-
Notifications
You must be signed in to change notification settings - Fork 4
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: 🎸 write audit logs to file (#65)
* feat: 🎸 write audit logs to file * terraform-docs: automated action --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
- Loading branch information
1 parent
d14ef16
commit 2999f1d
Showing
7 changed files
with
347 additions
and
35 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,201 @@ | ||
| resource "kubernetes_config_map" "fluent-bit-config" { | ||
| count = var.enable_modsec ? 1 : 0 | ||
|
|
||
| metadata { | ||
| name = "fluent-bit-config" | ||
| namespace = "ingress-controllers" | ||
| labels = { | ||
| "k8s-app" = var.controller_name | ||
| } | ||
| } | ||
| data = { | ||
| "fluent-bit.conf" = <<-EOT | ||
| [SERVICE] | ||
| Flush 1 | ||
| Log_Level info | ||
| Daemon Off | ||
| Grace 30 | ||
| Parsers_File parsers.conf | ||
| Parsers_File custom_parsers.conf | ||
| HTTP_Server On | ||
| HTTP_Listen 0.0.0.0 | ||
| HTTP_Port 2020 | ||
| Storage.path /var/log/flb-storage/ | ||
| Storage.max_chunks_up 64 | ||
| Storage.backlog.mem_limit 5MB | ||
| [INPUT] | ||
| Name tail | ||
| Alias modsec_nginx_ingress_audit_index | ||
| Tag cp-ingress-modsec-index-audit.* | ||
| Path /var/log/audit/*.log | ||
| Parser modsec-audit-log-index | ||
| Refresh_Interval 5 | ||
| Buffer_Max_Size 5MB | ||
| Buffer_Chunk_Size 1M | ||
| Offset_Key pause_position_modsec-audit-index | ||
| DB cp-ingress-modsec-audit-index.db | ||
| DB.locking true | ||
| Storage.type filesystem | ||
| Storage.pause_on_chunks_overlimit True | ||
| [INPUT] | ||
| Name tail | ||
| Alias modsec_nginx_ingress_audit | ||
| Tag cp-ingress-modsec-audit.* | ||
| Path /var/log/audit/**/**/* | ||
| Parser docker | ||
| Refresh_Interval 5 | ||
| Buffer_Max_Size 5MB | ||
| Buffer_Chunk_Size 1M | ||
| Offset_Key pause_position_modsec-audit | ||
| DB cp-ingress-modsec-audit.db | ||
| DB.locking true | ||
| Storage.type filesystem | ||
| Storage.pause_on_chunks_overlimit True | ||
| [FILTER] | ||
| Name lua | ||
| Match cp-ingress-modsec-audit.* | ||
| script /fluent-bit/scripts/cb_extract_tag_value.lua | ||
| call cb_extract_tag_value | ||
| [FILTER] | ||
| Name parser | ||
| Parser generic-json | ||
| Match cp-ingress-modsec-audit.* | ||
| Key_Name log | ||
| Reserve_Data On | ||
| Preserve_Key On | ||
| [OUTPUT] | ||
| Name opensearch | ||
| Alias modsec_nginx_ingress_audit | ||
| Match * | ||
| Host ${var.opensearch_modsec_audit_host} | ||
| Port 443 | ||
| Type _doc | ||
| Time_Key @timestamp | ||
| Logstash_Prefix ${var.cluster}_k8s_modsec_ingress | ||
| tls On | ||
| Logstash_Format On | ||
| Replace_Dots On | ||
| Generate_ID On | ||
| Retry_Limit False | ||
| AWS_AUTH On | ||
| AWS_REGION eu-west-2 | ||
| Suppress_Type_Name On | ||
| Buffer_Size False | ||
| EOT | ||
|
|
||
| "custom_parsers.conf" = <<-EOT | ||
| [PARSER] | ||
| Name modsec-audit-log-index | ||
| Format regex | ||
| Regex ^(?<url>[^ ]+) (?<client_ip>[^ ]+) (?<log>.*)$ | ||
| Time_Key time | ||
| Time_Format %d/%m/%Y:T%H:%M:%S.%z | ||
| [PARSER] | ||
| Name initial-json | ||
| Format json | ||
| Time_Key time | ||
| Time_Keep On | ||
| [PARSER] | ||
| Name generic-json | ||
| Format json | ||
| Time_Key time | ||
| Time_Format %Y-%b-%dT%H:%M:%S | ||
| Time_Keep On | ||
| # Command | Decoder | Field | Optional Action | ||
| # =============|==================|================= | ||
| Decode_Field_As escaped_utf8 log do_next | ||
| Decode_Field_As json log | ||
| EOT | ||
| } | ||
|
|
||
| depends_on = [ | ||
| kubernetes_namespace.ingress_controllers, | ||
| ] | ||
|
|
||
| lifecycle { | ||
| ignore_changes = [metadata[0].annotations] | ||
| } | ||
| } | ||
|
|
||
| resource "kubernetes_config_map" "fluent_bit_lua_script" { | ||
| count = var.enable_modsec ? 1 : 0 | ||
|
|
||
| metadata { | ||
| name = "fluent-bit-luascripts" | ||
| namespace = "ingress-controllers" | ||
| labels = { | ||
| "k8s-app" = var.controller_name | ||
| } | ||
| } | ||
| data = { | ||
| "cb_extract_tag_value.lua" = <<-EOT | ||
| function cb_extract_tag_value(tag, timestamp, record) | ||
| local github_team = string.gmatch(record["log"], '%[tag "github_team=([%a+|%-]*)"%]') | ||
| local github_team_from_json = string.gmatch(record["log"], '"tags":%[.*"github_team=([%a+|%-]*)".*%]') | ||
| local new_record = record | ||
| local team_matches = {} | ||
| local json_matches = {} | ||
| for team in github_team do | ||
| table.insert(team_matches, team) | ||
| end | ||
| for team in github_team_from_json do | ||
| table.insert(json_matches, team) | ||
| end | ||
| if #team_matches > 0 then | ||
| new_record["github_teams"] = team_matches | ||
| return 1, timestamp, new_record | ||
| elseif #json_matches > 0 then | ||
| new_record["github_teams"] = json_matches | ||
| return 1, timestamp, new_record | ||
| else | ||
| return 0, timestamp, record | ||
| end | ||
| end | ||
| EOT | ||
| } | ||
|
|
||
| depends_on = [ | ||
| kubernetes_namespace.ingress_controllers, | ||
| ] | ||
|
|
||
| lifecycle { | ||
| ignore_changes = [metadata[0].annotations] | ||
| } | ||
| } | ||
|
|
||
| resource "kubernetes_config_map" "modsecurity_nginx_config" { | ||
| count = var.enable_modsec ? 1 : 0 | ||
|
|
||
| metadata { | ||
| name = "modsecurity-nginx-config" | ||
| namespace = "ingress-controllers" | ||
| labels = { | ||
| "k8s-app" = var.controller_name | ||
| } | ||
| } | ||
| data = { | ||
| "modsecurity.conf" = file("${path.module}/templates/modsecurity.conf"), | ||
| } | ||
|
|
||
| depends_on = [ | ||
| kubernetes_namespace.ingress_controllers, | ||
| ] | ||
|
|
||
| lifecycle { | ||
| ignore_changes = [metadata[0].annotations] | ||
| } | ||
| } | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,69 @@ | ||
| resource "kubernetes_service_account_v1" "restart_modsec_containers" { | ||
| metadata { | ||
| name = "restart-modsec-containers" | ||
| namespace = "ingress-controllers" | ||
| } | ||
| } | ||
|
|
||
| resource "kubernetes_role_v1" "restart_modsec_containers" { | ||
| metadata { | ||
| name = "restart-modsec-containers" | ||
| namespace = "ingress-controllers" | ||
| } | ||
|
|
||
| rule { | ||
| api_groups = ["apps", "applications"] | ||
| resources = ["deployments"] | ||
| verbs = ["get", "list", "patch"] | ||
| } | ||
| } | ||
|
|
||
| resource "kubernetes_role_binding_v1" "restart_modsec_containers" { | ||
| metadata { | ||
| name = "restart-modsec-containers" | ||
| namespace = "ingress-controllers" | ||
| } | ||
| role_ref { | ||
| api_group = "rbac.authorization.k8s.io" | ||
| kind = "Role" | ||
| name = "restart-modsec-containers" | ||
| } | ||
| subject { | ||
| kind = "ServiceAccount" | ||
| name = "restart-modsec-containers" | ||
| namespace = "ingress-controllers" | ||
| } | ||
| } | ||
|
|
||
| resource "kubernetes_cron_job_v1" "restart_modsec_containers" { | ||
| metadata { | ||
| name = "restart-modsec-containers-nightly" | ||
| namespace = "ingress-controllers" | ||
| } | ||
| spec { | ||
| concurrency_policy = "Forbid" | ||
| failed_jobs_history_limit = 2 | ||
| schedule = "00 23 * * *" | ||
| starting_deadline_seconds = 10 | ||
| successful_jobs_history_limit = 0 | ||
| job_template { | ||
| metadata {} | ||
| spec { | ||
| backoff_limit = 2 | ||
| active_deadline_seconds = 600 | ||
| ttl_seconds_after_finished = 10 | ||
| template { | ||
| metadata {} | ||
| spec { | ||
| service_account_name = "restart-modsec-containers" | ||
| container { | ||
| name = "kubectl" | ||
| image = "bitnami/kubectl" | ||
| command = ["kubectl", "rollout", "restart", "deployment/nginx-ingress-modsec-controller"] | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.