> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# OCI OKE Should Capture Security-Relevant Events Without Restriction

### More Info:

Cluster audit logs and security-relevant events should be captured without truncation or sampling so post-incident forensics, anomaly detection, and compliance evidence are reliable. Stream logs to a tamper-evident destination.

### Risk Level

High

### Address

Compliance, Logging, Security

### Compliance Standards

* CIS OKE

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Below are console-only steps to ensure OKE captures **all security‑relevant events without restriction** using OCI Logging.

        This focuses on:

        * Enabling all available **OKE control plane logs** (API server, audit, scheduler, controller)
        * Ensuring logs are **not filtered** and are persisted appropriately

        ***

        ### 1. Open Your OKE Cluster

        1. Sign in to the **OCI Console**.
        2. In the left menu, go to **Developer Services → Kubernetes Clusters (OKE)**.
        3. Select the **Compartment** where your cluster resides.
        4. Click the **name of the cluster** you want to fix.

        ***

        ### 2. Enable All Control Plane Logs

        1. On the cluster details page, go to the **Logs** tab.

        2. For each available log type (names can vary slightly by version/shape), do the following:

           * `kube-apiserver` or `kubernetes API server`
           * `kube-apiserver audit` / `kubernetes API server audit`
           * `kube-controller-manager`
           * `kube-scheduler`
           * Any other OKE control plane logs presented

           For each:

           a. If you see **Enable log** or **Create log**:

           * Click **Enable log**.
           * Choose or create a **Log Group**:
             * Prefer a dedicated group like `oke-control-plane-logs` in the same **Compartment**.
           * Make sure **Log Type** is set to **Service Log**.
           * Do **not** add any filters; keep the default to capture **all events**.
           * Click **Enable** or **Create**.

        3. Confirm that the **Status** for each key log is now **Enabled**.

        ***

        ### 3. Set Log Retention (No Restrictive Filters)

        1. Go to **Observability & Management → Logging → Log Groups**.
        2. Select the **Compartment** and choose the log group you used (e.g., `oke-control-plane-logs`).
        3. Open each OKE log you just enabled.
        4. In each log:
           * Click **Edit Log**.
           * Ensure there are **no “Include/Exclude” filters** configured. If filters exist, clear them so that:
             * All severities are captured.
             * All categories/paths are captured.
           * Set an appropriate **Retention Period** (e.g., 90 days or per your policy).
           * Save changes.

        This ensures logs are **not restricted** at the log configuration level.

        ***

        ### 4. (Optional but Recommended) Persist Logs to Storage/Analytics

        To make sure security‑relevant events are preserved and queryable:

        1. Go to **Observability & Management → Service Connectors**.
        2. Click **Create Service Connector**.
        3. Configure:
           * **Source**: Logging
             * Select the **Compartment** and **Log Group** used for OKE.
             * Do **not** configure any filter; select all the OKE logs.
           * **Target**:
             * Either **Object Storage** (for long‑term archival)
               * Choose/create a **Bucket** dedicated for audit/security logs
             * Or **Logging Analytics** (for search/analytics)
        4. Complete and **Create** the connector.

        This avoids event loss and supports compliance use cases.

        ***

        ### 5. Verify Events Are Flowing

        1. Go to **Observability & Management → Logging**.
        2. Open the OKE log group and each log stream (API server, audit, etc.).
        3. Confirm:
           * New log entries appear when you perform actions on the cluster (e.g., `kubectl create namespace`, `kubectl auth can-i`).
           * Events show full detail (no indication of dropped or filtered events).

        ***

        These steps ensure OKE is capturing **all security‑relevant control plane events without restriction**, with central logging and optional archival or analytics as required by most security benchmarks.
      </Accordion>

      <Accordion title="Using CLI">
        Below are CLI-focused steps to ensure OKE (OCI Container Engine for Kubernetes) captures all security‑relevant events (i.e., all available service logs) without restriction.

        > Assumptions:\
        > – You have OCI CLI configured (`oci setup config`) with appropriate permissions.\
        > – You know the OCID of your OKE cluster and your compartment.

        ***

        ## 1. Identify Required IDs

        ```bash theme={null}
        # Set your compartment OCID
        COMPARTMENT_OCID="<your_compartment_ocid>"

        # (Optional) List OKE clusters to get the cluster OCID
        oci ce cluster list \
          --compartment-id "$COMPARTMENT_OCID" \
          --all

        # Set the OKE cluster OCID
        CLUSTER_OCID="<your_oke_cluster_ocid>"

        # Get a logging log group (or create a new one)
        oci logging log-group list \
          --compartment-id "$COMPARTMENT_OCID"

        # If none or you want a dedicated one:
        LOG_GROUP_NAME="oke-security-logs"
        LOG_GROUP_OCID=$(oci logging log-group create \
          --compartment-id "$COMPARTMENT_OCID" \
          --display-name "$LOG_GROUP_NAME" \
          --query 'data.id' --raw-output)
        ```

        If you already have a log group, just set:

        ```bash theme={null}
        LOG_GROUP_OCID="<existing_log_group_ocid>"
        ```

        ***

        ## 2. Discover All Available OKE Log Categories

        You want **all** categories so you don’t restrict security‑relevant events.

        ```bash theme={null}
        oci logging log list-categories \
          --compartment-id "$COMPARTMENT_OCID" \
          --service "containerengine"
        ```

        Note the list of categories returned (examples, actual names may differ by region/version):

        * `cluster`
        * `controlplane`
        * `apiserver`
        * `scheduler`
        * `controller-manager`
        * `audit`\
          etc.

        You will create a log for **each** category you want captured.

        ***

        ## 3. Enable All OKE Service Logs (No Filtering)

        For each category from step 2, create a service log associated with the OKE cluster and ensure it is enabled.

        Example Bash loop:

        ```bash theme={null}
        # Example: categories derived from `log list-categories`
        CATEGORIES=("cluster" "controlplane" "apiserver" "scheduler" "controller-manager" "audit")

        for CATEGORY in "${CATEGORIES[@]}"; do
          echo "Creating/enabling log for category: $CATEGORY"

          oci logging log create \
            --log-group-id "$LOG_GROUP_OCID" \
            --display-name "oke-${CATEGORY}-log" \
            --log-type "SERVICE" \
            --is-enabled true \
            --configuration '{
              "source": {
                "category": "'"$CATEGORY"'",
                "resource": "'"$CLUSTER_OCID"'",
                "service": "containerengine"
              }
            }'
        done
        ```

        Key points:

        * `--log-type "SERVICE"` for service logs.
        * `--is-enabled true` ensures logging is active.
        * No filter/retention restriction is applied here; every event of each category is captured.

        ***

        ## 4. (Optional) Verify Logs Are Enabled and Active

        ```bash theme={null}
        oci logging log list \
          --log-group-id "$LOG_GROUP_OCID" \
          --all \
          --query 'data[].{name:"display-name",enabled:"is-enabled",category:"configuration.source.category"}'
        ```

        Ensure all categories you care about are present and `is-enabled` is `true`.

        ***

        ## 5. (Optional but Recommended) Ensure Audit Logs Are Collected

        OCI Audit is always on at the tenancy level, but ensure you are exporting them centrally:

        ```bash theme={null}
        # List Audit service log categories
        oci logging log list-categories \
          --compartment-id "$COMPARTMENT_OCID" \
          --service "audit"

        # Create a log for the audit service (no restriction)
        oci logging log create \
          --log-group-id "$LOG_GROUP_OCID" \
          --display-name "tenancy-audit-log" \
          --log-type "SERVICE" \
          --is-enabled true \
          --configuration '{
            "source": {
              "category": "audit",
              "service": "audit"
            }
          }'
        ```

        ***

        This configuration ensures OKE control plane / cluster and tenancy audit events are captured via Logging without category‑based restriction, which aligns with the requirement that security‑relevant events be captured comprehensively.
      </Accordion>

      <Accordion title="Using Python">
        Below is how you remediate “OCI OKE should capture security-relevant events without restriction” using Python and the OCI SDK, by enabling OKE service logs (especially `audit`) with no filters.

        ### 1. Prerequisites

        1. Install OCI SDK:

        ```bash theme={null}
        pip install oci
        ```

        2. Configure OCI CLI/SDK auth at `~/.oci/config`:

        ```ini theme={null}
        [DEFAULT]
        user=ocid1.user.oc1..xxxx
        fingerprint=xx:xx:xx:xx
        key_file=/path/to/private_key.pem
        tenancy=ocid1.tenancy.oc1..xxxx
        region=eu-frankfurt-1
        ```

        3. Collect:

        * `compartment_ocid` where the OKE cluster lives
        * `cluster_ocid` for the OKE cluster you want to fix

        ***

        ### 2. Python script to enable OKE audit (and other) logs without restriction

        ```python theme={null}
        import oci

        # -------- CONFIG --------
        PROFILE = "DEFAULT"
        COMPARTMENT_ID = "ocid1.compartment.oc1..xxxxx"
        CLUSTER_OCID = "ocid1.cluster.oc1..xxxxx"
        LOG_GROUP_NAME = "oke-security-logs"
        # ------------------------

        config = oci.config.from_file("~/.oci/config", PROFILE)
        logging_client = oci.logging.LoggingManagementClient(config)

        def get_or_create_log_group(compartment_id, log_group_name):
            # Check if log group exists
            existing = logging_client.list_log_groups(
                compartment_id=compartment_id,
                display_name=log_group_name,
                lifecycle_state="ACTIVE"
            ).data

            if existing:
                return existing[0]

            # Create if not
            create_details = oci.logging.models.CreateLogGroupDetails(
                compartment_id=compartment_id,
                display_name=log_group_name,
                description="Log group for OKE security-relevant logs"
            )
            response = logging_client.create_log_group(create_details)
            oci.wait_until(
                logging_client,
                logging_client.get_log_group(response.data.id),
                "lifecycle_state",
                "ACTIVE"
            )
            return response.data

        def find_containerengine_service(compartment_id):
            # Discover the Container Engine (OKE) logging service
            services = logging_client.list_services(compartment_id=compartment_id).data
            for svc in services:
                # Service name is usually "containerengine" or "oke"-like; print to verify if needed.
                if svc.name.lower() in ("containerengine", "oke"):
                    return svc
            raise RuntimeError("Could not find OKE/containerengine logging service in this compartment.")

        def list_oke_log_categories(compartment_id, service_id):
            categories = logging_client.list_log_categories(
                compartment_id=compartment_id,
                service_id=service_id
            ).data
            return categories

        def ensure_log_enabled_for_category(log_group_id, service, category_name, cluster_ocid):
            # Check if log already exists
            existing_logs = logging_client.list_logs(
                log_group_id=log_group_id,
                display_name=f"OKE-{category_name}",
                lifecycle_state="ACTIVE"
            ).data

            if existing_logs:
                # Ensure it's enabled
                log_id = existing_logs[0].id
                log = logging_client.get_log(log_group_id, log_id).data
                if not log.is_enabled:
                    update_details = oci.logging.models.UpdateLogDetails(
                        is_enabled=True
                    )
                    logging_client.update_log(
                        log_group_id=log_group_id,
                        log_id=log_id,
                        update_log_details=update_details
                    )
                return

            # Create log: no log_filter = no restriction (captures all events in that category)
            create_log_details = oci.logging.models.CreateLogDetails(
                display_name=f"OKE-{category_name}",
                log_type="SERVICE",
                is_enabled=True,
                configuration=oci.logging.models.Configuration(
                    source=oci.logging.models.OciService(
                        # service / resource / category tell Logging which OKE stream to capture
                        service=service.name,
                        resource=CLUSTER_OCID,
                        category=category_name
                    )
                    # log_filter left empty to avoid any restriction
                )
            )

            response = logging_client.create_log(
                log_group_id=log_group_id,
                create_log_details=create_log_details
            )
            oci.wait_until(
                logging_client,
                logging_client.get_log(log_group_id, response.data.id),
                "lifecycle_state",
                "ACTIVE"
            )

        def main():
            # 1. Ensure log group exists
            log_group = get_or_create_log_group(COMPARTMENT_ID, LOG_GROUP_NAME)

            # 2. Find OKE (containerengine) logging service
            oke_service = find_containerengine_service(COMPARTMENT_ID)

            # 3. List available log categories for OKE
            categories = list_oke_log_categories(COMPARTMENT_ID, oke_service.id)

            # Security-relevant categories (names can vary by region/tenancy; print categories to verify)
            # Common: "audit", "kubernetes", "apiserver", etc.
            security_categories = {"audit", "kubernetes", "apiserver", "cluster"}

            for cat in categories:
                if cat.name.lower() in security_categories:
                    ensure_log_enabled_for_category(
                        log_group_id=log_group.id,
                        service=oke_service,
                        category_name=cat.name,
                        cluster_ocid=CLUSTER_OCID
                    )
                    print(f"Ensured OKE log category '{cat.name}' is enabled and unrestricted.")

        if __name__ == "__main__":
            main()
        ```

        ***

        ### 3. What this does (in terms of the requirement)

        * Creates (or reuses) a log group dedicated to OKE security logs.
        * Discovers the OKE logging service and its log categories.
        * For each security-relevant category (`audit`, etc.), creates a **SERVICE** log:
          * `is_enabled=True`
          * **no `log_filter`** configured → all events in that category are captured (no restriction).
        * Ensures existing logs are enabled if they were disabled.

        If you paste the output of `list_services` / `list_log_categories` for your tenancy, I can adjust the exact `security_categories` for your environment.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # Existing OKE cluster (for reference)
        resource "oci_containerengine_cluster" "OKE_CLUSTER" {
          # Replace with your existing cluster arguments
          name          = "OKE_CLUSTER_NAME"
          compartment_id = "COMPARTMENT_OCID"
          vcn_id         = "VCN_OCID"
          # ...
        }

        # Log group to hold OKE control plane / audit logs
        resource "oci_logging_log_group" "OKE_LOG_GROUP" {
          compartment_id = "COMPARTMENT_OCID"            # REPLACE with the compartment that owns the cluster
          display_name   = "OKE_CLUSTER_SECURITY_LOGS"   # REPLACE if desired
          description    = "Security-relevant OKE control plane logs"
        }

        # Enable all available OKE service logs (including audit / security-relevant events)
        resource "oci_logging_log" "OKE_CLUSTER_ALL_LOGS" {
          display_name = "OKE_CLUSTER_ALL_LOGS"          # REPLACE if desired
          log_group_id = oci_logging_log_group.OKE_LOG_GROUP.id
          log_type     = "SERVICE"

          configuration {
            source {
              # "all" ensures no category-based truncation and captures every log category
              category = "all"
              service  = "kubernetes"                    # OKE control plane logs
              resource = oci_containerengine_cluster.OKE_CLUSTER.id
            }
          }

          is_enabled = true
        }

        # (Optional but recommended) Object Storage bucket for tamper-evident archival
        resource "oci_objectstorage_bucket" "OKE_LOG_ARCHIVE_BUCKET" {
          compartment_id = "COMPARTMENT_OCID"            # REPLACE
          namespace      = "OBJECT_STORAGE_NAMESPACE"    # REPLACE
          name           = "oke-security-logs-archive"   # REPLACE
          storage_tier   = "Standard"

          # (Optional) Add retention rules / immutability here if required by your policy
          # retention_rules { ... }
        }

        # (Optional but recommended) Service Connector: stream logs to the archive bucket
        resource "oci_sch_service_connector" "OKE_LOG_SERVICE_CONNECTOR" {
          compartment_id = "COMPARTMENT_OCID"            # REPLACE
          display_name   = "oke-security-logs-to-objstore"

          source {
            kind = "logging"

            log_sources {
              log_group_id = oci_logging_log_group.OKE_LOG_GROUP.id
              log_id       = oci_logging_log.OKE_CLUSTER_ALL_LOGS.id
            }
          }

          target {
            kind = "objectstorage"

            bucket {
              bucket_name = oci_objectstorage_bucket.OKE_LOG_ARCHIVE_BUCKET.name
              namespace   = oci_objectstorage_bucket.OKE_LOG_ARCHIVE_BUCKET.namespace
            }
          }

          state = "ACTIVE"
        }
        ```

        This change does **not** replace the existing `oci_containerengine_cluster` resource; it only adds logging and streaming resources around it.

        To verify, `terraform plan` should show:

        * `+` creation of `oci_logging_log_group.OKE_LOG_GROUP`
        * `+` creation of `oci_logging_log.OKE_CLUSTER_ALL_LOGS` with `is_enabled = true` and `category = "all"`
        * `+` creation of `oci_objectstorage_bucket.OKE_LOG_ARCHIVE_BUCKET` (if included)
        * `+` creation of `oci_sch_service_connector.OKE_LOG_SERVICE_CONNECTOR` (if included)
        * `~` **no** changes to `oci_containerengine_cluster.OKE_CLUSTER`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>