Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

add dynamic audit policy controller #460

Merged
merged 2 commits into from Jul 9, 2021
Merged

add dynamic audit policy controller #460

merged 2 commits into from Jul 9, 2021

Conversation

EmilyM1
Copy link
Contributor

@EmilyM1 EmilyM1 commented Jun 30, 2021

Removes static elements of audit policy and allows for dynamic creation with groups specified.

@openshift-ci openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 30, 2021
@openshift-ci openshift-ci bot requested review from stlaz and sttts June 30, 2021 22:04
@EmilyM1
Copy link
Contributor Author

EmilyM1 commented Jul 2, 2021

/test e2e-agnostic-upgrade

@EmilyM1
Copy link
Contributor Author

EmilyM1 commented Jul 2, 2021

/retest

@sttts
Copy link
Contributor

sttts commented Jul 3, 2021

The pod still tries to access /var/run/configmaps/audit/default.yaml. This must be /var/run/configmaps/audit/policy.yaml instead (in bindata).

@EmilyM1 EmilyM1 changed the title [WIP]add dynamic audit policy controller add dynamic audit policy controller Jul 6, 2021
@openshift-ci openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 6, 2021
sttts
sttts reviewed Jul 6, 2021
View reviewed changes
pkg/operator/workload/sync_openshift_oauth_apiserver_test.go
ObservedConfig: runtime.RawExtension{Raw: []byte(withDefaultsProvidedAPIServerArgsJSON)},
},
expectedAPIServerArguments: map[string][]string{
"api-audiences": {"https://now.something.different"},
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we preserve this part of the test about api-audiences?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

just leave the test, but remove the lines with audit policy. That should work, shouldn't it?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can try it.

@EmilyM1 EmilyM1 force-pushed the init-audit-policy-controller branch from c33ffc8 to 7e95cc2 Compare July 6, 2021 20:08
@EmilyM1 EmilyM1 force-pushed the init-audit-policy-controller branch from 012a273 to 126851e Compare July 6, 2021 20:43
sttts
sttts reviewed Jul 6, 2021
View reviewed changes
pkg/operator/workload/sync_openshift_oauth_apiserver_test.go
ObservedConfig: runtime.RawExtension{Raw: []byte(emptyAPIServerArgsJSON)},
},
expectedAPIServerArguments: map[string][]string{
"audit-policy-file": {"/var/run/configmaps/audit/default.yaml"},
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

just remove this line only

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

And line 180 too

@EmilyM1 EmilyM1 force-pushed the init-audit-policy-controller branch from 126851e to 60a7a13 Compare July 6, 2021 20:50
sttts
sttts reviewed Jul 6, 2021
View reviewed changes
pkg/operator/workload/testdata/sync_ds_scenario_2.yaml
--tls-min-version=VersionTLS12 \
--v=2
--cors-allowed-origins='//127\.0\.0\.1(:|$)' \
--cors-allowed-origins='//localhost(:|$)' \
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

move left every but the first green line

sttts
sttts reviewed Jul 6, 2021
View reviewed changes
pkg/operator/workload/testdata/sync_ds_scenario_3.yaml Outdated
--tls-cipher-suites=TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 \
--tls-min-version=VersionTLS13 \
--v=2
--audit-policy-file=/var/run/configmaps/audit/policy.yaml \
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

remove this line

sttts
sttts reviewed Jul 6, 2021
View reviewed changes
pkg/operator/workload/testdata/sync_ds_scenario_3.yaml
--v=2
--audit-policy-file=/var/run/configmaps/audit/policy.yaml \
--cors-allowed-origins='//127\.0\.0\.1(:|$)' \
--cors-allowed-origins='//localhost(:|$)' \
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

move left from here on

@stlaz
Copy link
Member

stlaz commented Jul 7, 2021

/hold
needs better commit management (and the tests to pass)

@openshift-ci openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 7, 2021
@EmilyM1 EmilyM1 force-pushed the init-audit-policy-controller branch from 4096ae0 to 8047b34 Compare July 7, 2021 19:39
@EmilyM1 EmilyM1 changed the title add dynamic audit policy controller [WIP] add dynamic audit policy controller Jul 7, 2021
@openshift-ci openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 7, 2021
@EmilyM1
Copy link
Contributor Author

EmilyM1 commented Jul 7, 2021

@stlaz Put back in WIP till tests are passing and squashed.
Found in this PR we have quite a few previously existing yaml alignment problems, so flurry of commits from yesterday addresses those.
Will remove WIP and ping you when passes and resquashed if needed.

@EmilyM1
Copy link
Contributor Author

EmilyM1 commented Jul 7, 2021

/test e2e-agnostic

@stlaz
Copy link
Member

stlaz commented Jul 8, 2021

/hold cancel
this seems ready

@openshift-ci openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 8, 2021
@EmilyM1 EmilyM1 changed the title [WIP] add dynamic audit policy controller add dynamic audit policy controller Jul 8, 2021
@openshift-ci openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 8, 2021
@EmilyM1
Copy link
Contributor Author

EmilyM1 commented Jul 8, 2021

/test e2e-agnostic-ipv6

@EmilyM1
Copy link
Contributor Author

EmilyM1 commented Jul 8, 2021

/test e2e-agnostic

@EmilyM1
Copy link
Contributor Author

EmilyM1 commented Jul 8, 2021

/test e2e-agnostic-ipv6

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jul 9, 2021

@EmilyM1: The following test failed, say /retest to rerun all failed tests:

Test name Commit Details Rerun command
ci/prow/e2e-agnostic-ipv6 8047b34 link /test e2e-agnostic-ipv6

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@stlaz
Copy link
Member

stlaz commented Jul 9, 2021

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jul 9, 2021
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jul 9, 2021

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: EmilyM1, stlaz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 9, 2021
@openshift-merge-robot openshift-merge-robot merged commit 4eda0f5 into openshift:master Jul 9, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@sttts sttts sttts left review comments

@stlaz stlaz Awaiting requested review from stlaz

Assignees

@stlaz stlaz

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@EmilyM1 @sttts @stlaz @openshift-merge-robot