[Enhancement]: Retain Audit Logs for 7 days

[adambkaplan]

Design Document Link

PR: #

What would you like to be added:

The kube-apiserver has several parameters which allow audit log retention to be tuned. This is exposed by the following flags:

• --audit-log-maxage defines the maximum number of days to retain old audit log files
• --audit-log-maxbackup defines the maximum number of audit log files to retain
• --audit-log-maxsize defines the maximum size in megabytes of the audit log file before it gets rotated

This enhancement sets the --audit-log-maxage setting to 7 days if microshift is configured with an audit log directory.

See https://kubernetes.io/docs/tasks/debug-application-cluster/audit/

Why is this needed:

With default settings, the audit logs on a minimal cluster can grow quite large. I deployed microshift on a very old laptop with what is by today's standards absurdly small storage (15GB). My cluster ultimately died because the kube-apiserver audit logs generated over the course of ~20 days exceeded 5GB, exhausting the space on the drive.

[adambkaplan]

An alternative approach, in the spirit of "minimal configuration": if the audit log directory is provided, audit logs are retained for 7 days?

[fzdarsky]

Thank you @adambkaplan, I agree this needs addressing. My gut feeling is to default to a minimal level of audit logging (e.g. like you proposed) or maybe even disable audit logging, then provide a generic mechanism for users to pass parameters like these to kube-apiserver et al. I opened #618 for that.

[adambkaplan]

I've updated the title and description of this issue to reflect the code that was merged.