Collect & forward OVN audit logs

What is the problem that your customer is facing?

Recently (OCP 4.8), the OVNKubernetes plugin introduced a new feature where audit logs can be collected which allows for gathering more information about network policies.

As with any other audit log, this is considered sensitive information and often has to be handled in a different pipeline than other container logs.

What is the business impact, if any, if this request will not be made available?

Customers in regulated industries will have to come up with their own log forwarding solution just for this type of log. Otherwise, they might use a side-car container to output the logs, which would forward them to the regular bucket of logs. Which, if found by an auditor, is considered a finding that might affect their compliance targets.

What are your expectations for this feature

The Cluster Logging Operator already has a log forwarding feature that takes audit logs into account.

It is expected that if these OVN audit logs (which are persisted in the /ovn/acl-audit-log.log file) are found, they will be collected, and can be forwarded using the audit inputRef.

Have you done this before and/or outside of support and if yes, how?

No.