KubernetesAudit not support https!

[penetest]

No description provided.

[adnanrahic]

Hi! What setup are you using? We have it running in prod behind HTTPS and it is working as expected. If you can send me your config, I can take a closer look and reproduce your issue.

[otisg]

@penetest are you trying to send Kubernetes audit logs to Sematext or some place else?

[penetest]

@otisg Yes，I want to collect k8s audit logs by LogAgent, But k8s(18.x) audit webhooks need to https server instead of http server.
and KubernetesAudit plugin is http server, so not recevie k8s audit

[otisg]

What is the HTTP URL you are referring to? Can you paste it here please?

[penetest]

you can referre to these,and you will find 'The scheme must be “https”; the URL must begin with “https://“.'

[otisg]

Yeah. But I am asking what URL you are using? Where exactly - to which URL/endpoint - is your Logagent configured to send k8s audit logs?

[adnanrahic]

@penetest The Kubernetes Audit plugin in Logagent runs a simple Node.js HTTP server that listens on a port.

1. You will need to use a reverse proxy (this can be Nginx) to use HTTPS and route traffic to this Node.js server.
2. You will then need to configure the Kubernetes API Server to send logs to the https endpoint of the (Nginx) reverse proxy.

Does that make sense?

Again, can you share your config? If I see it I can give you better instructions.

[adnanrahic]

Something we can explore in the future is to add support for HTTPS with the built-in https module as explained here: https://nodejs.org/en/knowledge/HTTP/servers/how-to-create-a-HTTPS-server/

[adnanrahic]

What you can also do is configure the Kubernetes API Server to send audit logs directly to Sematext Logs.

Check out the product announcement here: https://sematext.com/product-updates/#/2020/we-have-a-new-integration-for-kubernetes-audit-logs

Also, please check out how to set it up with a Dynamic Backend, and shipping logs directly to Sematext Logs: https://sematext.com/docs/integration/kubernetes-audit-integration/#kubernetes-audit-dynamic-backend

[otisg]

Did this work for you, @penetest ?