Navigation Menu

Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add minimal audit policy to local-up-cluster #72487

Merged
merged 1 commit into from Feb 20, 2019
Merged

Add minimal audit policy to local-up-cluster #72487

merged 1 commit into from Feb 20, 2019

Conversation

dims
Copy link
Member

@dims dims commented Jan 2, 2019

Change-Id: Ia2cdb5a6a891665ece5365698f2989ba3782a5ec

What type of PR is this?
/kind feature

What this PR does / why we need it:
Add support for generating audit logs.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

NONE

@k8s-ci-robot k8s-ci-robot added release-note-none Denotes a PR that doesn't merit a release note. kind/feature Categorizes issue or PR as related to a new feature. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. labels Jan 2, 2019
@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 2, 2019
@dims
Copy link
Member Author

dims commented Jan 2, 2019

/test pull-kubernetes-local-e2e

liggitt
liggitt reviewed Jan 2, 2019
View reviewed changes
hack/local-up-cluster.sh Outdated Show resolved Hide resolved
@dims
Copy link
Member Author

dims commented Jan 10, 2019

/assign @liggitt

liggitt
liggitt reviewed Jan 10, 2019
View reviewed changes
hack/local-up-cluster.sh
APISERVER_LOG=${LOG_DIR}/kube-apiserver.log
${CONTROLPLANE_SUDO} "${GO_OUT}/hyperkube" apiserver ${swagger_arg} ${authorizer_arg} ${priv_arg} ${runtime_config} \
${cloud_config_arg} \
${advertise_address} \
${node_port_range} \
--v=${LOG_LEVEL} \
--vmodule="${LOG_SPEC}" \
--audit-policy-file=/tmp/kube-audit-policy-file \
--audit-log-path=${LOG_DIR}/kube-apiserver-audit.log \
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should we set --audit-log-maxsize to avoid filling disks with logs?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what size would you expect for a local cluster doing some testing?
planning to look at something similar for https://github.com/kubernetes-sigs/kind soon.

@liggitt
Copy link
Member

liggitt commented Jan 10, 2019

is the test failure related?

@dims
Copy link
Member Author

dims commented Jan 10, 2019

@liggitt i used it when trying to poking at th the audit log for the 0-length problem. but no, it's not related to any failures per se.

@dims dims force-pushed the add-minimal-audit-policy-to-local-up-cluster branch from d570e4d to 654ab35 Compare January 14, 2019 02:43
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dims

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@dims
Copy link
Member Author

dims commented Feb 5, 2019

/assign @BenTheElder @cblecker

liggitt
liggitt reviewed Feb 5, 2019
View reviewed changes
hack/local-up-cluster.sh Outdated
@@ -565,13 +565,23 @@ function start_apiserver {
cloud_config_arg="--cloud-provider=external"
fi

cat <<EOF > /tmp/kube-audit-policy-file
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

only do this if $AUDIT_POLICY_FILE is unset, and set AUDIT_POLICY_FILE to /tmp/kube-audit-policy-file here, and use --audit-policy-file="${AUDIT_POLICY_FILE}" \ below?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wish we weren't hardcoding to /tmp, but it's all over the file so it's not exactly going to break anyone.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I had the same thought, and the same follow up response. I wouldn't do something different just for this file

cblecker
cblecker reviewed Feb 6, 2019
View reviewed changes
Copy link
Member

@cblecker cblecker left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No bash concerns. I defer to @liggitt for the specific flags and format of the policy pile.

hack/local-up-cluster.sh Outdated
@@ -565,13 +565,23 @@ function start_apiserver {
cloud_config_arg="--cloud-provider=external"
fi

cat <<EOF > /tmp/kube-audit-policy-file
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wish we weren't hardcoding to /tmp, but it's all over the file so it's not exactly going to break anyone.

@dims
Copy link
Member Author

dims commented Feb 18, 2019

@liggitt @cblecker so can we let this in?

@liggitt
Copy link
Member

liggitt commented Feb 18, 2019

#72487 (comment) still applies

@dims
Add minimal audit policy to local-up-cluster
6b6bfb3 
Change-Id: Ia2cdb5a6a891665ece5365698f2989ba3782a5ec
@dims dims force-pushed the add-minimal-audit-policy-to-local-up-cluster branch from 654ab35 to 6b6bfb3 Compare February 18, 2019 16:19
@dims
Copy link
Member Author

dims commented Feb 18, 2019

@liggitt whoops! missed that. fixing now.

@anarchistHH1983
Copy link

anarchistHH1983 commented Feb 18, 2019 via email

@dims
Copy link
Member Author

dims commented Feb 18, 2019

/retest

@anarchistHH1983
Copy link

anarchistHH1983 commented Feb 18, 2019 via email

@dims
Copy link
Member Author

dims commented Feb 18, 2019

/priority important-soon
/sig testing

@k8s-ci-robot k8s-ci-robot added priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. sig/testing Categorizes an issue or PR as relevant to SIG Testing. and removed needs-priority Indicates a PR lacks a `priority/foo` label and requires one. needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Feb 18, 2019
@liggitt
Copy link
Member

liggitt commented Feb 20, 2019

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Feb 20, 2019
@k8s-ci-robot k8s-ci-robot merged commit b96342a into kubernetes:master Feb 20, 2019
@wongma7 wongma7 mentioned this pull request Jul 15, 2019
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@BenTheElder BenTheElder BenTheElder left review comments

@liggitt liggitt liggitt left review comments

@cblecker cblecker cblecker left review comments

@eparis eparis Awaiting requested review from eparis

@lavalamp lavalamp Awaiting requested review from lavalamp

Assignees

@BenTheElder BenTheElder

@liggitt liggitt

@cblecker cblecker

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/feature Categorizes issue or PR as related to a new feature. lgtm "Looks good to me", indicates that a PR is ready to be merged. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. release-note-none Denotes a PR that doesn't merit a release note. sig/testing Categorizes an issue or PR as relevant to SIG Testing. size/S Denotes a PR that changes 10-29 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
6 participants
@dims @liggitt @k8s-ci-robot @anarchistHH1983 @BenTheElder @cblecker