Skip to content

Commit d461a0d

Browse files
Gerrit91Gerrit91
authored
Add splunk audit configuration for metal-api. (#514)
1 parent 1e109c2 commit d461a0d

File tree

3 files changed

+51
-20
lines changed

3 files changed

+51
-20
lines changed

‎control-plane/roles/metal/README.md‎

Lines changed: 30 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -182,25 +182,36 @@ You can look up all the default values of this role [here](defaults/main.yaml).
182182

183183
Configuration for metal-api:
184184

185-
| Name | Mandatory | Description |
186-
| ------------------------------------ | --------- | -------------------------------------------------------------------------- |
187-
| metal_auditing_timescaledb_enabled | | Whether to deploy or not to configure timescaledb auditing. Default false. |
188-
| metal_auditing_timescaledb_host | | The timescaledb host |
189-
| metal_auditing_timescaledb_port | | The timescaledb port |
190-
| metal_auditing_timescaledb_db | | The timescaledb database name |
191-
| metal_auditing_timescaledb_user | | The timescaledb user |
192-
| metal_auditing_timescaledb_password | | The timescaledb password |
193-
| metal_auditing_timescaledb_retention | | The timescaledb retention period, only configurable at first startup |
194-
| metal_auditing_search_backend | | Explicitly sets a configured audit backend to be used for search |
185+
| Name | Mandatory | Description |
186+
| ------------------------------------ | --------- | -------------------------------------------------------------------- |
187+
| metal_auditing_timescaledb_enabled | | Whether or not to configure timescaledb auditing. Default false. |
188+
| metal_auditing_timescaledb_host | | The timescaledb host |
189+
| metal_auditing_timescaledb_port | | The timescaledb port |
190+
| metal_auditing_timescaledb_db | | The timescaledb database name |
191+
| metal_auditing_timescaledb_user | | The timescaledb user |
192+
| metal_auditing_timescaledb_password | | The timescaledb password |
193+
| metal_auditing_timescaledb_retention | | The timescaledb retention period, only configurable at first startup |
194+
| metal_auditing_search_backend | | Explicitly sets a configured audit backend to be used for search |
195+
196+
| Name | Mandatory | Description |
197+
| --------------------------------- | --------- | --------------------------------------------------------------- |
198+
| metal_auditing_splunk_enabled | | Whetheror not to configure timescaledb auditing. Default false. |
199+
| metal_auditing_splunk_endpoint | | The splunk endpoint. |
200+
| metal_auditing_splunk_hec_token | | The splunk hec token. |
201+
| metal_auditing_splunk_source | | The splunk source. |
202+
| metal_auditing_splunk_source_type | | The splunk source type. |
203+
| metal_auditing_splunk_index | | The splunk index. |
204+
| metal_auditing_splunk_host | | The splunk host. |
205+
| metal_auditing_splunk_ca | | The splunk CA (not encoded). |
195206

196207
Configuration for metal-apiserver:
197208

198-
| Name | Mandatory | Description |
199-
| ---------------------------------------------- | --------- | ------------------------------------------------------------------------- |
200-
| metal_apiserver_auditing_enabled | | Whether to deploy or not to configure timescaledb auditing. Default true. |
201-
| metal_apiserver_auditing_timescaledb_host | | The timescaledb host |
202-
| metal_apiserver_auditing_timescaledb_port | | The timescaledb port |
203-
| metal_apiserver_auditing_timescaledb_db | | The timescaledb database name |
204-
| metal_apiserver_auditing_timescaledb_user | | The timescaledb user |
205-
| metal_apiserver_auditing_timescaledb_password | | The timescaledb password |
206-
| metal_apiserver_auditing_timescaledb_retention | | The timescaledb retention period, only configurable at first startup |
209+
| Name | Mandatory | Description |
210+
| ---------------------------------------------- | --------- | -------------------------------------------------------------------- |
211+
| metal_apiserver_auditing_enabled | | Whether or not to configure timescaledb auditing. Default true. |
212+
| metal_apiserver_auditing_timescaledb_host | | The timescaledb host |
213+
| metal_apiserver_auditing_timescaledb_port | | The timescaledb port |
214+
| metal_apiserver_auditing_timescaledb_db | | The timescaledb database name |
215+
| metal_apiserver_auditing_timescaledb_user | | The timescaledb user |
216+
| metal_apiserver_auditing_timescaledb_password | | The timescaledb password |
217+
| metal_apiserver_auditing_timescaledb_retention | | The timescaledb retention period, only configurable at first startup |

‎control-plane/roles/metal/defaults/main.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -152,4 +152,13 @@ metal_auditing_timescaledb_user: "postgres"
152152
metal_auditing_timescaledb_password: "change-me"
153153
metal_auditing_timescaledb_retention: "14 days"
154154

155+
metal_auditing_splunk_enabled: false
156+
metal_auditing_splunk_endpoint:
157+
metal_auditing_splunk_hec_token:
158+
metal_auditing_splunk_source:
159+
metal_auditing_splunk_source_type:
160+
metal_auditing_splunk_index:
161+
metal_auditing_splunk_host:
162+
metal_auditing_splunk_ca:
163+
155164
metal_auditing_search_backend:

‎control-plane/roles/metal/templates/metal-values.j2‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -239,7 +239,7 @@ metal_apiserver:
239239
password: {{ metal_apiserver_redis_password }}
240240
admin_subjects: {{ metal_apiserver_admin_subjects | to_json }}
241241
auditing:
242-
enabled: {{ 'true' if metal_apiserver_auditing_enabled else 'false' }}
242+
enabled: {{ 'true' if metal_apiserver_auditing_enabled else 'false' }}
243243
timescaledb:
244244
host: {{ metal_apiserver_auditing_timescaledb_host }}
245245
port: {{ metal_apiserver_auditing_timescaledb_port }}
@@ -264,6 +264,17 @@ auditing:
264264
password: "{{ metal_auditing_timescaledb_password }}"
265265
retention: "{{ metal_auditing_timescaledb_retention }}"
266266
{% endif %}
267+
{% if metal_auditing_splunk_enabled %}
268+
splunk:
269+
enabled: true
270+
endpoint: "{{ metal_auditing_splunk_endpoint }}"
271+
hec: "{{ metal_auditing_splunk_hec_token }}"
272+
source: "{{ metal_auditing_splunk_source | default('', true) }}"
273+
source_type: "{{ metal_auditing_splunk_source_type | default('', true) }}"
274+
index: "{{ metal_auditing_splunk_index | default('', true) }}"
275+
host: "{{ metal_auditing_splunk_host | default('', true) }}"
276+
ca: "{{ (metal_auditing_splunk_ca | b64encode) | default('', true) }}"
277+
{% endif %}
267278

268279
metal_registry_auth_enabled: "{{ metal_registry_auth_enabled }}"
269280
metal_registry_auth:

0 commit comments

Comments
 (0)