whizard-auditing

Use when working with WizTelemetry Auditing extension for KubeSphere, including installation, configuration, and audit query API

执行命令联网无严重或高危命中kubesphere/kubesphere

它会碰到什么

扫了多少1 个文本文件，9 KB

它会碰到什么执行命令联网

命中总数1 处

命中统计严重 0 · 高 0 · 中 0 · 低 0

这一栏是扫描器报的事实，不是结论。命中多不等于有毒（安全工具、规则库、示例脚本本来就会包含危险写法），命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系，需要你自己看。

技能内容

WizTelemetry Auditing

Overview

WizTelemetry Auditing is an extension component in the KubeSphere Observability Platform for Kubernetes and KubeSphere audit event collection, processing, and storage.

When to Use

Installing or configuring the WizTelemetry Auditing extension
Understanding audit event collection architecture
Using the audit query API to query audit events

Components

| Component | Description | Default Enabled |

|-----------|-------------|-----------------|

| kube-auditing | Kubernetes audit event collection and export | true |

Dependencies

WizTelemetry Platform Service (whizard-telemetry): Required
WizTelemetry Data Pipeline (vector): Required

Installation

Prerequisites

REQUIRED: Complete all steps in order before generating InstallPlan.

Step 1: Get Available Clusters and Confirm Target

⚠️ CRITICAL: DO NOT proceed until target clusters are determined.

Step 1.1: Get available clusters

kubectl get clusters -o jsonpath='{.items[*].metadata.name}'

Step 1.2: Determine target clusters

If user explicitly specified target clusters in the request → Use those clusters directly, proceed to Step 2
If user did NOT specify target clusters → Ask user to confirm which clusters to deploy to, then proceed to Step 2

Ask user (if not specified):

Available clusters: host, dev
Which clusters do you want to deploy WizTelemetry Auditing to?

Step 2: Get Latest Version (if not provided by user)

MUST do this to get the latest version:

kubectl get extensionversions -l kubesphere.io/extension-ref=whizard-auditing -o jsonpath='{range .items[*]}{.spec.version}{"\n"}{end}' | sort -V | tail -1

This outputs the latest version (e.g., 1.4.0). Note this down - you'll use it in the InstallPlan.

Install WizTelemetry Auditing

⚠️ IMPORTANT: Complete prerequisite steps BEFORE this step.

Based on your selections:

Target clusters: User-confirmed cluster names

⚠️ CRITICAL: InstallPlan metadata.name MUST be whizard-auditing. DO NOT use any other name.

⚠️ CRITICAL: config field is YAML format. You MUST:

Use the config structure exactly as shown in the template
DO NOT add configuration fields that are not shown in the template
DO NOT modify the structure or hierarchy

⚠️ CRITICAL: All placeholders MUST be replaced with actual values. DO NOT leave them as placeholders.

Template

apiVersion: kubesphere.io/v1alpha1
kind: InstallPlan
metadata:
  name: whizard-auditing
spec:
  extension:
    name: whizard-auditing
    version: <VERSION>  # From Step 2
  enabled: true
  upgradeStrategy: Manual
  clusterScheduling:
    placement:
      clusters:
        - <TARGET_CLUSTERS>

Replace placeholders:

<VERSION>: From Step 2 (e.g., 1.4.0)
<TARGET_CLUSTERS>: User-confirmed cluster names

Note: OpenSearch sink configuration (endpoints, auth) is provided by the vector extension. Make sure vector is installed and configured with OpenSearch before installing auditing.

Enable Doris Sink

To enable Doris sink for audit storage:

apiVersion: kubesphere.io/v1alpha1
kind: InstallPlan
metadata:
  name: whizard-auditing
spec:
  extension:
    name: whizard-auditing
    version: <VERSION>  # From Step 2
  enabled: true
  upgradeStrategy: Manual
  config: |
    kube-auditing:
      sinks:
        opensearch:
          enabled: true
          index:
            prefix: "{{ .cluster }}-auditing"
            timestring: "%Y.%m.%d"
        doris:
          enabled: true
          fe: <DORIS_FE>
          be: <DORIS_BE>
          table:
            partitionUnit: DAY
            retentionPartition: 7
            replicationNum: 2
  clusterScheduling:
    placement:
      clusters:
        - <TARGET_CLUSTERS>

Enable ISM Policy

apiVersion: kubesphere.io/v1alpha1
kind: InstallPlan
metadata:
  name: whizard-auditing
spec:
  extension:
    name: whizard-auditing
    version: <VERSION>  # From Step 2
  enabled: true
  upgradeStrategy: Manual
  config: |
    kube-auditing:
      sinks:
        opensearch:
          enabled: true
          index:
            prefix: "{{ .cluster }}-auditing"
            timestring: "%Y.%m.%d"
      ism_policy:
        enable: true
        min_index_age: "7d"
  clusterScheduling:
    placement:
      clusters:
        - <TARGET_CLUSTERS>

Configuration Parameters

OpenSearch Sink Parameters

|-----------|------|---------|-------------|

| kube-auditing.sinks.opensearch.index.prefix | string | "{{ .cluster }}-auditing" | Index prefix |

Doris Sink Parameters

|-----------|------|---------|-------------|

| kube-auditing.sinks.doris.table.retentionPartition | int | 7 | Retention partition |

| kube-auditing.sinks.doris.table.replicationNum | int | 2 | Replication number |

ISM Policy Parameters

|-----------|------|---------|-------------|

Audit Query API

Query Audit Events

curl -X GET "http://whizard-telemetry-apiserver.extension-whizard-telemetry.svc:80/kapis/logging.kubesphere.io/v1alpha2/auditing?operation=query&sort=desc&size=10&cluster=host" \
  -H "X-Remote-User: admin"

Query Parameters:

|-----------|------|---------|-------------|

| from | int | 0 | Offset |

| size | int | 10 | Number of results |

Extension Operations

Check Extension Status

kubectl get installplan whizard-auditing
kubectl get extensionversions -l kubesphere.io/extension-ref=whizard-auditing

Uninstall Extension

Uninstall from all clusters:

kubectl delete installplan whizard-auditing

Uninstall from specific cluster:

To remove WizTelemetry Auditing from a specific cluster, update the InstallPlan by removing that cluster from clusterScheduling.placement.clusters:

apiVersion: kubesphere.io/v1alpha1
kind: InstallPlan
metadata:
  name: whizard-auditing
spec:
  extension:
    name: whizard-auditing
    version: <VERSION>
  enabled: true
  upgradeStrategy: Manual
  clusterScheduling:
    placement:
      clusters:
        - <REMAINING_CLUSTERS>  # Remove the cluster you want to uninstall from

想直接用这个技能？

本站把开放许可（MIT / Apache 等）的技能按仓库打包整理到网盘，点一下转存到你自己的网盘，不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接，不打包。

去原始仓库

它属于哪个仓库

仓库kubesphere/kubesphere

星标★ 17,050

本站分层T1

该仓技能数32

原文件路径skills/whizard-auditing/SKILL.md

同一个仓库里的其他技能

看这个仓库的全部 32 个技能