admin/kubesphere
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ignore dryRun k8s request when auditing

Browse Source 
Signed-off-by: wanjunlei <wanjunlei@yunify.com>
This commit is contained in:
wanjunlei
2020-07-15 11:38:32 +08:00
parent 42b543ec5e
commit a0255d6409
4 changed files with 25 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
pkg/apiserver/auditing/types.go
View File

@@ -33,7 +33,7 @@ type Auditing interface {
Enabled() bool Enabled() bool
K8sAuditingEnabled() bool K8sAuditingEnabled() bool
LogRequestObject(req *http.Request, info *request.RequestInfo) *auditv1alpha1.Event LogRequestObject(req *http.Request, info *request.RequestInfo) *auditv1alpha1.Event
LogResponseObject(e *auditv1alpha1.Event, resp *ResponseCapture, info *request.RequestInfo) LogResponseObject(e *auditv1alpha1.Event, resp *ResponseCapture)
} }
type auditing struct { type auditing struct {
@@ -96,6 +96,17 @@ func (a *auditing) K8sAuditingEnabled() bool {
// //
func (a *auditing) LogRequestObject(req *http.Request, info *request.RequestInfo) *auditv1alpha1.Event { func (a *auditing) LogRequestObject(req *http.Request, info *request.RequestInfo) *auditv1alpha1.Event {
// Ignore the dryRun k8s request.
if info.IsKubernetesRequest {
values := req.URL.Query()
if v, ok := values["dryRun"]; ok {
if len(v) > 0 && v[0] == v1.DryRunAll {
klog.V(6).Infof("ignore dryRun request %s", req.URL.Path)
return nil
}
}
}
e := &auditv1alpha1.Event{ e := &auditv1alpha1.Event{
Workspace: info.Workspace, Workspace: info.Workspace,
Cluster: info.Cluster, Cluster: info.Cluster,
@@ -175,7 +186,7 @@ func (a *auditing) LogRequestObject(req *http.Request, info *request.RequestInfo
return e return e
} }
func (a *auditing) LogResponseObject(e *auditv1alpha1.Event, resp *ResponseCapture, info *request.RequestInfo) { func (a *auditing) LogResponseObject(e *auditv1alpha1.Event, resp *ResponseCapture) {
e.StageTimestamp = v1.NewMicroTime(time.Now()) e.StageTimestamp = v1.NewMicroTime(time.Now())
e.ResponseStatus = &v1.Status{Code: int32(resp.StatusCode())} e.ResponseStatus = &v1.Status{Code: int32(resp.StatusCode())}

2
pkg/apiserver/auditing/types_test.go
View File

@@ -252,7 +252,7 @@ func TestAuditing_LogResponseObject(t *testing.T) {
resp := NewResponseCapture(httptest.NewRecorder()) resp := NewResponseCapture(httptest.NewRecorder())
resp.WriteHeader(200) resp.WriteHeader(200)
a.LogResponseObject(e, resp, info) a.LogResponseObject(e, resp)
expectedEvent := &v1alpha12.Event{ expectedEvent := &v1alpha12.Event{
Event: audit.Event{ Event: audit.Event{

11
pkg/apiserver/filters/auditing.go
View File

@@ -33,10 +33,13 @@ func WithAuditing(handler http.Handler, a auditing.Auditing) http.Handler {
} }
e := a.LogRequestObject(req, info) e := a.LogRequestObject(req, info)
req = req.WithContext(request.WithAuditEvent(req.Context(), e)) if e != nil {
resp := auditing.NewResponseCapture(w) resp := auditing.NewResponseCapture(w)
handler.ServeHTTP(resp, req) handler.ServeHTTP(resp, req)
go a.LogResponseObject(e, resp, info) go a.LogResponseObject(e, resp)
} else {
handler.ServeHTTP(w, req)
}
}) })
} }

9
pkg/apiserver/request/context.go
View File

@@ -18,9 +18,8 @@ package request
import ( import (
"context" "context"
"kubesphere.io/kubesphere/pkg/apiserver/auditing/v1alpha1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apiserver/pkg/apis/audit"
"k8s.io/apiserver/pkg/authentication/user" "k8s.io/apiserver/pkg/authentication/user"
) )
@@ -87,12 +86,12 @@ func UserFrom(ctx context.Context) (user.Info, bool) {
} }
// WithAuditEvent returns set audit event struct. // WithAuditEvent returns set audit event struct.
func WithAuditEvent(parent context.Context, ev *v1alpha1.Event) context.Context { func WithAuditEvent(parent context.Context, ev *audit.Event) context.Context {
return WithValue(parent, auditKey, ev) return WithValue(parent, auditKey, ev)
} }
// AuditEventFrom returns the audit event struct on the ctx // AuditEventFrom returns the audit event struct on the ctx
func AuditEventFrom(ctx context.Context) *v1alpha1.Event { func AuditEventFrom(ctx context.Context) *audit.Event {
ev, _ := ctx.Value(auditKey).(*v1alpha1.Event) ev, _ := ctx.Value(auditKey).(*audit.Event)
return ev return ev
} }