Skip to content

Commit 6472cb1

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #7241 from csrwng/persistent_audit_log
CNTRLPLANE-1772: feat(audit): add persistent audit log feature with automatic snapshots
2 parents 3e02e1e + 1091107 commit 6472cb1

File tree

51 files changed

+5809
-23
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

51 files changed

+5809
-23
lines changed

‎Makefile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -191,6 +191,7 @@ hypershift-api: $(CONTROLLER_GEN) $(CODE_GEN)
191191
# Generate additional CRDs.
192192
$(CONTROLLER_GEN) $(CRD_OPTIONS) paths="./api/scheduling/..." output:crd:artifacts:config=cmd/install/assets/hypershift-operator
193193
$(CONTROLLER_GEN) $(CRD_OPTIONS) paths="./api/certificates/..." output:crd:artifacts:config=cmd/install/assets/hypershift-operator
194+
$(CONTROLLER_GEN) $(CRD_OPTIONS) paths="./api/auditlogpersistence/..." output:crd:artifacts:config=cmd/install/assets/hypershift-operator
194195

195196
.PHONY: cluster-api
196197
cluster-api: $(CONTROLLER_GEN)

‎api/auditlogpersistence/register.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
package auditlogpersistence
2+
3+
const GroupName = "auditlogpersistence.hypershift.openshift.io"

‎api/auditlogpersistence/v1alpha1/auditlogpersistenceconfig_types.go‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
package v1alpha1
2+
3+
import (
4+
"k8s.io/apimachinery/pkg/api/resource"
5+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
6+
)
7+
8+
// +genclient
9+
// +kubebuilder:resource:path=auditlogpersistenceconfigs,shortName=alpc;alpcs,scope=Cluster
10+
// +kubebuilder:object:root=true
11+
// +kubebuilder:subresource:status
12+
// +kubebuilder:storageversion
13+
// +genclient:nonNamespaced
14+
// +kubebuilder:validation:XValidation:rule="self.metadata.name == 'cluster'", message="exactly one configuration may exist and must be named 'cluster'"
15+
16+
// AuditLogPersistenceConfig defines the desired state of AuditLogPersistenceConfig.
17+
// Configuration options here allow management cluster administrators to configure
18+
// persistent audit logs with automatic snapshots for kube-apiserver pods in hosted clusters.
19+
type AuditLogPersistenceConfig struct {
20+
metav1.TypeMeta `json:",inline"`
21+
metav1.ObjectMeta `json:"metadata,omitempty"`
22+
23+
// +optional
24+
Spec AuditLogPersistenceConfigSpec `json:"spec,omitempty"`
25+
// +optional
26+
Status AuditLogPersistenceConfigStatus `json:"status,omitempty"`
27+
}
28+
29+
// AuditLogPersistenceConfigSpec defines the desired state of AuditLogPersistenceConfig
30+
type AuditLogPersistenceConfigSpec struct {
31+
// Enabled enables or disables the audit log persistence feature globally.
32+
// When disabled, no PVCs will be created and no snapshots will be taken.
33+
// Defaults to false.
34+
// +optional
35+
Enabled bool `json:"enabled,omitempty"`
36+
37+
// Storage defines the PVC configuration for audit log storage.
38+
// +optional
39+
Storage StorageConfig `json:"storage,omitempty"`
40+
41+
// AuditLog defines audit log settings that will be applied to kube-apiserver.
42+
// +optional
43+
AuditLog AuditLogConfig `json:"auditLog,omitempty"`
44+
45+
// Snapshots defines snapshot configuration for crash recovery.
46+
// +optional
47+
Snapshots SnapshotConfig `json:"snapshots,omitempty"`
48+
}
49+
50+
// StorageConfig defines PVC storage configuration
51+
type StorageConfig struct {
52+
// StorageClassName is the name of the StorageClass to use for PVCs.
53+
// If not specified, the default storage class will be used.
54+
// +optional
55+
StorageClassName string `json:"storageClassName,omitempty"`
56+
57+
// Size is the size of each PVC created for kube-apiserver pods.
58+
// Must be a valid Kubernetes quantity (e.g., "5Gi", "10Gi").
59+
// Defaults to "5Gi".
60+
// +optional
61+
Size resource.Quantity `json:"size,omitempty"`
62+
}
63+
64+
// AuditLogConfig defines audit log settings
65+
type AuditLogConfig struct {
66+
// MaxSize is the maximum size in megabytes of the audit log file before it gets rotated.
67+
// This corresponds to the --audit-log-maxsize kube-apiserver argument.
68+
// If not specified, defaults to 200.
69+
// +kubebuilder:validation:Minimum=1
70+
// +optional
71+
MaxSize *int32 `json:"maxSize,omitempty"`
72+
73+
// MaxBackup is the maximum number of old audit log files to retain.
74+
// This corresponds to the --audit-log-maxbackup kube-apiserver argument.
75+
// If not specified, defaults to 10.
76+
// +kubebuilder:validation:Minimum=1
77+
// +optional
78+
MaxBackup *int32 `json:"maxBackup,omitempty"`
79+
}
80+
81+
// SnapshotConfig defines snapshot configuration
82+
type SnapshotConfig struct {
83+
// Enabled enables or disables automatic snapshot creation on pod crashes.
84+
// Defaults to false.
85+
// +optional
86+
Enabled bool `json:"enabled,omitempty"`
87+
88+
// MinInterval is the minimum time interval between snapshots for the same pod.
89+
// This prevents creating too many snapshots in rapid succession.
90+
// Must be a valid duration string (e.g., "1h", "30m").
91+
// Defaults to "1h".
92+
// +kubebuilder:validation:Pattern=`^([0-9]+(ns|us|µs|ms|s|m|h))+$`
93+
// +optional
94+
MinInterval string `json:"minInterval,omitempty"`
95+
96+
// PerPodRetentionCount is the maximum number of snapshots to retain per PVC.
97+
// When this limit is reached, the oldest snapshot for that PVC will be deleted.
98+
// If not specified, defaults to 10.
99+
// +kubebuilder:validation:Minimum=1
100+
// +optional
101+
PerPodRetentionCount *int32 `json:"perPodRetentionCount,omitempty"`
102+
103+
// NamespaceRetentionCount is the maximum total number of snapshots to retain per namespace.
104+
// When this limit is reached, the oldest snapshot in the namespace will be deleted.
105+
// If not specified, defaults to 50.
106+
// +kubebuilder:validation:Minimum=1
107+
// +optional
108+
NamespaceRetentionCount *int32 `json:"namespaceRetentionCount,omitempty"`
109+
110+
// VolumeSnapshotClassName is the name of the VolumeSnapshotClass to use for creating snapshots.
111+
// If not specified, the system will attempt to match the PVC's StorageClass provisioner
112+
// to an appropriate VolumeSnapshotClass.
113+
// +optional
114+
VolumeSnapshotClassName string `json:"volumeSnapshotClassName,omitempty"`
115+
}
116+
117+
// AuditLogPersistenceConfigStatus defines the observed state of AuditLogPersistenceConfig
118+
type AuditLogPersistenceConfigStatus struct {
119+
// Conditions represent the latest available observations of the configuration's state.
120+
// +listType=map
121+
// +listMapKey=type
122+
// +optional
123+
Conditions []metav1.Condition `json:"conditions,omitempty"`
124+
}
125+
126+
// +kubebuilder:object:root=true
127+
128+
// AuditLogPersistenceConfigList contains a list of AuditLogPersistenceConfig
129+
type AuditLogPersistenceConfigList struct {
130+
metav1.TypeMeta `json:",inline"`
131+
metav1.ListMeta `json:"metadata,omitempty"`
132+
// +optional
133+
Items []AuditLogPersistenceConfig `json:"items"`
134+
}

‎api/auditlogpersistence/v1alpha1/doc.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
// +k8s:deepcopy-gen=package,register
2+
// +groupName=auditlogpersistence.hypershift.openshift.io
3+
// +k8s:openapi-gen=true
4+
package v1alpha1

‎api/auditlogpersistence/v1alpha1/register.go‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
package v1alpha1
2+
3+
import (
4+
"github.com/openshift/hypershift/api/auditlogpersistence"
5+
6+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
7+
"k8s.io/apimachinery/pkg/runtime"
8+
"k8s.io/apimachinery/pkg/runtime/schema"
9+
)
10+
11+
// SchemeGroupVersion is group version used to register these objects.
12+
var SchemeGroupVersion = schema.GroupVersion{Group: auditlogpersistence.GroupName, Version: "v1alpha1"}
13+
14+
// Kind takes an unqualified kind and returns back a Group qualified GroupKind.
15+
func Kind(kind string) schema.GroupKind {
16+
return SchemeGroupVersion.WithKind(kind).GroupKind()
17+
}
18+
19+
// Resource takes an unqualified resource and returns a Group qualified GroupResource.
20+
func Resource(resource string) schema.GroupResource {
21+
return SchemeGroupVersion.WithResource(resource).GroupResource()
22+
}
23+
24+
var (
25+
SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)
26+
AddToScheme = SchemeBuilder.AddToScheme
27+
)
28+
29+
// Adds the list of known types to Scheme.
30+
func addKnownTypes(scheme *runtime.Scheme) error {
31+
scheme.AddKnownTypes(SchemeGroupVersion,
32+
&AuditLogPersistenceConfig{},
33+
&AuditLogPersistenceConfigList{},
34+
)
35+
metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
36+
return nil
37+
}

‎api/auditlogpersistence/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 191 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)