Enabling kube-audit

ibm_catalog.json

@@ -756,6 +756,30 @@
                 }
               ],
               "hidden": true
+            },
+            {
+              "key":"enable_kube_audit"
+            },
+            {
+              "key": "audit_deployment_name"
+            },
+            {
+              "key": "audit_log_policy"
+            },
+            {
+              "key": "audit_namespace"
+            },
+            {
+              "key": "audit_webhook_listener_image"
+            },
+            {
+              "key": "audit_webhook_listener_image_version"
+            },
+            {
+              "key":"wait_till"
+            },
+            {
+              "key":"wait_till_timeout"
             }
           ],
           "dependencies": [

modules/kube-audit/variables.tf

@@ -95,7 +95,7 @@ variable "audit_webhook_listener_image_version" {
   type        = string
   description = "The tag or digest for the audit webhook listener image to deploy. If changing the value, ensure it is compatible with `audit_webhook_listener_image`."
   nullable    = false
-  default     = "deaabcb8225e800385413ba420cf3f819d3b0671@sha256:acf123f4dba63534cbc104c6886abedff9d25a22a34ab7b549ede988ed6e7144" # See, https://github.ibm.com/GoldenEye/issues/issues/13371
+  default     = "deaabcb8225e800385413ba420cf3f819d3b0671@sha256:acf123f4dba63534cbc104c6886abedff9d25a22a34ab7b549ede988ed6e7144"
   validation {
     condition     = can(regex("^[a-f0-9]{40}@sha256:[a-f0-9]{64}$", var.audit_webhook_listener_image_version))
     error_message = "The value of the audit webhook listener image version must match the tag and sha256 image digest format"

solutions/fully-configurable/kubeconfig/.gitignore

@@ -0,0 +1,6 @@
+# Ignore everything
+*
+
+# But not these files...
+!.gitignore
+!README.md

solutions/fully-configurable/kubeconfig/README.md

@@ -0,0 +1,2 @@
+This directory must exist in source control so the `ibm_container_cluster_config` data lookup can use it to place the
+config.yml used to connect to a kubernetes cluster.

solutions/fully-configurable/main.tf

@@ -284,3 +284,36 @@ module "secret_group" {
   secret_group_description = "Secret group for storing ingress certificates for cluster ${var.cluster_name} with id: ${module.ocp_base.cluster_id}"
   endpoint_type            = var.secrets_manager_endpoint_type
 }
+
+data "ibm_container_cluster_config" "cluster_config" {
+  count             = var.enable_kube_audit ? 1 : 0
+  cluster_name_id   = module.ocp_base.cluster_id
+  config_dir        = "${path.module}/kubeconfig"
+  admin             = true
+  resource_group_id = module.ocp_base.resource_group_id
+  endpoint_type     = var.cluster_config_endpoint_type != "default" ? var.cluster_config_endpoint_type : null
+}
+
+# Wait time to allow cluster refreshes components after provisioning
+resource "time_sleep" "wait_45_seconds" {
+  depends_on      = [data.ibm_container_cluster_config.cluster_config]
+  create_duration = "45s"
+}
+
+module "kube_audit" {
+  count                                = var.enable_kube_audit ? 1 : 0
+  ibmcloud_api_key                     = var.ibmcloud_api_key
+  source                               = "../../modules/kube-audit"
+  cluster_id                           = module.ocp_base.cluster_id
+  cluster_resource_group_id            = module.ocp_base.resource_group_id
+  region                               = module.ocp_base.region
+  wait_till                            = var.wait_till
+  wait_till_timeout                    = var.wait_till_timeout
+  use_private_endpoint                 = var.use_private_endpoint
+  cluster_config_endpoint_type         = var.cluster_config_endpoint_type
+  audit_log_policy                     = var.audit_log_policy
+  audit_namespace                      = var.audit_namespace
+  audit_deployment_name                = var.audit_deployment_name
+  audit_webhook_listener_image         = var.audit_webhook_listener_image
+  audit_webhook_listener_image_version = var.audit_webhook_listener_image_version
+}

solutions/fully-configurable/provider.tf

@@ -24,3 +24,17 @@ provider "ibm" {
   visibility            = var.provider_visibility
   private_endpoint_type = (var.provider_visibility == "private" && local.vpc_region == "ca-mon") ? "vpe" : null
 }
+
+provider "helm" {
+  kubernetes {
+    host                   = data.ibm_container_cluster_config.cluster_config[0].host
+    token                  = data.ibm_container_cluster_config.cluster_config[0].token
+    cluster_ca_certificate = data.ibm_container_cluster_config.cluster_config[0].ca_certificate
+  }
+}
+
+provider "kubernetes" {
+  host                   = data.ibm_container_cluster_config.cluster_config[0].host
+  token                  = data.ibm_container_cluster_config.cluster_config[0].token
+  cluster_ca_certificate = data.ibm_container_cluster_config.cluster_config[0].ca_certificate
+}

solutions/fully-configurable/variables.tf

@@ -556,3 +556,55 @@ variable "skip_ocp_secrets_manager_iam_auth_policy" {
   description = "To skip creating auth policy that allows OCP cluster 'Manager' role access in the existing Secrets Manager instance for managing ingress certificates."
   default     = false
 }
+
+##############################################################
+# Kube Audit
+##############################################################
+
+variable "wait_till" {
+  description = "To avoid long wait times when you run your Terraform code, you can specify the stage when you want Terraform to mark the cluster resource creation as completed. Depending on what stage you choose, the cluster creation might not be fully completed and continues to run in the background. However, your Terraform code can continue to run without waiting for the cluster to be fully created. Supported args are `MasterNodeReady`, `OneWorkerNodeReady`, `IngressReady` and `Normal`"
+  type        = string
+  default     = "IngressReady"
+}
+
+variable "wait_till_timeout" {
+  description = "Timeout for wait_till in minutes."
+  type        = number
+  default     = 90
+}
+
+variable "enable_kube_audit" {
+  type        = bool
+  description = "Set true to enable kube audit by default."
+  default     = true
+}
+
+variable "audit_log_policy" {
+  type        = string
+  description = "Specify the amount of information that is logged to the API server audit logs by choosing the audit log policy profile to use. Supported values are `default` and `WriteRequestBodies`."
+  default     = "default"
+}
+
+variable "audit_namespace" {
+  type        = string
+  description = "The name of the namespace where log collection service and a deployment will be created."
+  default     = "ibm-kube-audit"
+}
+
+variable "audit_deployment_name" {
+  type        = string
+  description = "The name of log collection deployement and service."
+  default     = "ibmcloud-kube-audit"
+}
+
+variable "audit_webhook_listener_image" {
+  type        = string
+  description = "The audit webhook listener image reference in the format of `[registry-url]/[namespace]/[image]`.The sub-module uses the `icr.io/ibm/ibmcloud-kube-audit-to-ibm-cloud-logs` image to forward logs to IBM Cloud Logs. This image is for demonstration purposes only. For a production solution, configure and maintain your own log forwarding image."
+  default     = "icr.io/ibm/ibmcloud-kube-audit-to-ibm-cloud-logs"
+}
+
+variable "audit_webhook_listener_image_version" {
+  type        = string
+  description = "The tag or digest for the audit webhook listener image to deploy. If changing the value, ensure it is compatible with `audit_webhook_listener_image`."
+  default     = "deaabcb8225e800385413ba420cf3f819d3b0671@sha256:acf123f4dba63534cbc104c6886abedff9d25a22a34ab7b549ede988ed6e7144"
+}

solutions/fully-configurable/version.tf

@@ -7,5 +7,17 @@ terraform {
       source  = "IBM-Cloud/ibm"
       version = "1.80.3"
     }
+    helm = {
+      source  = "hashicorp/helm"
+      version = "2.17.0"
+    }
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = "2.37.1"
+    }
+    time = {
+      source  = "hashicorp/time"
+      version = "0.13.1"
+    }
   }
 }

tests/pr_test.go

@@ -105,7 +105,7 @@ func TestRunFullyConfigurableInSchematics(t *testing.T) {
 	options := testschematic.TestSchematicOptionsDefault(&testschematic.TestSchematicOptions{
 		Testing:               t,
 		Prefix:                "ocp-fc",
-		TarIncludePatterns:    []string{"*.tf", fullyConfigurableTerraformDir + "/*.*", fullyConfigurableTerraformDir + "/scripts/*.*", "scripts/*.sh", "kubeconfig/README.md"},
+		TarIncludePatterns:    []string{"*.tf", fullyConfigurableTerraformDir + "/*.*", fullyConfigurableTerraformDir + "/scripts/*.*", "scripts/*.sh", "kubeconfig/README.md", "modules/kube-audit/*.*", "modules/kube-audit/kubeconfig/README.md", "modules/kube-audit/scripts/*.*", fullyConfigurableTerraformDir + "/kubeconfig/README.md", "modules/kube-audit/helm-charts/kube-audit/*.*", "modules/kube-audit/helm-charts/kube-audit/templates/*.*", "modules/kube-audit/helm-charts/kube-audit/values.yaml"},
 		TemplateFolder:        fullyConfigurableTerraformDir,
 		Tags:                  []string{"test-schematic"},
 		DeleteWorkspaceOnFail: false,
@@ -141,7 +141,7 @@ func TestRunUpgradeFullyConfigurable(t *testing.T) {
 	options := testschematic.TestSchematicOptionsDefault(&testschematic.TestSchematicOptions{
 		Testing:               t,
 		Prefix:                "fc-upg",
-		TarIncludePatterns:    []string{"*.tf", "scripts/*.sh", "kubeconfig/README.md", fullyConfigurableTerraformDir + "/*.*", fullyConfigurableTerraformDir + "/scripts/*.*"},
+		TarIncludePatterns:    []string{"*.tf", "scripts/*.sh", "kubeconfig/README.md", fullyConfigurableTerraformDir + "/*.*", fullyConfigurableTerraformDir + "/scripts/*.*", fullyConfigurableTerraformDir + "/kubeconfig/README.md", "modules/kube-audit/scripts/*.*", "modules/kube-audit/helm-charts/kube-audit/*.*", "modules/kube-audit/helm-charts/kube-audit/templates/*.*", "modules/kube-audit/helm-charts/kube-audit/values.yaml", "modules/kube-audit/*.*", "modules/kube-audit/kubeconfig/README.md"},
 		TemplateFolder:        fullyConfigurableTerraformDir,
 		Tags:                  []string{"test-schematic"},
 		DeleteWorkspaceOnFail: false,