#5963) * Mention usage of block storage version param (#5925) Mention usage of block storage version (bs-version) parameter to workaround attachment issues using older K8S versions on an OpenStack cloud with path-based endpoints. Resolves: #5924 * Update sysctl-cluster.md (#5894) Include guide on enabling unsafe sysctls in minikube * Avoid Latin phrases & format note (#5889) * Avoid Latin phrases & format note according the Documentation Style Guide * Update scratch.md * Update scratch.md * resolves jekyll rendering error (#5976) - chinese isn't understood for keys in YAML frontmatter in jekyll, so replaced it with the english equivalent that doesn't throw the following error on rendering: Error reading file src/kubernetes.github.io/cn/docs/concepts/cluster-administration/device-plugins.md: (<unknown>): could not find expected ':' while scanning a simple key at line 4 column 1 * Change VM to pod. (#6022) * Add link to custom metrics. (#6023) * Rephrase core group. (#6024) * Added explanation on context to when joining (#6018) * Update create-cluster-kubeadm.md (#5761) Update Canal version in pod network apply commands * Fixes issue #5620 (#5869) * Fixes issue #5620 Signed-off-by: Brad Topol <btopol@us.ibm.com> * Restructured so that review process is for both current and upcoming releases. Added content describing the use of tech reviewers. * Removed incorrect Kubernetes reviewer link. * Fixed tech reviewer URL to now use website * Update pod-priority-preemption.md fix-wrong-link-to-pod-preemption * pod-security-policy.md: add links to the page about admission plugins. * Adding all files for BlaBlaCar case study (#5857) * Adding all files for BlaBlaCar case study * Update blablacar.html * Fix changed URL for google containers * Add /docs/reference/auto-generated directory * correct the downwardapi redirect * Remove links using "here" * Rename to /docs/reference/generated directory * add Concept template * Change title to just Ingress * Link mistake (#6038) * link mistake * link mistake * skip title check for skip_title_check.txt * skip title check for skip_title_check.txt * remove doesn't exist link. * Fix podpreset task (#5705) * Add a simple pod manifest to pod overview (#5986) * Split PodPreset concept out from task doc (#5984) * Add selector spec description (#5789) * Add selector spec description * Fix selector field explanation * Put orphaned topics in TOC. (#6051) * static-pod example bad format in the final page (#6050) * static-pod example bad format in the final page * static-pod example bad format in the final page * static-pod example bad format in the final page * static-pod example bad format in the final page * static-pod example bad format in the final page * Fix `backoffLimit` field misplacement (#6042) It should be placed in JobSpec according to: https://github.com/kubernetes/kubernetes/blob/master/api/swagger-spec/batch_v1.json#L1488-L1514 * Update addons.md (#6061) * add info about VMware NSX-T CNI plugin (#5987) * add info about VMware NSX-T CNI plugin Hello, I'm VMware Networking and Security Architect and would like to include short information about our CNI plugin implementation similar to what other vendors did Best regards Emil Gagala * Update networking.md * Update networking.md * Update networking.md * Update: Using universal zsh configuration (#5669) * Update install-kubectl.md Zsh is not only oh-my-zsh, so I added universal configuration for zsh that also can be used in prezto. * fix merge error after rebase * Operating etcd cluster for Kubernetes bad format in the final page (#6056) * Operating etcd cluster for Kubernetes bad format in the final page * Update configure-upgrade-etcd.md * Update configure-upgrade-etcd.md * Usage note and warning tags. (#6053) * Usage note and warning tags. * Update configure-upgrade-etcd.md * Update configure-upgrade-etcd.md * Document jekyll includes snippets * Add jekyll includes to docs home toc - Remove extra kubernetes home in toc * document docker cgroupdriver req (#5937) * Update test blacklists (#6063) * Update toc check blacklist * Update title check blacklist * wip * wip * Fix typo * Document unconfined apparmor profile * Revert "Document the unconfined profile for AppArmor" (#6268) * CRD Validation: remove alpha warning, change enable instructions to (#6066) disable * Documented service annotation for AWS ELB SSL policy * kubeadm: add a note about the new `--print-join-command` flag. This is a new flag for the `kubeadm token create` command. * Add a note to PDB page * Improve Kubeadm reference doc (#6103) * automatically-generated kubeadm reference doc * user-mantained kubeadm reference doc * Documentation for CSIPersistentVolume * change replicaset documentation to use apps/v1 APIs * Update service.md ipvs alpha version -> beta version * Updated Deployment concept docs (#6494) * Updated Deployment concept docs * Addressed comments * Documentation for volume scheduling alpha feature * Update admission control docs for webhooks * Improve DNS documentation (#6479) * update ds for 1.9 * Update service.md * Update service.md * Revert "begin updating webhook documentation" (#6575) * Update version numbers to include 1.9 (#6518) * Update site versions for 1.9 * Removed 1.4 docs * Update _config.yml * Update _config.yml * updates for raw block devices * rbac: docs for aggregated cluster roles (#6474) * Added IPv6 information for Kubelet arguments (#6498) * Added IPv6 info to kube-proxy arguments * Added IPv6 information for argument for kubelet * Update PVC resizing documentation (#6487) * Updates for Windows Server version 1709 with K8s v1.8 (#6180) * Updated for WSv1709 and K8s v1.8 * Updated picture and CNI config * Fixed formatting on CNI Config * Updated docs to reference Microsoft/SDN GitHub docs * fix typo * Workaround for Jekyllr frontmatter * Added section on features and limitations, with example yaml files. * Update index.md * Added kubeadm section, few other small fixes * Few minor grammar fixes * Update access-cluster.md with a comment that for IPv6 the user should use [::1] for the localhost * Addressed a number of issues brought up against the base PR * Fixed windows-host-setup link * Rewrite PodSecurityPolicy guide * Update index.md Signed-off-by: Alin Balutoiu <abalutoiu@cloudbasesolutions.com> Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org> * Spelling correction and sentence capitalization. - Corrected the spelling error for storing, was put in as 'stoing'. - Capitalized list items. - Added '.' at end of sentences in the list items. * Update index.md * Update index.md * Addressed comments and rebased * Fixed formatting * Fixed formatting * Updated header link * Updated hyperlinks * Updated warning * formatting * formatting * formatting * Revert "Update access-cluster.md with a comment that for IPv6" This reverts commit 31e4dbd. * Revert "fix typo" This reverts commit c056787. * Revert "Workaround for Jekyllr frontmatter" This reverts commit b84ac59. * Fixed grammatical issues and reverted non-related commits * Revert "Rewrite PodSecurityPolicy guide" This reverts commit 5d39cfe. * Revert "Spelling correction and sentence capitalization." This reverts commit 47eed43. * Fixed auto-numbering * Minor formatting updates * CoreDNS feature documentation (#6463) * Initial placeholder PR for CoreDNS feature documentation * Remove from admin, add content * Fix missing endcapture * Add to tasks.yml * Review feedback * Postpone Deletion of a Persistent Volume Claim in case It Is Used by a Pod (#6415) * Postpone Deletion of a Persistent Volume Claim in case It Is Used by a Pod A new feature PVC Protection was added into K8s 1.9 that's why this documentation change is needed. * Added tag at the top of each new area. * Fix typo * Fix: switched on in (all kubelets) -> (all K8s components). * Added link to admission controller * Moved PVC Protection configuration into Before you begin section. * Added steps how to verify PVC Protection feature. * Fixes for admission controller plugin description and for PVC Protection description in PVC lifecycle. * Testing official rendering of enumerations (1., 2., 3., etc.) * Re-write to address comments from review. * Fixed definition when a PVC is in active use by a pod. * Change auditing docs page for 1.9 release (#6427) * Change auditing docs page for 1.9 release Signed-off-by: Mik Vyatskov <vmik@google.com> * Address review comments Signed-off-by: Mik Vyatskov <vmik@google.com> * Address review comments Signed-off-by: Mik Vyatskov <vmik@google.com> * Address review comments Signed-off-by: Mik Vyatskov <vmik@google.com> * Fix broken link Signed-off-by: Mik Vyatskov <vmik@google.com> * short circuit deny docs (#6536) * line wrap * short circuit deny * address comments * Add kubeadm 1.9 upgrade docs (#6485) * kubeadm: Improve kubeadm documentation for v1.9 (#6645) * Update admission control docs for webhooks (re-send #6368) (#6650) * Update admission control docs for webhooks * update in response to comments * Revamp rkt and add CRI-O as alternative runtime (#6371) Signed-off-by: Lorenzo Fontana <lo@linux.com> * Documented NLB for Kubernetes 1.9 (#6260) * Added IPV6 information to setup cluster using kubeadm (#6465) * Added IPV6 information to setup cluster using kubeadm * Updated kubeadm.md & create-cluster-kubeadm.md with IPv6 related information * Added IPv6 options for kubeadm --init & automated address binding for kube-proxy based on version of IP configured for API server) * Changes to kubeadm.md as per comments * Modified kubeadm.md and create-cluster-kubeadm.md * Implemented changes requested by zacharysarah * Removed autogenerated kubeadm.md changes * StatefulSet 1.9 updates. (#6550) * updates sts concept and tutorials to use 1.9 apps/v1 * Update statefulset.md * clarify pod name label * Garbage collection updates for 1.9 (#6555) * 1.9 gc policy update * carify deletion * Couple nits for dnsConfig doc (#6652) * Add doc for AllowedFlexVolume (#6563) * Update OpenStack Cloud Provider API support for v1.9 (#6638) * Flex volume is GA. Remove alpha notation. (#6666) * Update generated ref docs for Kubernetes and Federation components. (#6658) * Update generated ref docs for Kubernetes and Federation components. * Rename kubectl-options to kubectl. * Add title to kubectl. * Fix double synopsis. * Update Federation API ref docs for 1.9. (#6636) * Update federation API ref docs. * Move and redirect. * Move generated Federation docs to the generated directory. * Fix titles. * Type * Fix titles * Update auto-generated Kubernetes APi ref docs. (#6646) * Update kubectl commands for 1.9 (#6635) * add ExtendedResourceToleration admission controller (#6618) * Update API reference paths for v1.9 (#6681)

Change auditing docs page for 1.9 release

6d81861

Signed-off-by: Mik Vyatskov <vmik@google.com>

k8s-ci-robot requested review from CaoShuFeng, ericchiang, sttts and tallclair November 23, 2017 18:47

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Nov 23, 2017

k8s-github-robot assigned Bradamant3 Nov 23, 2017

crassirostris mentioned this pull request Nov 23, 2017

API Audit Logging kubernetes/enhancements#22

Closed

3 tasks

CaoShuFeng reviewed Nov 24, 2017

View reviewed changes

tengqm requested changes Nov 24, 2017

View reviewed changes

tengqm added this to In Progress in Release 1.9 Nov 24, 2017

hzxuzhonghu reviewed Nov 25, 2017

View reviewed changes

Address review comments

c8e6f71

Signed-off-by: Mik Vyatskov <vmik@google.com>

steveperry-53 added Needs Docs Review labels Nov 28, 2017

tengqm approved these changes Nov 28, 2017

View reviewed changes

tallclair reviewed Nov 28, 2017

View reviewed changes

tengqm mentioned this pull request Nov 29, 2017

Auditing topic is unclear, missing information #6365

Closed

2 tasks

zacharysarah moved this from In Progress to To Do in Release 1.9 Nov 29, 2017

steveperry-53 added this to the 1.9 milestone Nov 29, 2017

steveperry-53 added Tech Review: Open Issues and removed Needs Tech Review labels Nov 29, 2017

zacharysarah mentioned this pull request Nov 30, 2017

Release 1.9 #5978

Merged

zacharysarah suggested changes Dec 3, 2017

View reviewed changes

zacharysarah moved this from To Do to In Progress in Release 1.9 Dec 3, 2017

zacharysarah added Docs Review: Open Issues and removed Needs Docs Review labels Dec 3, 2017

Address review comments

4ed86a0

Signed-off-by: Mik Vyatskov <vmik@google.com>

crassirostris commented Dec 4, 2017

View reviewed changes

Address review comments

0a82e2d

Signed-off-by: Mik Vyatskov <vmik@google.com>

zacharysarah mentioned this pull request Dec 7, 2017

[1.9] Issue Burndown kubernetes/sig-release#38

Closed

Fix broken link

ff1f784

Signed-off-by: Mik Vyatskov <vmik@google.com>

zacharysarah approved these changes Dec 7, 2017

View reviewed changes

zacharysarah merged commit 07d8458 into kubernetes:release-1.9 Dec 7, 2017

zacharysarah moved this from In Progress to Done in Release 1.9 Dec 11, 2017

Change auditing docs page for 1.9 release #6427

Change auditing docs page for 1.9 release #6427

Conversation

crassirostris commented Nov 23, 2017 • edited by k8s-reviewable

k8sio-netlify-preview-bot commented Nov 23, 2017 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

CaoShuFeng commented Nov 24, 2017

k8s-ci-robot commented Nov 24, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sttts commented Nov 24, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

steveperry-53 commented Nov 29, 2017

zacharysarah left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

crassirostris left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

zacharysarah commented Dec 6, 2017

zacharysarah commented Dec 7, 2017

crassirostris commented Dec 7, 2017

crassirostris commented Nov 23, 2017 •

edited by k8s-reviewable

k8sio-netlify-preview-bot commented Nov 23, 2017 •

edited