Containers-roadmap: EKS Control Plane Logs

[pauncejones]

View Kubernetes API Server and Audit Logs in your account.

[swestcott]

Would this include apiserver audit logs?

[brynmathias]

Would be nice to be able to push the logs into an Elasticsearch service running on aws.

[jesse-peters]

If it goes to cloudwatch it would be more flexible than elasticsearch - would also follow the ECS pattern.

[vijaykatam]

Is this going to include other control plane components such scheduler, kubelet and controller-manager? Also interested in logs from iam authenticator pod for auditing purposes.

[tiffanycitra]

Is there an ETA for this feature?

[tdmalone]

@tiffanycitra
From the README:

A: Because job zero is security and operational stability, we can't provide specific target dates for features.

However given this has just moved to Coming Soon, that's a good sign! 😅

[sankareds]

+1

[max-lobur]

How is it supposed to be PCI compliant if I can't get an audit log (k8s events / api logs)

[pc-rshetty]

Our migration to EKS has come to a halt due to this. From security and audit perspective i have no way to know who did what. So this has become a blocker for us.

[tabern]

Just shipped! You can now send Kubernetes control plane logs from your EKS clusters to CloudWatch Logs.

• https://aws.amazon.com/about-aws/whats-new/2019/04/amazon-eks-now-delivers-kubernetes-control-plane-logs-to-amazon-/
• https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html

[nickschuch]

Super awesome! Thanks to everyone involved!

[pc-rshetty]

thank you very much AWS EKS team

[bnutt]

Thank you for this!

[StevenACoffman]

Can you enable this with cloudformation yet? The API yes: https://docs.aws.amazon.com/eks/latest/APIReference/API_CreateCluster.html

[tabern]

@pc-rshetty so happy to hear that this unblocked you!
@StevenACoffman - yes. I've opened https://github.com/aws/containers-roadmap/issues/242 to track this.

[rtkgjacobs]

Side note, this isn't available within troposphere yet. I already opened a ticket there.

See (or vote) - https://github.com/cloudtools/troposphere/issues/1362

[pc-rshetty]

@tabern yeah our Security and compliance had refused to let us migrate if this was not in place. so thank you very much. We moved couple into EKS but to move all existing production workload we need it to be fool proof.

[pc-rshetty]

Today i saw on our prod cloudwatch(we did not configure master logs yet) that kube-controller-manager, authenticator, kube-apiserver-audit logs showingup. I haven't researched on it yet but is it due to this new feature(some kind of default )

[pc-rshetty]

ok sorry , i just checked our devops went superfast and enabled it :) so that explains why we see the logs now.