trending/OpenShell
1
0
Fork 0
mirror of https://github.com/NVIDIA/OpenShell.git synced 2026-10-31 07:44:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

docs(website): sync dev docs from 915a5d1553

Browse Source
This commit is contained in:
github-actions[bot]
2026-10-20 22:35:20 +00:00
parent 2f928f761b
commit 4f17e473f1
3 changed files with 12 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fern/.docs-snapshots.yml
+3 -3
View File
@@ -1,8 +1,8 @@
snapshots:
dev:
source-ref: ea265a2f9a86e6fc1911041fec4b5fdcefd674dd
source-sha: ea265a2f9a86e6fc1911041fec4b5fdcefd674dd
version: 0.1.6.dev6
source-ref: 915a5d1553bdd48c15a85f7fa3266f0c695cbba1
source-sha: 915a5d1553bdd48c15a85f7fa3266f0c695cbba1
version: 0.1.6.dev8
latest:
source-ref: bdb956f2cd65a635f1294fccf1d138d263bf650f
source-sha: bdb956f2cd65a635f1294fccf1d138d263bf650f
fern/pages-dev/observability/logging.mdx
+7 -1
View File
@@ -60,7 +60,7 @@ OpenShell maps sandbox events to these OCSF classes:
| `SSH:` | SSH Activity | 4007 | SSH handshakes, authentication, channel operations |
| `PROC:` | Process Activity | 1007 | Process start, exit, timeout, signal failures |
| `FINDING:` | Detection Finding | 2004 | Security findings (nonce replay, proxy bypass, unsafe policy) |
| `AUTH:` | Authentication | 3002 | Gateway authentication failures |
| `AUTH:` | Authentication | 3002 | Gateway authentication failures and credential logons |
| `API:` | API Activity | 6003 | Inference calls, gateway authorization denials |
| `CONFIG:` | Device Config State Change | 5019 | Policy load/reload, Landlock, TLS setup, provider and settings changes |
| `LIFECYCLE:` | Application Lifecycle | 6002 | Sandbox supervisor start, SSH server ready |
@@ -115,6 +115,12 @@ A gateway request rejected because it presented no credential:
OCSF AUTH:LOGON [LOW] DENIED unknown [op:/openshell.v1.OpenShell/ListSandboxes reason:missing_credential]
```
The first request a gateway replica accepts with a user's OIDC token:
```text
OCSF AUTH:LOGON [INFO] ALLOWED user:8d2f6b1c-3e4a-4f5b-9c7d-0a1b2c3d4e5f from 203.0.113.7:51234 [protocol:OpenID op:/openshell.v1.OpenShell/ListSandboxes]
```
A sandbox credential used to read another sandbox's configuration:
```text
fern/pages-dev/observability/ocsf-json-export.mdx
+2
View File
@@ -37,6 +37,8 @@ The gateway emits an Authentication (`class_uid: 3002`) event when it rejects a
`src_endpoint` holds the address of the connection's immediate peer, which is the proxy or load balancer when one fronts the gateway, or the name `edge-tunnel` for requests carried over the WebSocket tunnel. `metadata.correlation_uid` holds the request's `x-request-id` when it is a UUID. The gateway generates one when the client sends none and returns it in the response. A client-supplied ID is recorded as sent, so it identifies the request, not the client.
The gateway also emits an Informational Authentication event with `status: Success` the first time a replica accepts a credential, such as a bearer token or client certificate. Later requests with the same credential emit nothing, so supervisor polling does not repeat the event. A refreshed token or renewed certificate is a new credential and logs on again, as does a credential still in use an hour later. Each replica records its own logons, and a replica tracking more than 16,384 credentials forgets the oldest early. `user` identifies the principal the same way `actor.user` does for authorization denials, described below. The `src_endpoint` and `metadata.correlation_uid` come from the request that logged on. Requests admitted by `auth.allow_unauthenticated_users`, or by a gateway with no authentication configured, emit no success event. To select only rejected requests, filter Authentication events on `status_id: 2` (Failure) rather than on `class_uid` alone.
These events never include presented credentials, other request headers, or verification error text.
The gateway emits an API Activity (`class_uid: 6003`) event with Medium severity when its method, role, scope, sandbox, workspace, or operator checks refuse an authenticated caller. `actor.user` identifies the principal: its `type` is `User`, `Admin` for an mTLS operator, `Sandbox`, or `Gateway Peer`, and `uid` is the subject, sandbox ID, or gateway replica ID. `api.operation` names the gRPC method, and `resources` names the sandbox or workspace that was refused, when one applies, by `uid` for a sandbox ID or by `name` otherwise. `status_detail` holds the reason category: