Red Hat OpenShift Container Platform

Disabling audit logging

You can disable audit logging for Red Hat OpenShift Container Platform. When you disable audit logging, even OAuth access token requests and OAuth authorize token requests are not logged.

It is not recommended to disable audit logging by using the None profile unless you are fully aware of the risks of not logging data that can be beneficial when troubleshooting issues. If you disable audit logging and a support situation arises, you might need to enable audit logging and reproduce the issue in order to troubleshoot properly.

Prerequisites

You have access to the cluster as a user with the cluster-admin role.

Procedure

Edit the APIServer resource:
```
$ oc edit apiserver cluster
```
Set the spec.audit.profile field to None:
```
apiVersion: config.openshift.io/v1
kind: APIServer
metadata:
...
spec:
  audit:
    profile: None
```
You can also disable audit logging only for specific groups by specifying custom rules in the spec.audit.customRules field.
Save the file to apply the changes.

Verification

Verify that a new revision of the Kubernetes API server pods is rolled out. It can take several minutes for all nodes to update to the new revision.
```
$ oc get kubeapiserver -o=jsonpath='{range .items[0].status.conditions[?(@.type=="NodeInstallerProgressing")]}{.reason}{"\n"}{.message}{"\n"}'
```
Review the NodeInstallerProgressing status condition for the Kubernetes API server to verify that all nodes are at the latest revision. The output shows AllNodesAtLatestRevision upon successful update:
```
AllNodesAtLatestRevision
3 nodes are at revision 12
```
In this example, the latest revision number is 12.

If the output shows a message similar to one of the following messages, the update is still in progress. Wait a few minutes and try again.
- 3 nodes are at revision 11; 0 nodes have achieved new revision 12
- 2 nodes are at revision 11; 1 nodes are at revision 12