Skip to content

Commit 588de0b

Browse files
Gerrit91Gerrit91
authored
Role for auditing-timescaledb. (#310)
1 parent d35e1f3 commit 588de0b

File tree

9 files changed

+165
-18
lines changed

9 files changed

+165
-18
lines changed

‎control-plane/roles/auditing-timescaledb/README.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# auditing-timescaledb
2+
3+
This role provides a database for the metal-api that can be used for storing audit traces. The auditing feature has to be explicitly enabled in the metal-api in order to make use of this database.
4+
5+
This role just wraps the [postgres-backup-restore](/control-plane/roles/postgres-backup-restore) role. Refer to this role for further documentation.
6+
7+
## Variables
8+
9+
The role should take the same variables as the wrapped role, but prefixed with `auditing_timescaledb_` instead of `postgres_`.

‎control-plane/roles/auditing-timescaledb/defaults/main/control-plane-defaults‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../../../../control-plane-defaults/

‎control-plane/roles/auditing-timescaledb/defaults/main/global-defaults‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../../../../../defaults

‎control-plane/roles/auditing-timescaledb/defaults/main/main.yaml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
---
2+
auditing_timescaledb_name: auditing-timescaledb
3+
auditing_timescaledb_namespace: "{{ metal_control_plane_namespace }}"
4+
5+
auditing_timescaledb_image_pull_policy: "{{ metal_control_plane_image_pull_policy }}"
6+
7+
auditing_timescaledb_storage_size: 10Gi
8+
auditing_timescaledb_storage_class:
9+
auditing_timescaledb_db: auditing
10+
auditing_timescaledb_user: postgres
11+
auditing_timescaledb_password: change-me
12+
auditing_timescaledb_max_connections: 100
13+
14+
auditing_timescaledb_shared_libraries_preload:
15+
- pg_stat_statements
16+
- timescaledb
17+
18+
auditing_timescaledb_backup_restore_sidecar_image_pull_policy: "{{ metal_control_plane_image_pull_policy }}"
19+
auditing_timescaledb_backup_restore_sidecar_provider: local
20+
auditing_timescaledb_backup_restore_sidecar_backup_cron_schedule: "0 * * * *"
21+
auditing_timescaledb_backup_restore_sidecar_log_level: debug
22+
auditing_timescaledb_backup_restore_sidecar_object_prefix: "{{ auditing_timescaledb_name }}-{{ metal_control_plane_stage_name }}"
23+
auditing_timescaledb_backup_restore_sidecar_object_max_keep:
24+
25+
auditing_timescaledb_backup_restore_sidecar_gcp_bucket_name:
26+
auditing_timescaledb_backup_restore_sidecar_gcp_backup_location:
27+
auditing_timescaledb_backup_restore_sidecar_gcp_project_id:
28+
auditing_timescaledb_backup_restore_sidecar_gcp_serviceaccount_json:
29+
30+
auditing_timescaledb_resources:
31+
requests:
32+
memory: "256Mi"
33+
cpu: "500m"
34+
limits:
35+
memory: "1Gi"
36+
cpu: "1"
37+
38+
auditing_timescaledb_registry_auth_enabled: "{{ metal_registry_auth_enabled }}"
39+
auditing_timescaledb_registry_auth:
40+
auths:
41+
https://index.docker.io/v1/:
42+
username: "{{ metal_registry_auth_user }}"
43+
password: "{{ metal_registry_auth_password }}"
44+
auth: "{{ (metal_registry_auth_user + ':' + metal_registry_auth_password) | b64encode }}"

‎control-plane/roles/auditing-timescaledb/tasks/main.yaml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
---
2+
- name: Gather release versions
3+
setup_yaml:
4+
5+
- name: Check mandatory variables for this role are set
6+
assert:
7+
fail_msg: "not all mandatory variables given, check role documentation"
8+
quiet: yes
9+
that:
10+
- auditing_timescaledb_image_name is defined
11+
- auditing_timescaledb_image_tag is defined
12+
- auditing_timescaledb_backup_restore_sidecar_image_name is defined
13+
- auditing_timescaledb_backup_restore_sidecar_image_tag is defined
14+
15+
- name: Create namespace
16+
k8s:
17+
definition:
18+
apiVersion: v1
19+
kind: Namespace
20+
metadata:
21+
name: "{{ auditing_timescaledb_namespace }}"
22+
labels:
23+
name: "{{ auditing_timescaledb_namespace }}"
24+
25+
- name: Deploy auditing timescale db
26+
include_role:
27+
name: metal-roles/control-plane/roles/postgres-backup-restore
28+
vars:
29+
postgres_name: "{{ auditing_timescaledb_name }}"
30+
postgres_namespace: "{{ auditing_timescaledb_namespace }}"
31+
postgres_image_pull_policy: "{{ auditing_timescaledb_image_pull_policy }}"
32+
postgres_image_name: "{{ auditing_timescaledb_image_name }}"
33+
postgres_image_tag: "{{ auditing_timescaledb_image_tag }}"
34+
postgres_registry_auth_enabled: "{{ auditing_timescaledb_registry_auth_enabled }}"
35+
postgres_registry_auth: "{{ auditing_timescaledb_registry_auth }}"
36+
postgres_storage_size: "{{ auditing_timescaledb_storage_size }}"
37+
postgres_storage_class: "{{ auditing_timescaledb_storage_class }}"
38+
postgres_db: "{{ auditing_timescaledb_db }}"
39+
postgres_user: "{{ auditing_timescaledb_user }}"
40+
postgres_password: "{{ auditing_timescaledb_password }}"
41+
postgres_max_connections: "{{ auditing_timescaledb_max_connections }}"
42+
postgres_shared_libraries_preload: "{{ auditing_timescaledb_shared_libraries_preload }}"
43+
postgres_backup_restore_sidecar_image_pull_policy: "{{ auditing_timescaledb_backup_restore_sidecar_image_pull_policy }}"
44+
postgres_backup_restore_sidecar_image_name: "{{ auditing_timescaledb_backup_restore_sidecar_image_name }}"
45+
postgres_backup_restore_sidecar_image_tag: "{{ auditing_timescaledb_backup_restore_sidecar_image_tag }}"
46+
postgres_backup_restore_sidecar_provider: "{{ auditing_timescaledb_backup_restore_sidecar_provider }}"
47+
postgres_backup_restore_sidecar_backup_cron_schedule: "{{ auditing_timescaledb_backup_restore_sidecar_backup_cron_schedule }}"
48+
postgres_backup_restore_sidecar_log_level: "{{ auditing_timescaledb_backup_restore_sidecar_log_level }}"
49+
postgres_backup_restore_sidecar_object_prefix: "{{ auditing_timescaledb_backup_restore_sidecar_object_prefix }}"
50+
postgres_backup_restore_sidecar_gcp_bucket_name: "{{ auditing_timescaledb_backup_restore_sidecar_gcp_bucket_name }}"
51+
postgres_backup_restore_sidecar_gcp_backup_location: "{{ auditing_timescaledb_backup_restore_sidecar_gcp_backup_location }}"
52+
postgres_backup_restore_sidecar_gcp_project_id: "{{ auditing_timescaledb_backup_restore_sidecar_gcp_project_id }}"
53+
postgres_backup_restore_sidecar_gcp_serviceaccount_json: "{{ auditing_timescaledb_backup_restore_sidecar_gcp_serviceaccount_json }}"
54+
postgres_resources: "{{ auditing_timescaledb_resources }}"
55+
postgres_backup_restore_sidecar_object_max_keep: "{{ auditing_timescaledb_backup_restore_sidecar_object_max_keep }}"

‎control-plane/roles/metal/README.md‎

Lines changed: 16 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -154,11 +154,19 @@ You can look up all the default values of this role [here](defaults/main/main.ya
154154

155155
### Auditing
156156

157-
| Name | Mandatory | Description |
158-
|----------------------------------|-----------|------------------------------------------------------------------------------|
159-
| metal_auditing_enabled | | Whether to deploy or not to deploy the auditing. Default false. |
160-
| metal_auditing_url | | The URL of the auditing server (required if enabled) |
161-
| metal_auditing_index_prefix | | auditing index prefix. |
162-
| metal_auditing_index_interval | | auditing index creation interval, can be one of @hourly / @daily / @monthly. |
163-
| metal_auditing_meili_secret_name | | Secret name that holds the API key for meilisearch |
164-
| metal_auditing_meili_api_key | | API key for meilisearch |
157+
| Name | Mandatory | Description |
158+
| ------------------------------------ | --------- | ---------------------------------------------------------------------------- |
159+
| metal_auditing_meili_enabled | | Whether to deploy or not to configure meilisearch auditing. Default false. |
160+
| metal_auditing_meili_url | | The URL of the auditing server (required if enabled) |
161+
| metal_auditing_meili_index_prefix | | auditing index prefix. |
162+
| metal_auditing_meili_index_interval | | auditing index creation interval, can be one of @hourly / @daily / @monthly. |
163+
| metal_auditing_meili_secret_name | | Secret name that holds the API key for meilisearch |
164+
| metal_auditing_meili_api_key | | API key for meilisearch |
165+
| metal_auditing_timescaledb_enabled | | Whether to deploy or not to configure timescaledb auditing. Default false. |
166+
| metal_auditing_timescaledb_host | | The timescaledb host |
167+
| metal_auditing_timescaledb_port | | The timescaledb port |
168+
| metal_auditing_timescaledb_db | | The timescaledb database name |
169+
| metal_auditing_timescaledb_user | | The timescaledb user |
170+
| metal_auditing_timescaledb_password | | The timescaledb password |
171+
| metal_auditing_timescaledb_retention | | The timescaledb retention period, only configurable at first startup |
172+
| metal_auditing_search_backend | | Explicitly sets a configured audit backend to be used for search |

‎control-plane/roles/metal/defaults/main/main.yaml‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -113,8 +113,18 @@ metal_api_headscale_control_plane_address: "http{{ 's' if metal_api_headscale_tl
113113
metal_api_headscale_internal_api_address: "headscale:50443"
114114

115115
# auditing
116-
metal_auditing_enabled: false
117-
metal_auditing_index_prefix: "auditing"
118-
metal_auditing_index_interval: "@daily"
119-
metal_auditing_url: "http://auditing-meili.{{ auditing_meili_namespace if auditing_meili_namespace is defined else metal_control_plane_namespace }}.svc.cluster.local:7700"
120-
metal_auditing_meili_api_key: "{{ lookup('k8s', api_version='v1', namespace=auditing_meili_namespace if auditing_meili_namespace is defined else metal_control_plane_namespace, kind='Secret', resource_name='auditing-meili').get('data', {}).get('MEILI_MASTER_KEY') | b64decode if metal_auditing_enabled else '' }}"
116+
metal_auditing_meili_enabled: false
117+
metal_auditing_meili_index_prefix: "auditing"
118+
metal_auditing_meili_index_interval: "@daily"
119+
metal_auditing_meili_url: "http://auditing-meili.{{ auditing_meili_namespace if auditing_meili_namespace is defined else metal_control_plane_namespace }}.svc.cluster.local:7700"
120+
metal_auditing_meili_api_key: "{{ lookup('k8s', api_version='v1', namespace=auditing_meili_namespace if auditing_meili_namespace is defined else metal_control_plane_namespace, kind='Secret', resource_name='auditing-meili').get('data', {}).get('MEILI_MASTER_KEY') | b64decode if metal_auditing_meili_enabled else '' }}"
121+
122+
metal_auditing_timescaledb_enabled: false
123+
metal_auditing_timescaledb_host: "auditing-timescaledb"
124+
metal_auditing_timescaledb_port: "5432"
125+
metal_auditing_timescaledb_db: "auditing"
126+
metal_auditing_timescaledb_user: "postgres"
127+
metal_auditing_timescaledb_password: "change-me"
128+
metal_auditing_timescaledb_retention: "14 days"
129+
130+
metal_auditing_search_backend:

‎control-plane/roles/metal/templates/metal-values.j2‎

Lines changed: 20 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -216,8 +216,23 @@ deploy_ingress: {{ metal_deploy_ingress }}
216216
ingress: {{ metal_ingress | to_json }}
217217

218218
auditing:
219-
enabled: {{ metal_auditing_enabled }}
220-
index_prefix: "{{ metal_auditing_index_prefix }}"
221-
index_interval: "{{ metal_auditing_index_interval }}"
222-
existingMasterKeySecret: "metal-auditing-meili-api-key"
223-
url: "{{ metal_auditing_url }}"
219+
enabled: {{ 'true' if metal_auditing_meili_enabled or metal_auditing_timescaledb_enabled else 'false' }}
220+
search_backend: {{ metal_auditing_search_backend if metal_auditing_search_backend else '' }}
221+
{% if metal_auditing_meili_enabled %}
222+
meilisearch:
223+
enabled: true
224+
index_prefix: "{{ metal_auditing_meili_index_prefix }}"
225+
index_interval: "{{ metal_auditing_meili_index_interval }}"
226+
existingMasterKeySecret: "metal-auditing-meili-api-key"
227+
url: "{{ metal_auditing_meili_url }}"
228+
{% endif %}
229+
{% if metal_auditing_timescaledb_enabled %}
230+
timescaledb:
231+
enabled: true
232+
host: "{{ metal_auditing_timescaledb_host }}"
233+
port: "{{ metal_auditing_timescaledb_port }}"
234+
db: "{{ metal_auditing_timescaledb_db }}"
235+
user: "{{ metal_auditing_timescaledb_user }}"
236+
password: "{{ metal_auditing_timescaledb_password }}"
237+
retention: "{{ metal_auditing_timescaledb_retention }}"
238+
{% endif %}

‎defaults/main.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,8 @@ metal_stack_release:
4646
headscale_db_backup_restore_sidecar_image_name: "docker-images.metal-stack.generic.backup-restore-sidecar.name"
4747
auditing_meili_backup_restore_sidecar_image_tag: "docker-images.metal-stack.generic.backup-restore-sidecar.tag"
4848
auditing_meili_backup_restore_sidecar_image_name: "docker-images.metal-stack.generic.backup-restore-sidecar.name"
49+
auditing_timescaledb_backup_restore_sidecar_image_tag: "docker-images.metal-stack.generic.backup-restore-sidecar.tag"
50+
auditing_timescaledb_backup_restore_sidecar_image_name: "docker-images.metal-stack.generic.backup-restore-sidecar.name"
4951
# gardener
5052
firewall_controller_manager_image_tag: "docker-images.metal-stack.gardener.firewall-controller-manager.tag"
5153
firewall_controller_manager_image_name: "docker-images.metal-stack.gardener.firewall-controller-manager.name"
@@ -100,6 +102,8 @@ metal_stack_release:
100102
headscale_db_image_name: "docker-images.third-party.control-plane.headscale-db.name"
101103
auditing_meili_image_name: "docker-images.third-party.control-plane.meilisearch.name"
102104
auditing_meili_image_tag: "docker-images.third-party.control-plane.meilisearch.tag"
105+
auditing_timescaledb_image_name: "docker-images.third-party.control-plane.timescaledb.name"
106+
auditing_timescaledb_image_tag: "docker-images.third-party.control-plane.timescaledb.tag"
103107
image_cache_coredns_image_tag: "docker-images.third-party.partition.image-cache-coredns.tag"
104108
image_cache_coredns_image_name: "docker-images.third-party.partition.image-cache-coredns.name"
105109
image_cache_haproxy_image_tag: "docker-images.third-party.partition.image-cache-haproxy.tag"

0 commit comments

Comments
 (0)