Upload audit logs on build02 to aws CloudWatch

clusters/build-clusters/02_cluster/openshift/api_audit_log/admin_logging-app_rbac.yaml

@@ -0,0 +1,8 @@
+---
+kind: ServiceAccount
+apiVersion: v1
+metadata:
+  annotations:
+    openshift.io/description: This SA is used for uploading audit-log by vector
+  name: logging-app
+  namespace: api-audit-log

clusters/build-clusters/02_cluster/openshift/api_audit_log/api-audit-log_namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  annotations:
+    openshift.io/description: This ns is used to upload api audit-log to aws cloudwatch
+  name: api-audit-log

clusters/build-clusters/02_cluster/openshift/api_audit_log/vector-audit-log-config_configmap.yaml

@@ -0,0 +1,26 @@
+kind: ConfigMap
+apiVersion: v1
+data:
+  vector.toml: |-
+    [sources.kube_apiserver_audit_logs]
+      type = "file"
+      include = ["/host/var/log/kube-apiserver/audit.log"]
+      ignore_older = 86400
+
+    [sources.openshift_apiserver_audit_logs]
+      type = "file"
+      include = ["/host/var/log/openshift-apiserver/audit.log"]
+      ignore_older = 86400
+
+    [sinks.aws_cloudwatch_logs]
+      type = "aws_cloudwatch_logs"
+      inputs = ["kube_apiserver_audit_logs", "openshift_apiserver_audit_logs"]
+      group_name = "ci-build02-audit-logs"
+      region = "us-east-1"
+      stream_name = "{{ host }}"
+      encoding = "json"
+      batch.max_events = 500
+metadata:
+  name: vector-audit-log-config
+  namespace: api-audit-log
+

clusters/build-clusters/02_cluster/openshift/api_audit_log/vector-audit-log_daemonset.yaml

@@ -0,0 +1,69 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: vector-audit-log
+  namespace: api-audit-log
+  labels:
+    k8s-app: vector-audit-log
+spec:
+  selector:
+    matchLabels:
+      k8s-app: vector-audit-log
+  updateStrategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        k8s-app: vector-audit-log
+        configmap-update: "4"
+      annotations:
+        scheduler.alpha.kubernetes.io/critical-pod: ''
+    spec:
+      dnsPolicy: Default
+      containers:
+      - name: vector-audit-log
+        image: docker.io/timberio/vector:0.9.1-alpine
+        env:
+        - name: AWS_ACCESS_KEY_ID
+          valueFrom:
+            secretKeyRef:
+              name: aws-ci-infra-ci-build02-audit-logs-uploader-credentials
+              key: AWS_ACCESS_KEY_ID
+        - name: AWS_SECRET_ACCESS_KEY
+          valueFrom:
+            secretKeyRef:
+              name: aws-ci-infra-ci-build02-audit-logs-uploader-credentials
+              key: AWS_SECRET_ACCESS_KEY
+        securityContext:
+          privileged: true
+        resources:
+          requests:
+            cpu: 100m
+            memory: 300Mi
+        volumeMounts:
+        - name: varlog
+          mountPath: /host/var/log
+          readOnly: true
+        - name: config-volume
+          mountPath: /etc/vector
+          readOnly: true
+        - name: data-volume
+          mountPath: /var/lib/vector
+      nodeSelector:
+        node-role.kubernetes.io/master: ""
+      serviceAccountName: logging-app
+      tolerations:
+      - key: node-role.kubernetes.io/master
+        effect: NoSchedule
+      terminationGracePeriodSeconds: 30
+      volumes:
+      - name: varlog
+        hostPath:
+          path: /var/log
+      - name: config-volume
+        configMap:
+          name: vector-audit-log-config
+      - name: data-volume
+        hostPath:
+          path: /var/lib/vector
+          type: DirectoryOrCreate