Skip to content

[Audit log forwarding] - update audit-tls secret to IM deployments for audit forwarding support #1061

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 21 commits into
base: master
Choose a base branch
from
Open

[Audit log forwarding] - update audit-tls secret to IM deployments for audit forwarding support #1061

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
21 commits
Select commit Hold shift + click to select a range
65f2e31
watch audit-tls secret to update deployments for audit
rashmi43 Jul 2, 2025
a4aa178
pass autdit url from authn CR
rashmi43 Aug 1, 2025
27ae7e0
change the logic to use secret length
rashmi43 Aug 4, 2025
4995af4
Merge branch 'master' into audit-tls-cp4s
rashmi43 Aug 4, 2025
08ebc79
print audit variables
rashmi43 Aug 4, 2025
c5b6d91
update variable name
rashmi43 Aug 4, 2025
26a0204
remove watch
rashmi43 Aug 4, 2025
1d61bf7
remove watch
rashmi43 Aug 4, 2025
6f0ab93
add to auth yaml samples
rashmi43 Aug 4, 2025
1557b97
add to auth yaml samples
rashmi43 Aug 4, 2025
6a99b9c
change to stringpointer
rashmi43 Aug 4, 2025
26233d1
Update internal/controller/operator/deployment.go
rashmi43 Aug 4, 2025
e6eb35b
Update internal/controller/operator/containers.go
rashmi43 Aug 5, 2025
91dafe2
change to string pointer
rashmi43 Aug 6, 2025
a76590a
change to string pointer
rashmi43 Aug 6, 2025
f16e9b9
review comments
rashmi43 Aug 13, 2025
b29c9f2
add print
rashmi43 Aug 13, 2025
624a0e6
remove print
rashmi43 Aug 13, 2025
6e9b29d
remove print
rashmi43 Aug 13, 2025
e80e1ec
final changes
rashmi43 Aug 14, 2025
4f28c8f
add log when finding secret
rashmi43 Aug 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions api/operator/v1alpha1/authentication_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,6 +139,8 @@ type ConfigSpec struct {
ICPPort int32 `json:"icpPort"`
FIPSEnabled bool `json:"fipsEnabled"`
ROKSEnabled bool `json:"roksEnabled"`
AuditUrl string `json:"auditUrl,omitempty"`
AuditSecret string `json:"auditSecret,omitempty"`
IBMCloudSaas bool `json:"ibmCloudSaas,omitempty"`
OnPremMultipleDeploy bool `json:"onPremMultipleDeploy,omitempty"`
SaasClientRedirectUrl string `json:"saasClientRedirectUrl,omitempty"`
Expand Down
4 changes: 4 additions & 0 deletions bundle/manifests/operator.ibm.com_authentications.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -228,6 +228,10 @@ spec:
type: string
providerIssuerURL:
type: string
auditURL:
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These changes should also be happening in the config directory, and changes here should be generated with make bundle

type: string
auditSecret:
type: string
roksEnabled:
type: boolean
roksURL:
Expand Down
15 changes: 15 additions & 0 deletions internal/controller/operator/authentication_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -443,6 +443,21 @@ func (r *AuthenticationReconciler) SetupWithManager(mgr ctrl.Manager) error {
}
}), builder.WithPredicates(predicate.Or(globalCMPred, productCMPred)),
)

authCtrl.Watches(&corev1.Secret{},
handler.EnqueueRequestsFromMapFunc(func(ctx context.Context, o client.Object) (requests []reconcile.Request) {
authCR, _ := ctrlcommon.GetAuthentication(ctx, r.Client)
if authCR == nil {
return
}
return []reconcile.Request{
{NamespacedName: types.NamespacedName{
Name: authCR.Name,
Namespace: authCR.Namespace,
}},
}
}),
)
bootstrappedPred := predicate.NewPredicateFuncs(func(o client.Object) bool {
return o.GetLabels()[ctrlcommon.ManagerVersionLabel] == version.Version
})
Expand Down
9 changes: 9 additions & 0 deletions internal/controller/operator/configmap.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -345,6 +345,10 @@ func updatePlatformAuthIDP(_ common.SecondaryReconciler, _ context.Context, obse
"LDAP_CTX_POOL_PREFERREDSIZE"),
updatesValuesWhen(not(observedKeySet[*corev1.ConfigMap]("MASTER_PATH")),
"MASTER_PATH"),
updatesValuesWhen(not(observedKeySet[*corev1.ConfigMap]("AUDIT_URL")),
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In conjunction with this comment, it's my feeling that these should just be added to the updatesAlways call, and, if we're trying to account for an existing setting on the ConfigMap from an upgrade, then we should account for that in the bootstrap controller.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We're still missing changes to the bootstrap controller, and this update function call is no longer needed once that is done.

"AUDIT_URL"),
updatesValuesWhen(not(observedKeySet[*corev1.ConfigMap]("AUDIT_SECRET")),
"AUDIT_SECRET"),
}

if v, ok := generated.Data["IS_OPENSHIFT_ENV"]; ok {
Expand Down Expand Up @@ -437,6 +441,9 @@ func (r *AuthenticationReconciler) generateAuthIdpConfigMap(clusterInfo *corev1.
}
}

// Found AUDIT variables
reqLogger.Info("Found audit variables, audit url", authCR.Spec.Config.AuditUrl, " and audit secret", authCR.Spec.Config.AuditSecret)

// Set the path for SAML connections
var masterPath string
if masterPath, err = r.getMasterPath(ctx, ctrl.Request{NamespacedName: common.GetObjectKey(s.GetPrimary())}); err != nil {
Expand Down Expand Up @@ -466,6 +473,8 @@ func (r *AuthenticationReconciler) generateAuthIdpConfigMap(clusterInfo *corev1.
"AUDIT_ENABLED_IDPROVIDER": "false",
"AUDIT_ENABLED_IDMGMT": "false",
"AUDIT_DETAIL": "false",
"AUDIT_URL": authCR.Spec.Config.AuditUrl,
"AUDIT_SECRET": authCR.Spec.Config.AuditSecret,
"LOG_LEVEL_IDPROVIDER": "info",
"LOG_LEVEL_AUTHSVC": "info",
"LOG_LEVEL_IDMGMT": "info",
Expand Down
146 changes: 92 additions & 54 deletions internal/controller/operator/containers.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -414,7 +414,7 @@ func buildAuthServiceContainer(instance *operatorv1alpha1.Authentication, authSe

}

func buildIdentityProviderContainer(instance *operatorv1alpha1.Authentication, identityProviderImage string, _ string, saasCRNId string) corev1.Container {
func buildIdentityProviderContainer(instance *operatorv1alpha1.Authentication, identityProviderImage string, _ string, saasCRNId string, auditSecretName string) corev1.Container {

resources := instance.Spec.IdentityProvider.Resources
if resources == nil {
Expand Down Expand Up @@ -632,7 +632,7 @@ func buildIdentityProviderContainer(instance *operatorv1alpha1.Authentication, i
"LDAP_SEARCH_CACHE_SIZE", "LDAP_SEARCH_CACHE_TIMEOUT", "LDAP_CTX_POOL_INITSIZE", "LDAP_CTX_POOL_MAXSIZE",
"LDAP_CTX_POOL_TIMEOUT", "LDAP_CTX_POOL_WAITTIME", "LDAP_CTX_POOL_PREFERREDSIZE", "LDAP_SEARCH_CACHE_ENABLED",
"LDAP_SEARCH_CACHE_SIZELIMIT", "LDAP_SEARCH_EXCLUDE_WILDCARD_CHARS", "LDAP_SEARCH_SIZE_LIMIT",
"LDAP_SEARCH_TIME_LIMIT", "LDAP_SEARCH_CN_ATTR_ONLY", "LDAP_SEARCH_ID_ATTR_ONLY",
"LDAP_SEARCH_TIME_LIMIT", "LDAP_SEARCH_CN_ATTR_ONLY", "LDAP_SEARCH_ID_ATTR_ONLY", "AUDIT_URL",
"DB_CONNECT_TIMEOUT", "DB_IDLE_TIMEOUT", "DB_CONNECT_MAX_RETRIES", "DB_POOL_MIN_SIZE", "DB_POOL_MAX_SIZE", "DB_SSL_MODE", "SEQL_LOGGING"}
idpEnvVars := buildIdpEnvVars(idpEnvVarList)

Expand Down Expand Up @@ -700,29 +700,8 @@ func buildIdentityProviderContainer(instance *operatorv1alpha1.Authentication, i
Drop: []corev1.Capability{"ALL"},
},
},
Resources: *resources,
VolumeMounts: []corev1.VolumeMount{
{
Name: "auth-key",
MountPath: "/opt/ibm/identity-provider/server/boot/auth-key",
},
{
Name: "identity-provider-cert",
MountPath: "/opt/ibm/identity-provider/certs",
},
{
Name: "saml-cert",
MountPath: "/certs/saml-certs",
},
{
Name: "pgsql-certs",
MountPath: "/certs/pgsql",
},
{
Name: "pgsql-client-cred",
MountPath: "/pgsql/clientinfo",
},
},
Resources: *resources,
VolumeMounts: buildIdentityProviderVolumeMounts(auditSecretName),
ReadinessProbe: &corev1.Probe{
ProbeHandler: corev1.ProbeHandler{
Exec: &corev1.ExecAction{
Expand Down Expand Up @@ -752,7 +731,7 @@ func buildIdentityProviderContainer(instance *operatorv1alpha1.Authentication, i

}

func buildIdentityManagerContainer(instance *operatorv1alpha1.Authentication, identityManagerImage string, _ string) corev1.Container {
func buildIdentityManagerContainer(instance *operatorv1alpha1.Authentication, identityManagerImage string, _ string, auditSecretName string) corev1.Container {

replicaCount := int(instance.Spec.Replicas)
resources := instance.Spec.IdentityManager.Resources
Expand Down Expand Up @@ -994,7 +973,7 @@ func buildIdentityManagerContainer(instance *operatorv1alpha1.Authentication, id
"ROKS_ENABLED", "ROKS_USER_PREFIX", "IDENTITY_AUTH_DIRECTORY_URL", "OIDC_ISSUER_URL", "BOOTSTRAP_USERID", "CLUSTER_NAME", "HTTP_ONLY", "LDAP_SEARCH_SIZE_LIMIT", "LDAP_SEARCH_TIME_LIMIT",
"LDAP_SEARCH_CN_ATTR_ONLY", "LDAP_SEARCH_ID_ATTR_ONLY", "LDAP_SEARCH_EXCLUDE_WILDCARD_CHARS", "IGNORE_LDAP_FILTERS_VALIDATION", "AUTH_SVC_LDAP_CONFIG_TIMEOUT",
"SCIM_LDAP_SEARCH_SIZE_LIMIT", "SCIM_LDAP_SEARCH_TIME_LIMIT", "SCIM_ASYNC_PARALLEL_LIMIT", "SCIM_GET_DISPLAY_FOR_GROUP_USERS", "ATTR_MAPPING_FROM_CONFIG", "SCIM_AUTH_CACHE_MAX_SIZE", "SCIM_AUTH_CACHE_TTL_VALUE",
"DB_CONNECT_TIMEOUT", "DB_IDLE_TIMEOUT", "DB_CONNECT_MAX_RETRIES", "DB_POOL_MIN_SIZE", "DB_POOL_MAX_SIZE", "DB_SSL_MODE", "SEQL_LOGGING"}
"DB_CONNECT_TIMEOUT", "DB_IDLE_TIMEOUT", "DB_CONNECT_MAX_RETRIES", "DB_POOL_MIN_SIZE", "DB_POOL_MAX_SIZE", "DB_SSL_MODE", "SEQL_LOGGING", "AUDIT_URL"}

idpEnvVars := buildIdpEnvVars(idpEnvVarList)

Expand Down Expand Up @@ -1068,29 +1047,8 @@ func buildIdentityManagerContainer(instance *operatorv1alpha1.Authentication, id
Drop: []corev1.Capability{"ALL"},
},
},
Resources: *resources,
VolumeMounts: []corev1.VolumeMount{
{
Name: "cluster-ca",
MountPath: "/opt/ibm/identity-mgmt/certs",
},
{
Name: "platform-identity-management",
MountPath: "/opt/ibm/identity-mgmt/server/certs",
},
{
Name: "scim-ldap-attributes-mapping",
MountPath: "/opt/ibm/identity-mgmt/config/scim-config",
},
{
Name: "pgsql-certs",
MountPath: "/certs/pgsql",
},
{
Name: "pgsql-client-cred",
MountPath: "/pgsql/clientinfo",
},
},
Resources: *resources,
VolumeMounts: buildIdentityManagerVolumeMounts(auditSecretName),
ReadinessProbe: &corev1.Probe{
ProbeHandler: corev1.ProbeHandler{
Exec: &corev1.ExecAction{
Expand Down Expand Up @@ -1129,16 +1087,16 @@ func buildContainers(instance *operatorv1alpha1.Authentication, authServiceImage
return []corev1.Container{authServiceContainer}
}

func buildManagerContainers(instance *operatorv1alpha1.Authentication, identityManagerImage string, icpConsoleURL string) []corev1.Container {
func buildManagerContainers(instance *operatorv1alpha1.Authentication, identityManagerImage string, icpConsoleURL string, auditSecretName string) []corev1.Container {

identityManagerContainer := buildIdentityManagerContainer(instance, identityManagerImage, icpConsoleURL)
identityManagerContainer := buildIdentityManagerContainer(instance, identityManagerImage, icpConsoleURL, auditSecretName)

return []corev1.Container{identityManagerContainer}
}

func buildProviderContainers(instance *operatorv1alpha1.Authentication, identityProviderImage string, icpConsoleURL string, saasCrnId string) []corev1.Container {
func buildProviderContainers(instance *operatorv1alpha1.Authentication, identityProviderImage string, icpConsoleURL string, saasCrnId string, auditSecretName string) []corev1.Container {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same as here: https://github.com/IBM/ibm-iam-operator/pull/1061/files#r2252013204


identityProviderContainer := buildIdentityProviderContainer(instance, identityProviderImage, icpConsoleURL, saasCrnId)
identityProviderContainer := buildIdentityProviderContainer(instance, identityProviderImage, icpConsoleURL, saasCrnId, auditSecretName)

return []corev1.Container{identityProviderContainer}
}
Expand Down Expand Up @@ -1184,3 +1142,83 @@ func buildInitContainerEnvVars(envVarList []string, configmapName string) []core
}
return envVars
}

func buildIdentityManagerVolumeMounts(auditSecretName string) []corev1.VolumeMount {
volumeMounts := []corev1.VolumeMount{
{
Name: "cluster-ca",
MountPath: "/opt/ibm/identity-mgmt/certs",
},
{
Name: "platform-identity-management",
MountPath: "/opt/ibm/identity-mgmt/server/certs",
},
{
Name: "scim-ldap-attributes-mapping",
MountPath: "/opt/ibm/identity-mgmt/config/scim-config",
},
{
Name: "pgsql-certs",
MountPath: "/certs/pgsql",
},
{
Name: "pgsql-client-cred",
MountPath: "/pgsql/clientinfo",
},
}
if len(auditSecretName) > 0 {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you change AuditSecret to be a *string, you would need a nil check here.

volumeMounts = EnsureVolumeMountPresent(volumeMounts, GetAuditCertsVolumeMount())

}

return volumeMounts
}

func buildIdentityProviderVolumeMounts(auditSecretName string) []corev1.VolumeMount {
volumeMounts := []corev1.VolumeMount{
{
Name: "auth-key",
MountPath: "/opt/ibm/identity-provider/server/boot/auth-key",
},
{
Name: "identity-provider-cert",
MountPath: "/opt/ibm/identity-provider/certs",
},
{
Name: "saml-cert",
MountPath: "/certs/saml-certs",
},
{
Name: "pgsql-certs",
MountPath: "/certs/pgsql",
},
{
Name: "pgsql-client-cred",
MountPath: "/pgsql/clientinfo",
},
}
if len(auditSecretName) > 0 {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you change AuditSecret to be a *string, you would need a nil check here.

volumeMounts = EnsureVolumeMountPresent(volumeMounts, GetAuditCertsVolumeMount())

}
return volumeMounts
}

// EnsureVolumeMountPresent checks if a volumeMount exists
// If not, it appends the new volume and returns the updated slice.
func EnsureVolumeMountPresent(volumeMounts []corev1.VolumeMount, newVolMount corev1.VolumeMount) []corev1.VolumeMount {
for _, v := range volumeMounts {
if v.Name == newVolMount.Name {
return volumeMounts // already exists
}
}
return append(volumeMounts, newVolMount)
}

func GetAuditCertsVolumeMount() corev1.VolumeMount {
volMount := corev1.VolumeMount{
Name: IMAuditTLSVolume,
MountPath: "/certs/audit-tls",
}
return volMount
}
Loading