Kong Mesh audit logs

Access auditing allows you to track all actions executed in Kong Mesh, including actions performed by users and by the Control Plane.

The AccessAudit resource defines which actions and resource types should be audited. It is global-scoped, meaning it applies across all meshes.

type: AccessAudit
name: audit-1
rules:
- types: ["TrafficPermission", "TrafficRoute", "Mesh"] 
  mesh: default 
  access: ["CREATE", "UPDATE", "DELETE"] 
  accessAll: true 

apiVersion: kuma.io/v1alpha1
kind: AccessAudit
metadata:
  name: role-1
spec:
  rules:
  - types: ["TrafficPermission", "TrafficRoute", "Mesh"]
    mesh: default
    access: ["CREATE", "UPDATE", "DELETE"]
    accessAll: true

The following table describes the different parameters you can set when configuring audit logs:

If types is not specified in an AccessAudit rule, all types are audited except those defined in the Control Plane config under kmesh.access.audit.skipDefaultTypes. These excluded types include status and insight resources that are managed solely by the Control Plane.

Additional audit log actions

Aside from CREATE, UPDATE, DELETE, AccessAudit also lets you audit all actions that are controllable with RBAC:

• GENERATE_DATAPLANE_TOKEN (you can use mesh to audit only tokens generated for specific mesh)
• GENERATE_USER_TOKEN
• GENERATE_ZONE_CP_TOKEN
• GENERATE_ZONE_TOKEN
• VIEW_CONFIG_DUMP
• VIEW_STATS
• VIEW_CLUSTERS

The backend is external storage that persists audit logs. There is one available backend: a JSON file.

JSON file

The JSON file is a backend that persists audit logs to a single file in JSON format. You can configure the file backend with the Control Plane config.

The file backend can only be configured using YAML config, not environment variables.

kmesh:
  access:
    audit:
      skipDefaultTypes: ["DataplaneInsight", "ZoneIngressInsight", "ZoneEgressInsight", "ZoneInsight", "ServiceInsight", "MeshInsight"]
      backends:
      - type: file
        file:
          path: /tmp/audit.logs
          rotation:
            enabled: true
            maxRetainedFiles: 10
            maxSizeMb: 100
            maxAgeDays: 30

The following table describes the different parameters you can set when configuring the audit log backend:

In a multi-zone setup, AccessAudit is not synchronized between the global Control Plane and the zone Control Plane.