Skip to content

Commit aafd16b

Browse files
authored
add pub&deletion_protection audit log (#1438)
Signed-off-by: liheng.zms <[email protected]>
1 parent 18b15d5 commit aafd16b

File tree

9 files changed

+97
-5
lines changed

9 files changed

+97
-5
lines changed

main.go

+5
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,11 @@ func main() {
155155
setupLog.Error(err, "unable to init kruise clientset and informer")
156156
os.Exit(1)
157157
}
158+
err = util.InitProtectionLogger()
159+
if err != nil {
160+
setupLog.Error(err, "unable to init protection logger")
161+
os.Exit(1)
162+
}
158163

159164
var syncPeriod *time.Duration
160165
if syncPeriodStr != "" {

pkg/control/pubcontrol/pub_control_utils.go

+1
Original file line numberDiff line numberDiff line change
@@ -148,6 +148,7 @@ func PodUnavailableBudgetValidatePod(pod *corev1.Pod, operation policyv1alpha1.P
148148
}
149149
PodUnavailableBudgetMetrics.WithLabelValues(fmt.Sprintf("%s_%s_%s", kind, namespace, name), username).Add(1)
150150
recorder.Eventf(pod, corev1.EventTypeWarning, "PubPreventPodDeletion", "openkruise pub prevents pod deletion")
151+
util.LoggerProtectionInfo(util.ProtectionEventPub, kind, namespace, name, username)
151152
return err
152153
}
153154

pkg/util/logger.go

+77
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
/*
2+
Copyright 2023 The Kruise Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package util
18+
19+
import (
20+
"encoding/json"
21+
"flag"
22+
"fmt"
23+
"log"
24+
"os"
25+
"path/filepath"
26+
)
27+
28+
var (
29+
protectionLogger *log.Logger
30+
protectionLogPath string
31+
)
32+
33+
const (
34+
ProtectionEventPub = "PodUnavailableBudget"
35+
ProtectionEventDeletionProtection = "DeletionProtection"
36+
)
37+
38+
type ProtectionLoggerInfo struct {
39+
// PUB, ProtectionDeletion
40+
Event string
41+
Kind string
42+
Namespace string
43+
Name string
44+
UserAgent string
45+
}
46+
47+
func init() {
48+
flag.StringVar(&protectionLogPath, "protection-log-path", "/log", "protection log path, for example pub, delete_protection")
49+
}
50+
func InitProtectionLogger() error {
51+
err := os.MkdirAll(protectionLogPath, 0644)
52+
if err != nil {
53+
return fmt.Errorf("MkdirAll(%s) failed: %s", protectionLogPath, err.Error())
54+
}
55+
file, err := os.OpenFile(filepath.Join(protectionLogPath, "protection.log"), os.O_RDWR|os.O_CREATE|os.O_APPEND, 0644)
56+
if err != nil {
57+
return fmt.Errorf("openFile(%s) failed: %s", filepath.Join(protectionLogPath, "protection.log"), err.Error())
58+
}
59+
protectionLogger = log.New(file, "", 0)
60+
return nil
61+
}
62+
63+
func LoggerProtectionInfo(event, kind, ns, name, userAgent string) {
64+
// compatible with go test
65+
if protectionLogger == nil {
66+
return
67+
}
68+
info := ProtectionLoggerInfo{
69+
Event: event,
70+
Kind: kind,
71+
Namespace: ns,
72+
Name: name,
73+
UserAgent: userAgent,
74+
}
75+
by, _ := json.Marshal(info)
76+
protectionLogger.Println(string(by))
77+
}

pkg/webhook/builtinworkloads/validating/builtin_handlers.go

+2
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ import (
2121
"fmt"
2222
"net/http"
2323

24+
"github.com/openkruise/kruise/pkg/util"
2425
"github.com/openkruise/kruise/pkg/webhook/util/deletionprotection"
2526
admissionv1 "k8s.io/api/admission/v1"
2627
apps "k8s.io/api/apps/v1"
@@ -81,6 +82,7 @@ func (h *WorkloadHandler) Handle(ctx context.Context, req admission.Request) adm
8182

8283
if err := deletionprotection.ValidateWorkloadDeletion(metaObj, replicas); err != nil {
8384
deletionprotection.WorkloadDeletionProtectionMetrics.WithLabelValues(fmt.Sprintf("%s_%s_%s", req.Kind.Kind, metaObj.GetNamespace(), metaObj.GetName()), req.UserInfo.Username).Add(1)
85+
util.LoggerProtectionInfo(util.ProtectionEventDeletionProtection, req.Kind.Kind, metaObj.GetNamespace(), metaObj.GetName(), req.UserInfo.Username)
8486
return admission.Errored(http.StatusForbidden, err)
8587
}
8688
return admission.ValidationResponse(true, "")

pkg/webhook/cloneset/validating/cloneset_create_update_handler.go

+2
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ import (
2222
"net/http"
2323

2424
appsv1alpha1 "github.com/openkruise/kruise/apis/apps/v1alpha1"
25+
"github.com/openkruise/kruise/pkg/util"
2526
"github.com/openkruise/kruise/pkg/webhook/util/deletionprotection"
2627
admissionv1 "k8s.io/api/admission/v1"
2728
"k8s.io/klog/v2"
@@ -76,6 +77,7 @@ func (h *CloneSetCreateUpdateHandler) Handle(ctx context.Context, req admission.
7677
}
7778
if err := deletionprotection.ValidateWorkloadDeletion(oldObj, oldObj.Spec.Replicas); err != nil {
7879
deletionprotection.WorkloadDeletionProtectionMetrics.WithLabelValues(fmt.Sprintf("%s_%s_%s", req.Kind.Kind, oldObj.GetNamespace(), oldObj.GetName()), req.UserInfo.Username).Add(1)
80+
util.LoggerProtectionInfo(util.ProtectionEventDeletionProtection, req.Kind.Kind, oldObj.GetNamespace(), oldObj.GetName(), req.UserInfo.Username)
7981
return admission.Errored(http.StatusForbidden, err)
8082
}
8183
}

pkg/webhook/customresourcedefinition/validating/crd_handler.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -20,13 +20,13 @@ import (
2020
"context"
2121
"net/http"
2222

23+
"github.com/openkruise/kruise/pkg/util"
2324
"github.com/openkruise/kruise/pkg/webhook/util/deletionprotection"
24-
"k8s.io/apimachinery/pkg/runtime/schema"
25-
2625
admissionv1 "k8s.io/api/admission/v1"
2726
apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
2827
apiextensionsv1beta1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
2928
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
29+
"k8s.io/apimachinery/pkg/runtime/schema"
3030
"k8s.io/klog/v2"
3131
"sigs.k8s.io/controller-runtime/pkg/client"
3232
"sigs.k8s.io/controller-runtime/pkg/runtime/inject"
@@ -86,6 +86,7 @@ func (h *CRDHandler) Handle(ctx context.Context, req admission.Request) admissio
8686

8787
if err := deletionprotection.ValidateCRDDeletion(h.Client, metaObj, gvk); err != nil {
8888
deletionprotection.CRDDeletionProtectionMetrics.WithLabelValues(metaObj.GetName(), req.UserInfo.Username).Add(1)
89+
util.LoggerProtectionInfo(util.ProtectionEventDeletionProtection, "CustomResourceDefinition", "", metaObj.GetName(), req.UserInfo.Username)
8990
return admission.Errored(http.StatusForbidden, err)
9091
}
9192
return admission.ValidationResponse(true, "")

pkg/webhook/namespace/validating/namespace_handler.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -20,12 +20,11 @@ import (
2020
"context"
2121
"net/http"
2222

23+
"github.com/openkruise/kruise/pkg/util"
2324
"github.com/openkruise/kruise/pkg/webhook/util/deletionprotection"
24-
25-
"k8s.io/klog/v2"
26-
2725
admissionv1 "k8s.io/api/admission/v1"
2826
v1 "k8s.io/api/core/v1"
27+
"k8s.io/klog/v2"
2928
"sigs.k8s.io/controller-runtime/pkg/client"
3029
"sigs.k8s.io/controller-runtime/pkg/runtime/inject"
3130
"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
@@ -55,6 +54,7 @@ func (h *NamespaceHandler) Handle(ctx context.Context, req admission.Request) ad
5554
}
5655
if err := deletionprotection.ValidateNamespaceDeletion(h.Client, obj); err != nil {
5756
deletionprotection.NamespaceDeletionProtectionMetrics.WithLabelValues(obj.Name, req.UserInfo.Username).Add(1)
57+
util.LoggerProtectionInfo(util.ProtectionEventDeletionProtection, "Namespace", "", obj.Name, req.UserInfo.Username)
5858
return admission.Errored(http.StatusForbidden, err)
5959
}
6060
return admission.ValidationResponse(true, "")

pkg/webhook/statefulset/validating/statefulset_create_update_handler.go

+2
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ import (
2323

2424
appsv1alpha1 "github.com/openkruise/kruise/apis/apps/v1alpha1"
2525
appsv1beta1 "github.com/openkruise/kruise/apis/apps/v1beta1"
26+
"github.com/openkruise/kruise/pkg/util"
2627
"github.com/openkruise/kruise/pkg/webhook/util/deletionprotection"
2728
admissionv1 "k8s.io/api/admission/v1"
2829
"k8s.io/klog/v2"
@@ -87,6 +88,7 @@ func (h *StatefulSetCreateUpdateHandler) Handle(ctx context.Context, req admissi
8788
}
8889
if err := deletionprotection.ValidateWorkloadDeletion(oldObj, oldObj.Spec.Replicas); err != nil {
8990
deletionprotection.WorkloadDeletionProtectionMetrics.WithLabelValues(fmt.Sprintf("%s_%s_%s", req.Kind.Kind, oldObj.GetNamespace(), oldObj.GetName()), req.UserInfo.Username).Add(1)
91+
util.LoggerProtectionInfo(util.ProtectionEventDeletionProtection, req.Kind.Kind, oldObj.GetNamespace(), oldObj.GetName(), req.UserInfo.Username)
9092
return admission.Errored(http.StatusForbidden, err)
9193
}
9294
}

pkg/webhook/uniteddeployment/validating/uniteddeployment_create_update_handler.go

+2
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ import (
2222
"net/http"
2323

2424
appsv1alpha1 "github.com/openkruise/kruise/apis/apps/v1alpha1"
25+
"github.com/openkruise/kruise/pkg/util"
2526
"github.com/openkruise/kruise/pkg/webhook/util/deletionprotection"
2627
admissionv1 "k8s.io/api/admission/v1"
2728
"k8s.io/klog/v2"
@@ -78,6 +79,7 @@ func (h *UnitedDeploymentCreateUpdateHandler) Handle(ctx context.Context, req ad
7879
}
7980
if err := deletionprotection.ValidateWorkloadDeletion(oldObj, oldObj.Spec.Replicas); err != nil {
8081
deletionprotection.WorkloadDeletionProtectionMetrics.WithLabelValues(fmt.Sprintf("%s_%s_%s", req.Kind.Kind, oldObj.GetNamespace(), oldObj.GetName()), req.UserInfo.Username).Add(1)
82+
util.LoggerProtectionInfo(util.ProtectionEventDeletionProtection, req.Kind.Kind, oldObj.GetNamespace(), oldObj.GetName(), req.UserInfo.Username)
8183
return admission.Errored(http.StatusForbidden, err)
8284
}
8385
}

0 commit comments

Comments
 (0)