Skip to content

Commit e9ffc19

Browse files
auhligauhlig
committed
add barbican support, tests
1 parent 3b0e71d commit e9ffc19

File tree

10 files changed

+382
-174
lines changed

10 files changed

+382
-174
lines changed

‎README.md‎

Lines changed: 10 additions & 94 deletions
Original file line numberDiff line numberDiff line change
@@ -22,34 +22,7 @@ It distinguishes between `initiator` and `target` of an action.
2222

2323
The Cloud Audit Data Federation (CADF) specification defines a model for events within the OpenStack platform.
2424
This data model is used by the watcher middleware to classify requests.
25-
More information is provided in the [documentation](./doc/cadf.md).
26-
27-
#### Classification
28-
29-
The following attributes are recorded and passed via the WSGI environment through the pipeline.
30-
Moreover, this meta data is emitted as Prometheus metrics.
31-
Note: The attributes in the environment are capitalized.
32-
For example: `WATCHER.ACTION`, `WATCHER.INITIATOR_PROJECT_ID`, `WATCHER.TARGET_PROJECT_ID`, etc. .
33-
34-
- `action`: the CADF action
35-
- `service`: the name of the service
36-
37-
**Initiator** attributes:
38-
- `project_id`: the initiators project uid. `None` if domain scoped, `Unknown` if not authenticated.
39-
- `domain_id`: the initiators domain uid. `None` if project scoped, `Unknown` if not authenticated.
40-
- `user_id`: the initiators user id. `Unknown` if not authenticated.
41-
- `host_address`: the initiators host address
42-
43-
44-
**Target** attributes:
45-
- `project_id`: the targets project uid. `Unknown` if it could not be determined.
46-
- `type_uri`: characterizes the URI of the target resource
47-
48-
49-
**Additional service specific attributes**:
50-
51-
- Swift (object-store):
52-
- `target.container_id`: the name/id of the swift container. `None` if not relevant. `Unknown` if it could not be determined.
25+
More information is provided in the [CADF documentation](./doc/cadf.md).
5326

5427
### Metrics
5528

@@ -67,14 +40,16 @@ This middleware currently provides CADF-compliant support for the following Open
6740
|-----------------------|-----------------------|
6841
| Service name | Service type |
6942
|-----------------------|-----------------------|
70-
| Cinder | volume |
43+
| Barbican | key-manager |
44+
| Cinder | volume |
45+
| Designate | dns |
7146
| Glance | image |
47+
| Ironic | baremetal |
48+
| Keystone | identity |
49+
| Manila | share |
7250
| Neutron | network |
7351
| Nova | compute |
7452
| Swift | object-store |
75-
| Designate | dns |
76-
| Keystone | identity |
77-
| Ironic | baremetal |
7853
|-----------------------|-----------------------|
7954
````
8055

@@ -95,75 +70,16 @@ The watcher should be added after the keystone auth_token middleware to be able
9570
pipeline = .. auth_token watcher ..
9671
```
9772

98-
### WSGI configuration
73+
### Configuration
9974

100-
Configuration options in the paste.ini as shown below
75+
Mandatory configuration options in the paste.ini as shown below. See the [configuration section](./doc/configuration.md) for more options.
10176
```yaml
10277
[filter:watcher]
10378
use = egg:watcher-middleware#watcher
10479
# service_type as defined in service catalog. See supported services.
10580
# example: object-store, compute, dns, etc.
10681
service_type = <service_type>
107-
```
108-
Optional settings:
109-
```yaml
82+
11083
# path to configuration file containing customized action definitions
11184
config_file = /etc/watcher.yaml
112-
113-
# project id can be determined from either request path or service catalog if keystone.auth_token middleware is set to 'include_service_catalog = true'
114-
# determine the project id from request path
115-
project_id_from_path = true | false
116-
# determine the project id from the service catalog
117-
project_id_from_service_catalog = true | false
118-
119-
# per default the target.type_uri is prefixed by 'service/<service_type>/'
120-
# if the cadf spec. requires a different prefix, it might be given here
121-
# example: swift (object-store)
122-
# service_type = object-store
123-
# cadf_service_name = service/storage/object
124-
cadf_service_name = <service_name>
125-
126-
# metrics are emitted via StatsD
127-
statsd_host = 127.0.0.1
128-
statsd_port = 9125
129-
statsd_namespace = openstack_watcher
130-
```
131-
132-
#### Configuration file
133-
134-
Additionally, the watcher might require a configuration file.
135-
For existing services these can be found in the [examples](./etc).
136-
More details are provided [here](./doc/cadf.md)
137-
138-
The following snippet provides an overview of configuration options for a service.
139-
```yaml
140-
# keywords in a request path are followed by the UUID or name of a resource.
141-
# in the target type URI the UUID or name of a resource is replaced by the singular of the keyword.
142-
# a custom value for the singular can also be provided by a mapping <plural>:<singular>
143-
# moreover, if a path ends with a keyword the action will be 'read/list'
144-
path_keywords:
145-
- users
146-
- tokens
147-
- availability-zones: zone
148-
..
149-
150-
# per default every word following a path keyword is replaced.
151-
# however, exclusions can be configured by this list
152-
path_exclusions:
153-
- OS-PKI
154-
- ..
155-
156-
# some request path' are quite hard to map to their target type URI as the replacements can't be derived from the previous part.
157-
# thus, in some cases providing a mapping of <path_regex>: <target_type_URI> might be inevitable
158-
# note: the complete path (including versions, etc. ) needs to be reflected in the regex
159-
regex_path_mapping:
160-
- '\S+/domains/config/[0-9a-zA-Z_]+/default$': 'domains/config/group/default'
161-
162-
# CADF actions are determined by the request method and their path as outlined in the table in the CADF section of this documentation
163-
# however, these can be overwritten using the target type URI and the request method with a custom action_type
164-
custom_actions:
165-
tokens:
166-
- token:
167-
- method: GET
168-
action_type: custom_action
16985
```

‎doc/cadf.md‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,34 @@ The Cloud Audit Data Federation (CADF) specification defines a model for events
44
A comprehensive overview of OpenStack requests and their CADF representation can be found here: [Cloud Audit Data Federation - OpenStack Profile (CADF-OpenStack)](https://www.dmtf.org/sites/default/files/standards/documents/DSP2038_1.1.0.pdf).
55
The openstack-watcher-middleware follows DMTF specification DSP2038, version 1.1.0 as of 27 April 2015.
66

7+
#### Classification
8+
9+
The following attributes are recorded and passed via the WSGI environment through the pipeline.
10+
Moreover, this meta data is emitted as Prometheus metrics.
11+
Note: The attributes in the environment are capitalized.
12+
For example: `WATCHER.ACTION`, `WATCHER.INITIATOR_PROJECT_ID`, `WATCHER.TARGET_PROJECT_ID`, etc. .
13+
14+
- `action`: the CADF action
15+
- `service`: the name of the service
16+
17+
**Initiator** attributes:
18+
- `project_id`: the initiators project uid. `None` if domain scoped, `Unknown` if not authenticated.
19+
- `domain_id`: the initiators domain uid. `None` if project scoped, `Unknown` if not authenticated.
20+
- `user_id`: the initiators user id. `Unknown` if not authenticated.
21+
- `host_address`: the initiators host address
22+
23+
24+
**Target** attributes:
25+
- `project_id`: the targets project uid. `Unknown` if it could not be determined.
26+
- `type_uri`: characterizes the URI of the target resource
27+
28+
29+
**Additional service specific attributes**:
30+
31+
- Swift (object-store):
32+
- `target.container_id`: the name/id of the swift container. `None` if not relevant. `Unknown` if it could not be determined.
33+
34+
735
#### CADF actions
836

937
Actions characterize the operation performed by the initiator of a request against a target.

‎doc/configuration.md‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
### WSGI configuration
2+
3+
Configuration options in the paste.ini as shown below
4+
```yaml
5+
[filter:watcher]
6+
use = egg:watcher-middleware#watcher
7+
# service_type as defined in service catalog. See supported services.
8+
# example: object-store, compute, dns, etc.
9+
service_type = <service_type>
10+
```
11+
Optional settings:
12+
```yaml
13+
# path to configuration file containing customized action definitions
14+
config_file = /etc/watcher.yaml
15+
16+
# project id can be determined from either request path or service catalog if keystone.auth_token middleware is set to 'include_service_catalog = true'
17+
# determine the project id from request path
18+
project_id_from_path = true | false
19+
# determine the project id from the service catalog
20+
project_id_from_service_catalog = true | false
21+
22+
# per default the target.type_uri is prefixed by 'service/<service_type>/'
23+
# if the cadf spec. requires a different prefix, it might be given here
24+
# example: swift (object-store)
25+
# service_type = object-store
26+
# cadf_service_name = service/storage/object
27+
cadf_service_name = <service_name>
28+
29+
# metrics are emitted via StatsD
30+
statsd_host = 127.0.0.1
31+
statsd_port = 9125
32+
statsd_namespace = openstack_watcher
33+
```
34+
35+
#### Configuration file
36+
37+
Additionally, the watcher might require a configuration file.
38+
For existing services these can be found in the [examples](./etc).
39+
More details are provided [here](./doc/cadf.md)
40+
41+
The following snippet provides an overview of configuration options for a service.
42+
```yaml
43+
# keywords in a request path are followed by the UUID or name of a resource.
44+
# in the target type URI the UUID or name of a resource is replaced by the singular of the keyword.
45+
# a custom value for the singular can also be provided by a mapping <plural>:<singular>
46+
# moreover, if a path ends with a keyword the action will be 'read/list'
47+
path_keywords:
48+
- users
49+
- tokens
50+
- availability-zones: zone
51+
..
52+
53+
# per default every word following a path keyword is replaced.
54+
# however, exclusions can be configured by this list
55+
path_exclusions:
56+
- OS-PKI
57+
- ..
58+
59+
# some request path' are quite hard to map to their target type URI as the replacements can't be derived from the previous part.
60+
# thus, in some cases providing a mapping of <path_regex>: <target_type_URI> might be inevitable
61+
# note: the complete path (including versions, etc. ) needs to be reflected in the regex
62+
regex_path_mapping:
63+
- '\S+/domains/config/[0-9a-zA-Z_]+/default$': 'domains/config/group/default'
64+
65+
# CADF actions are determined by the request method and their path as outlined in the table in the CADF section of this documentation
66+
# however, these can be overwritten using the target type URI and the request method with a custom action_type
67+
custom_actions:
68+
tokens:
69+
- token:
70+
- method: GET
71+
action_type: custom_action
72+
```

‎etc/barbican.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
path_keywords:
2+
- consumers
3+
- containers
4+
- metadata: key
5+
- orders
6+
- quotas
7+
- project-quotas
8+
- secrets
9+
- secret-stores
10+
11+
keyword_exclusions:
12+
- global-default
13+
- preferred
14+
15+
regex_path_mapping:
16+
- '\S+/consumers$': 'container/consumers'

‎etc/ironic.yaml‎

Lines changed: 18 additions & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -1,77 +1,20 @@
1-
custom_actions:
2-
nodes:
3-
- method: GET
4-
action_type: read/list
5-
6-
- portgroups:
7-
- method: GET
8-
action_type: read/list
9-
10-
- ports:
11-
- method: GET
12-
action_type: read/list
13-
14-
- node:
15-
- vendor_passthru:
16-
- methods:
17-
- method: GET
18-
action_type: read/list
19-
20-
- traits:
21-
- method: GET
22-
action_type: read/list
23-
24-
- vifs:
25-
- method: GET
26-
action_type: read/list
27-
28-
- portgroups:
29-
- method: GET
30-
action_type: read/list
31-
32-
- ports:
33-
- method: GET
34-
action_type: read/list
35-
36-
- bios:
37-
- method: GET
38-
action_type: read/list
39-
40-
portgroups:
41-
- method: GET
42-
action_type: read/list
1+
path_keywords:
2+
- bios: setting
3+
- chassis: chassis
4+
- connectors
5+
- drivers
6+
- heartbeat: node
7+
- methods
8+
- nodes
9+
- ports
10+
- portgroups
11+
- targets
12+
- traits
13+
- volume
14+
- vifs
4315

44-
- portgroup:
45-
- ports:
46-
- method: GET
47-
action_type: read/list
48-
49-
ports:
50-
- method: GET
51-
action_type: read/list
52-
53-
volume:
54-
- method: GET
55-
action_type: read/list
56-
57-
- connectors:
58-
- method: GET
59-
action_type: read/list
60-
61-
- targets:
62-
- method: GET
63-
action_type: read/list
64-
65-
- drivers:
66-
- method: GET
67-
action_type: read/list
68-
69-
- driver:
70-
- vendor_passthru:
71-
- methods:
72-
- method: GET
73-
action_type: read/list
74-
75-
- chassis:
16+
custom_actions:
17+
chassis:
18+
chassis:
7619
- method: GET
77-
action_type: read/list
20+
action_type: read

‎watcher/cadf_strategy.py‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,16 @@ def __init__(
8787
else:
8888
self.keyword_exclusions = default_keyword_exclusions
8989

90+
def get_cadf_service_name(self):
91+
"""
92+
get the service name according to the CADF spec
93+
94+
:return: the cadf service name or unknown
95+
"""
96+
if common.is_none_or_unknown(self.target_type_uri_prefix):
97+
return taxonomy.UNKNOWN
98+
return self.target_type_uri_prefix
99+
90100
def determine_target_type_uri(self, req):
91101
"""
92102
determines the target.type_uri of a request by its path in the following order:

‎watcher/common.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,8 @@
4040
'volume': 'service/storage/block',
4141
'identity': 'data/security',
4242
'share': 'service/storage/share',
43-
'baremetal': 'service/compute/baremetal'
43+
'baremetal': 'service/compute/baremetal',
44+
'key-manager': 'service/security/keymanager'
4445
}
4546

4647

0 commit comments

Comments
 (0)