audit logs

Audit logs and log collection

When audit logging is enabled, the API service writes audit logs to a shared volume at /var/log/reportportal/audit.log inside the pod. The chart does not include a built-in log streamer. To ship these logs to a central backend (e.g. Elasticsearch, Loki, S3), add a sidecar using serviceapi.extraContainers (and optionally serviceapi.extraVolumes for config).

Enable audit logging

In your values:

serviceapi:
  auditLogs:
    enable: true
    loglevel: info  # or debug, etc.

This enables the AUDIT_LOGGER env in the API container and mounts the audit-log-volume at /var/log for the API container. Any additional container you add via extraContainers can mount the same volume name to read the log file.

Gather logs with a sidecar (extraContainers)

Use serviceapi.extraContainers to add a log collector that runs alongside the API and reads from the audit log volume. The volume is available as audit-log-volume and the log path is /var/log/reportportal/audit.log.

Example: Fluent Bit sidecar

Add a Fluent Bit sidecar that reads the audit log and forwards it (e.g. to stdout or to a remote backend). You can provide a custom config via extraVolumes and a ConfigMap.

values snippet:

serviceapi:
  auditLogs:
    enable: true
    loglevel: info
  extraVolumes:
    - name: fluentbit-config
      configMap:
        name: reportportal-fluentbit-audit
  extraContainers:
    - name: fluentbit
      image: fluent/fluent-bit:2.2
      volumeMounts:
        - name: audit-log-volume
          mountPath: /var/log
        - name: fluentbit-config
          mountPath: /fluent-bit/etc
          readOnly: true
      resources:
        requests:
          cpu: 10m
          memory: 25Mi
        limits:
          cpu: 100m
          memory: 128Mi

Create a ConfigMap with your Fluent Bit config (e.g. fluent-bit.conf and any parsers). Example that tails the audit log and prints to stdout:

apiVersion: v1
kind: ConfigMap
metadata:
  name: reportportal-fluentbit-audit
data:
  fluent-bit.conf: |
    [INPUT]
        Name              tail
        Path              /var/log/reportportal/audit.log
        Refresh_Interval  5
        Skip_Long_Lines   On
        Tag               reportportal.audit
    [OUTPUT]
        Name              stdout
        Match             *

Install or upgrade the chart with the ConfigMap present and the values above; the API pod will run the Fluent Bit sidecar and it will read from the shared audit log volume.

Example: Simple tail sidecar (for testing)

For a quick test (e.g. to confirm the volume and path), you can add a minimal sidecar that tails the file to stdout:

serviceapi:
  auditLogs:
    enable: true
  extraContainers:
    - name: audit-tail
      image: busybox:latest
      command: ["/bin/sh", "-c"]
      args:
        - while true; do if [ -e /var/log/reportportal/audit.log ]; then tail -f /var/log/reportportal/audit.log; else sleep 5; fi; done
      volumeMounts:
        - name: audit-log-volume
          mountPath: /var/log
      resources:
        requests: { cpu: 10m, memory: 10Mi }
        limits:   { cpu: 50m, memory: 32Mi }

View audit lines from the sidecar:

kubectl logs -l component=<release>-reportportal-api -c audit-tail -n <namespace> -f

Using extra init containers

Init containers run to completion before the main containers start. They are not suitable for continuous log streaming. You can use serviceapi.extraInitContainers for one-off tasks (e.g. prepare directories or copy a bootstrap file). For ongoing audit log collection, use a sidecar via serviceapi.extraContainers as shown above.

Summary

Goal	Approach
Enable audit logging	serviceapi.auditLogs.enable: true
Ship logs to a backend	Add a sidecar in serviceapi.extraContainers that mounts audit-log-volume at /var/log and reads /var/log/reportportal/audit.log.
Sidecar needs config	Add serviceapi.extraVolumes (e.g. ConfigMap) and mount it in the sidecar.
One-off setup (no streaming)	Use serviceapi.extraInitContainers if needed; for streaming use extraContainers.