Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add PodSecurityPolicy admission information to audit logs #58075

Closed
wants to merge 3 commits into from
Closed

Add PodSecurityPolicy admission information to audit logs #58075

wants to merge 3 commits into from

Conversation

CaoShuFeng
Copy link
Contributor

@CaoShuFeng CaoShuFeng commented Jan 10, 2018 •
edited

Fix #56209

PS: I will add RBAC to support this too.

Release note:

Add PodSecurityPolicy admission information to audit logs

/cc @sttts
/cc @tallclair

@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Jan 10, 2018
CaoShuFeng
CaoShuFeng commented Jan 10, 2018
View reviewed changes
plugin/pkg/admission/admit/admission.go
@@ -37,12 +38,12 @@ var _ admission.MutationInterface = AlwaysAdmit{}
var _ admission.ValidationInterface = AlwaysAdmit{}

// Admit makes an admission decision based on the request attributes
func (AlwaysAdmit) Admit(a admission.Attributes) (err error) {
func (AlwaysAdmit) Admit(_ request.Context, a admission.Attributes) (err error) {
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can also insert audit into admission.Attributes.
But audit is not an attribute.

I hope I am in the right direction.

sttts
sttts reviewed Jan 10, 2018
View reviewed changes
plugin/pkg/admission/alwayspullimages/admission.go
@@ -50,7 +51,7 @@ var _ admission.MutationInterface = &AlwaysPullImages{}
var _ admission.ValidationInterface = &AlwaysPullImages{}

// Admit makes an admission decision based on the request attributes
func (a *AlwaysPullImages) Admit(attributes admission.Attributes) (err error) {
func (a *AlwaysPullImages) Admit(_ request.Context, attributes admission.Attributes) (err error) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

that's a deep and big change. Can't we attach the information to the admission.Attributes?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, we can attach ctx or audit to admission.Attributes.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

And also attach audit to authorizer attributes here?

kubernetes/staging/src/k8s.io/apiserver/pkg/endpoints/filters/authorization.go

Line 49 in 6b925ac

authorized, reason, err := a.Authorize(attributes)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What exactly is audit that you have in mind, which type?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What exactly is audit that you have in mind, which type?

Not very sure about this. But it seems to be something different from Verb, UserInfo.

But I am very happy to insert audit to admission.Attribute and authorizer.Attribute. In fact I use such way in the beginning. This will make code much simpler.
:)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would expect that a webhook can return an annotation map to persist in audit events.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

add a map to Admit() and Validate()s' return value?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We also mutate the object "in" admission.Attributes. We should also store the audit annotation in admission.Attributes instead of complicating the function signatures.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What about this:
#58143
I wrote it today.
I haven't meet a serialization promblem in #58143 yet.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We also mutate the object "in" admission.Attributes. We should also store the audit annotation in admission.Attributes instead of complicating the function signatures.

Does #58143 addressed this comment?

@CaoShuFeng CaoShuFeng changed the title Audit annotation Add PodSecurityPolicy admission information to audit logs Jan 10, 2018
@sttts
Copy link
Contributor

sttts commented Jan 10, 2018

/cc @liggitt @deads2k

@crassirostris crassirostris mentioned this pull request Jan 10, 2018
Closed
11 tasks
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: CaoShuFeng
We suggest the following additional approvers: derekwaynecarr, sttts

Assign the PR to them by writing /assign @derekwaynecarr @sttts in a comment when ready.

Associated issue: #56209

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

@soltysh
Copy link
Contributor

soltysh commented Jan 16, 2018

I think that #58143 is a better way (as do others), so this could be closed, right?

@CaoShuFeng
Copy link
Contributor Author

I think that #58143 is a better way (as do others), so this could be closed, right?

Sure.

@CaoShuFeng CaoShuFeng closed this Jan 16, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@sttts sttts sttts left review comments

@tallclair tallclair Awaiting requested review from tallclair

@deads2k deads2k Awaiting requested review from deads2k

@liggitt liggitt Awaiting requested review from liggitt

Assignees

@sttts sttts

@derekwaynecarr derekwaynecarr

Labels
cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
6 participants
@CaoShuFeng @sttts @k8s-ci-robot @soltysh @liggitt @derekwaynecarr