Matheus Macabu
69 lines
2.2 KiB
Go
69 lines
2.2 KiB
Go
package auditing
|
|
|
|
import (
|
|
"slices"
|
|
|
|
"github.com/grafana/grafana/pkg/apimachinery/utils"
|
|
"k8s.io/apimachinery/pkg/runtime/schema"
|
|
auditinternal "k8s.io/apiserver/pkg/apis/audit"
|
|
"k8s.io/apiserver/pkg/audit"
|
|
"k8s.io/apiserver/pkg/authentication/user"
|
|
"k8s.io/apiserver/pkg/authorization/authorizer"
|
|
)
|
|
|
|
// PolicyRuleEvaluators is a map of API group+version to audit.PolicyRuleEvaluator
|
|
type PolicyRuleEvaluators = map[schema.GroupVersion]audit.PolicyRuleEvaluator
|
|
|
|
type PolicyRuleProvider interface {
|
|
PolicyRuleProvider(evaluators PolicyRuleEvaluators) audit.PolicyRuleEvaluator
|
|
}
|
|
|
|
// PolicyRuleEvaluator alias for easier imports.
|
|
type PolicyRuleEvaluator = audit.PolicyRuleEvaluator
|
|
|
|
// DefaultGrafanaPolicyRuleEvaluator provides a sane default configuration for audit logging for API group+versions.
|
|
type defaultGrafanaPolicyRuleEvaluator struct{}
|
|
|
|
var _ PolicyRuleEvaluator = &defaultGrafanaPolicyRuleEvaluator{}
|
|
|
|
func NewDefaultGrafanaPolicyRuleEvaluator() audit.PolicyRuleEvaluator {
|
|
return defaultGrafanaPolicyRuleEvaluator{}
|
|
}
|
|
|
|
func (defaultGrafanaPolicyRuleEvaluator) EvaluatePolicyRule(attrs authorizer.Attributes) audit.RequestAuditConfig {
|
|
// Skip non-resource and watch requests otherwise it is too noisy.
|
|
if !attrs.IsResourceRequest() || attrs.GetVerb() == utils.VerbWatch {
|
|
return audit.RequestAuditConfig{
|
|
Level: auditinternal.LevelNone,
|
|
}
|
|
}
|
|
|
|
// Skip auditing if the user is part of the privileged group.
|
|
// The loopback client uses this group, so requests initiated in `/api/` would be duplicated.
|
|
if u := attrs.GetUser(); u != nil && slices.Contains(u.GetGroups(), user.SystemPrivilegedGroup) {
|
|
return audit.RequestAuditConfig{
|
|
Level: auditinternal.LevelNone,
|
|
}
|
|
}
|
|
|
|
// Logging the response object allows us to get the resource name for create requests.
|
|
level := auditinternal.LevelMetadata
|
|
if attrs.GetVerb() == utils.VerbCreate {
|
|
level = auditinternal.LevelRequestResponse
|
|
}
|
|
|
|
return audit.RequestAuditConfig{
|
|
Level: level,
|
|
|
|
// Only log on StageResponseComplete, to avoid noisy logs.
|
|
OmitStages: []auditinternal.Stage{
|
|
auditinternal.StageRequestReceived,
|
|
auditinternal.StageResponseStarted,
|
|
auditinternal.StagePanic,
|
|
},
|
|
|
|
// Setting it to true causes extra copying/unmarshalling.
|
|
OmitManagedFields: false,
|
|
}
|
|
}
|