Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2025-05-22 07:51:13 -04:00
Code Issues Projects Releases Packages Wiki Activity

Enable and configure k8s audit-log (#160)

Browse source 
* Enable and configure k8s audit-log

* Update coordinator/kubernetes/k8sapi/kubeadm_config.go

Co-authored-by: Malte Poll <mp@edgeless.systems>

* add mount point for audit log dir in kubeadm conf

* Mount audit policy into kube-apiserver static pod

* Write default auditpolicy on cluster init / cluster join

Co-authored-by: Malte Poll <mp@edgeless.systems>
This commit is contained in:
Moritz Eckert 2022-05-20 17:30:37 +02:00 • committed by GitHub
parent e4a9be832c
commit 6dc97590fe
6 changed files with 114 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

18
coordinator/kubernetes/k8sapi/util.go
View file

@ -37,6 +37,15 @@ type ClusterUtil interface {
type KubernetesUtil struct{}
func (k *KubernetesUtil) InitCluster(initConfig []byte) error {
// TODO: audit policy should be user input
auditPolicy, err := resources.NewDefaultAuditPolicy().Marshal()
if err != nil {
return fmt.Errorf("failed to generate default audit policy: %w", err)
}
if err := os.WriteFile(auditPolicyPath, auditPolicy, 0o644); err != nil {
return fmt.Errorf("failed to write default audit policy: %w", err)
}
initConfigFile, err := os.CreateTemp("", "kubeadm-init.*.yaml")
if err != nil {
return fmt.Errorf("failed to create init config file %v: %w", initConfigFile.Name(), err)
@ -102,6 +111,15 @@ func (k *KubernetesUtil) SetupCloudNodeManager(kubectl Client, cloudNodeManagerC
// JoinCluster joins existing Kubernetes cluster using kubeadm join.
func (k *KubernetesUtil) JoinCluster(joinConfig []byte) error {
// TODO: audit policy should be user input
auditPolicy, err := resources.NewDefaultAuditPolicy().Marshal()
if err != nil {
return fmt.Errorf("failed to generate default audit policy: %w", err)
}
if err := os.WriteFile(auditPolicyPath, auditPolicy, 0o644); err != nil {
return fmt.Errorf("failed to write default audit policy: %w", err)
}
joinConfigFile, err := os.CreateTemp("", "kubeadm-join.*.yaml")
if err != nil {
return fmt.Errorf("failed to create join config file %v: %w", joinConfigFile.Name(), err)