Pod Session Recordingsㅤ

Overview

QueryPie records activities within connection sessions, such as Pod Exec, on the API servers of Kubernetes clusters managed by your organization. Administrators can monitor the actions users perform within the container shell by playing back recorded sessions.

Viewing Pod Session Recordings

1. Navigate to the Administrator > Audit > Kubernetes > Pod Session Recordings menu.

2. Pod exec session logs are displayed in descending order in the table.

3. You can use the search bar at the top left of the table to search by the following criteria:

   1. Name : User name

   2. Email : User email

   3. Cluster Name : Cluster name as registered in QueryPie

   4. Client IP : User's client IP address

   5. Client Name : User's client name/version (e.g., kubectl/v1.27.3)

4. You may click the filter button next to the search field to adjust the date range for Action At.

   

5. Refresh the log list by clicking the refresh button at the top right of the table.

6. The table provides the following column information:

   1. No : Event identification number

   2. Action At : Session recording start date and time

   3. Name : User name

   4. Email : User email

   5. Cluster Name : Target Kubernetes cluster name

   6. Role : Role that allowed the action

   7. Client IP : User's client IP address

   8. Client Name : User's client name/version

   9. Connected From : Source of connection (currently only Proxy is listed)

Playing Pod Session Recordings

7. To play a session recording, click the Action At link for any row.

8. Clicking the Action At link opens a modal displaying the initial downloading process for playback.

   

9. Based on whether the recorded file exceeds 700MB in size, the interface will either display a playback screen or provide a download button.

   1. For recordings under 700MB:

      

      1. The top section displays basic information, and the bottom section shows the replay screen.

         1. Name: Executor's name

         2. Action At: Occurrence date and time (start)

         3. Session Recording Name: Recording name

      2. Click the play button to start the session replay.

         1. Click the pause button to stop the replay.

         2. Drag the timeline or click on the desired timestamp to jump to that part of the session.

      3. Click the Close button to exit the playback modal.

   2. For recordings over 700MB:

      

      1. Instead of the playback screen, a message and a download button are displayed.

         1. The file size exceeds 700MB and cannot be played directly.

         2. To view this session recording, please download the file.

      2. Click the Download button to save the file locally.

         1. If Administrator > General > Company Management > Security > Others > Export a file with Encryption is set to Required, an encryption modal will appear before the download starts.