Skip to content

[Audit log forwarding] - update audit-tls secret to IM deployments for audit forwarding support #1061

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 21 commits into
base: master
Choose a base branch
from
+206 −58
Open

[Audit log forwarding] - update audit-tls secret to IM deployments for audit forwarding support #1061

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
21 commits
Select commit Hold shift + click to select a range
65f2e31
watch audit-tls secret to update deployments for audit
rashmi43 Jul 2, 2025
a4aa178
pass autdit url from authn CR
rashmi43 Aug 1, 2025
27ae7e0
change the logic to use secret length
rashmi43 Aug 4, 2025
4995af4
Merge branch 'master' into audit-tls-cp4s
rashmi43 Aug 4, 2025
08ebc79
print audit variables
rashmi43 Aug 4, 2025
c5b6d91
update variable name
rashmi43 Aug 4, 2025
26a0204
remove watch
rashmi43 Aug 4, 2025
1d61bf7
remove watch
rashmi43 Aug 4, 2025
6f0ab93
add to auth yaml samples
rashmi43 Aug 4, 2025
1557b97
add to auth yaml samples
rashmi43 Aug 4, 2025
6a99b9c
change to stringpointer
rashmi43 Aug 4, 2025
26233d1
Update internal/controller/operator/deployment.go
rashmi43 Aug 4, 2025
e6eb35b
Update internal/controller/operator/containers.go
rashmi43 Aug 5, 2025
91dafe2
change to string pointer
rashmi43 Aug 6, 2025
a76590a
change to string pointer
rashmi43 Aug 6, 2025
f16e9b9
review comments
rashmi43 Aug 13, 2025
b29c9f2
add print
rashmi43 Aug 13, 2025
624a0e6
remove print
rashmi43 Aug 13, 2025
6e9b29d
remove print
rashmi43 Aug 13, 2025
e80e1ec
final changes
rashmi43 Aug 14, 2025
4f28c8f
add log when finding secret
rashmi43 Aug 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions api/operator/v1alpha1/authentication_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,8 +139,8 @@ type ConfigSpec struct {
ICPPort int32 `json:"icpPort"`
FIPSEnabled bool `json:"fipsEnabled"`
ROKSEnabled bool `json:"roksEnabled"`
AuditUrl string `json:"auditUrl,omitempty"`
AuditSecret string `json:"auditSecret,omitempty"`
AuditUrl *string `json:"auditUrl,omitempty"`
AuditSecret *string `json:"auditSecret,omitempty"`
IBMCloudSaas bool `json:"ibmCloudSaas,omitempty"`
OnPremMultipleDeploy bool `json:"onPremMultipleDeploy,omitempty"`
SaasClientRedirectUrl string `json:"saasClientRedirectUrl,omitempty"`
Expand Down
4 changes: 2 additions & 2 deletions internal/controller/operator/configmap.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -473,8 +473,8 @@ func (r *AuthenticationReconciler) generateAuthIdpConfigMap(clusterInfo *corev1.
"AUDIT_ENABLED_IDPROVIDER": "false",
"AUDIT_ENABLED_IDMGMT": "false",
"AUDIT_DETAIL": "false",
"AUDIT_URL": authCR.Spec.Config.AuditUrl,
"AUDIT_SECRET": authCR.Spec.Config.AuditSecret,
"AUDIT_URL": *authCR.Spec.Config.AuditUrl,
"AUDIT_SECRET": *authCR.Spec.Config.AuditSecret,
"LOG_LEVEL_IDPROVIDER": "info",
"LOG_LEVEL_AUTHSVC": "info",
"LOG_LEVEL_IDMGMT": "info",
Expand Down
18 changes: 9 additions & 9 deletions internal/controller/operator/containers.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -414,7 +414,7 @@ func buildAuthServiceContainer(instance *operatorv1alpha1.Authentication, authSe

}

func buildIdentityProviderContainer(instance *operatorv1alpha1.Authentication, identityProviderImage string, _ string, saasCRNId string, auditSecretName *string) corev1.Container {
func buildIdentityProviderContainer(instance *operatorv1alpha1.Authentication, identityProviderImage string, _ string, saasCRNId string) corev1.Container {

resources := instance.Spec.IdentityProvider.Resources
if resources == nil {
Expand Down Expand Up @@ -701,7 +701,7 @@ func buildIdentityProviderContainer(instance *operatorv1alpha1.Authentication, i
},
},
Resources: *resources,
VolumeMounts: buildIdentityProviderVolumeMounts(auditSecretName),
VolumeMounts: buildIdentityProviderVolumeMounts(instance.Spec.Config.AuditSecret),
ReadinessProbe: &corev1.Probe{
ProbeHandler: corev1.ProbeHandler{
Exec: &corev1.ExecAction{
Expand Down Expand Up @@ -731,7 +731,7 @@ func buildIdentityProviderContainer(instance *operatorv1alpha1.Authentication, i

}

func buildIdentityManagerContainer(instance *operatorv1alpha1.Authentication, identityManagerImage string, _ string, auditSecretName *string) corev1.Container {
func buildIdentityManagerContainer(instance *operatorv1alpha1.Authentication, identityManagerImage string, _ string) corev1.Container {

replicaCount := int(instance.Spec.Replicas)
resources := instance.Spec.IdentityManager.Resources
Expand Down Expand Up @@ -1048,7 +1048,7 @@ func buildIdentityManagerContainer(instance *operatorv1alpha1.Authentication, id
},
},
Resources: *resources,
VolumeMounts: buildIdentityManagerVolumeMounts(auditSecretName),
VolumeMounts: buildIdentityManagerVolumeMounts(instance.Spec.Config.AuditSecret),
ReadinessProbe: &corev1.Probe{
ProbeHandler: corev1.ProbeHandler{
Exec: &corev1.ExecAction{
Expand Down Expand Up @@ -1087,16 +1087,16 @@ func buildContainers(instance *operatorv1alpha1.Authentication, authServiceImage
return []corev1.Container{authServiceContainer}
}

func buildManagerContainers(instance *operatorv1alpha1.Authentication, identityManagerImage string, icpConsoleURL string, auditSecretName *string) []corev1.Container {
func buildManagerContainers(instance *operatorv1alpha1.Authentication, identityManagerImage string, icpConsoleURL string) []corev1.Container {

identityManagerContainer := buildIdentityManagerContainer(instance, identityManagerImage, icpConsoleURL, auditSecretName)
identityManagerContainer := buildIdentityManagerContainer(instance, identityManagerImage, icpConsoleURL)

return []corev1.Container{identityManagerContainer}
}

func buildProviderContainers(instance *operatorv1alpha1.Authentication, identityProviderImage string, icpConsoleURL string, saasCrnId string, auditSecretName *string) []corev1.Container {
func buildProviderContainers(instance *operatorv1alpha1.Authentication, identityProviderImage string, icpConsoleURL string, saasCrnId string) []corev1.Container {

identityProviderContainer := buildIdentityProviderContainer(instance, identityProviderImage, icpConsoleURL, saasCrnId, auditSecretName)
identityProviderContainer := buildIdentityProviderContainer(instance, identityProviderImage, icpConsoleURL, saasCrnId)

return []corev1.Container{identityProviderContainer}
}
Expand Down Expand Up @@ -1200,7 +1200,7 @@ func buildIdentityProviderVolumeMounts(auditSecretName *string) []corev1.VolumeM
MountPath: "/pgsql/clientinfo",
},
}
if auditSecretName != nil {
if auditSecretName != nil && *auditSecretName != "" {
newVolMount := corev1.VolumeMount{
Name: IMAuditTLSVolume,
MountPath: "/certs/audit-tls",
Expand Down
61 changes: 23 additions & 38 deletions internal/controller/operator/deployment.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,7 +82,7 @@ func (r *AuthenticationReconciler) handleDeployments(ctx context.Context, req ct
samlConsoleURL = icpConsoleURL
}

auditSecretName, err := r.getAuditSecretNameIfExists(ctx, req.Namespace)
auditSecretName, err := r.getAuditSecretNameIfExists(context.TODO(), req.Namespace, authCR.Spec.Config.AuditUrl, authCR.Spec.Config.AuditSecret)
if err != nil {
return subreconciler.RequeueWithError(err)
}
Expand Down Expand Up @@ -189,50 +189,35 @@ func (r *AuthenticationReconciler) removeCP2Deployments(ctx context.Context, req
// cluster, or an empty string when the Secret isn't found or cannot otherwise
// be retrieved. If an error other than NotFound is received when trying to get
// the Secret, that is returned as well.
func (r *AuthenticationReconciler) getAuditSecretNameIfExists(ctx context.Context, namespace string) (*string, error) {
var auditSecretName string
var auditURL string
// Check for the presence of audit-endpoint configmap
authIdpConfigMapName := "platform-auth-idp"
authIdpConfigMap := &corev1.ConfigMap{}
idpCMLogger := log.WithValues("ConfigMap.Name", authIdpConfigMapName, "ConfigMap.Namespace", namespace)
if err := r.Get(ctx, types.NamespacedName{Name: authIdpConfigMapName, Namespace: namespace}, authIdpConfigMap); k8sErrors.IsNotFound(err) {
idpCMLogger.Info("ConfigMap was not found")
return nil, nil
} else if err != nil {
idpCMLogger.Error(err, "Failed to get ConfigMap")
return nil, err
}
if authIdpConfigMap.Data == nil {
idpCMLogger.Info("Invalid ConfigMap")
return nil, nil
}
if authIdpConfigMap.Data["AUDIT_URL"] == "" {
idpCMLogger.Info("Audit URL is not specified in ConfigMap; assume no Secret to mount", "key", "AUDIT_URL")
func (r *AuthenticationReconciler) getAuditSecretNameIfExists(ctx context.Context, namespace string, auditUrl *string, auditSecretName *string) (*string, error) {
//var auditSecretName string
//var auditURL string
reqLogger := logf.FromContext(ctx)

if auditUrl == nil {
reqLogger.Info("Audit URL is not specified in Authentication CR", "key", "AUDIT_URL")
return nil, nil
}
if authIdpConfigMap.Data["AUDIT_SECRET"] == "" {
idpCMLogger.Info("Audit Secret is not specified in ConfigMap; assume no Secret", "key", "AUDIT_SECRET")
if auditSecretName == nil {
reqLogger.Info("Audit Secret is not specified in Authentication CR", "key", "AUDIT_SECRET")
return nil, nil
}
auditURL = authIdpConfigMap.Data["AUDIT_URL"]
auditSecretName = authIdpConfigMap.Data["AUDIT_SECRET"]
idpCMLogger.Info("Fetched audit URL and audit Secret from ConfigMap", "AUDIT_SECRET", auditSecretName, "AUDIT_URL", auditURL)

auditTLSSecretLogger := log.WithValues("Secret.Name", auditSecretName, "Secret.Namespace", namespace)
reqLogger.Info("Fetched audit URL and audit Secret from Authentication CR", "AUDIT_SECRET", auditSecretName, "AUDIT_URL", auditUrl)

auditTLSSecret := &corev1.Secret{}
auditTLSSecretStruct := types.NamespacedName{Name: auditSecretName, Namespace: namespace}
err := r.Get(ctx, auditTLSSecretStruct, auditTLSSecret)
if k8sErrors.IsNotFound(err) {
auditTLSSecretLogger.Info("Secret for audit configuration not found")
auditTLSSecretStruct := types.NamespacedName{Name: *auditSecretName, Namespace: namespace}
err1 := r.Get(ctx, auditTLSSecretStruct, auditTLSSecret)
if k8sErrors.IsNotFound(err1) {
reqLogger.Info("Secret for audit configuration not found")
return nil, nil
} else if err != nil {
auditTLSSecretLogger.Error(err, "Failed to retrieve Secret for audit configuration")
return nil, err
} else if err1 != nil {
reqLogger.Error(err1, "Failed to retrieve Secret for audit configuration")
return nil, err1
}

auditTLSSecretLogger.Info("Secret found for audit configuration")
return &auditSecretName, nil
reqLogger.Info("Secret found for audit configuration")
return auditSecretName, nil
}

func generatePlatformAuthService(imagePullSecret, icpConsoleURL, _ string) common.GenerateFn[*appsv1.Deployment] {
Expand Down Expand Up @@ -567,7 +552,7 @@ func generatePlatformIdentityManagement(imagePullSecret, icpConsoleURL, _ string
},
},
Volumes: buildIdpVolumes(ldapCACert, routerCertSecret, auditSecretName),
Containers: buildManagerContainers(authCR, identityManagerImage, icpConsoleURL, auditSecretName),
Containers: buildManagerContainers(authCR, identityManagerImage, icpConsoleURL),
InitContainers: buildInitForMngrAndProvider(initContainerImage),
},
},
Expand Down Expand Up @@ -742,7 +727,7 @@ func generatePlatformIdentityProvider(imagePullSecret, icpConsoleURL, saasServic
},
},
Volumes: buildIdpVolumes(ldapCACert, routerCertSecret, auditSecretName),
Containers: buildProviderContainers(authCR, identityProviderImage, icpConsoleURL, saasServiceIdCrn, auditSecretName),
Containers: buildProviderContainers(authCR, identityProviderImage, icpConsoleURL, saasServiceIdCrn),
InitContainers: buildInitForMngrAndProvider(initContainerImage),
},
},
Expand Down