admin/kubesphere
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #2427 from wanjunlei/auditing-log

Browse Source 
ignore dryRun k8s request when auditing
This commit is contained in:
KubeSphere CI Bot
2020-07-20 14:55:49 +08:00
committed by GitHub
parent 71b8d96a45 5d99024f0b
commit bd6f46a5c9
4 changed files with 22 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
pkg/apiserver/auditing/types.go
View File

@@ -33,7 +33,7 @@ type Auditing interface {
Enabled() bool
K8sAuditingEnabled() bool
LogRequestObject(req *http.Request, info *request.RequestInfo) *auditv1alpha1.Event
LogResponseObject(e *auditv1alpha1.Event, resp *ResponseCapture, info *request.RequestInfo)
LogResponseObject(e *auditv1alpha1.Event, resp *ResponseCapture)
}
type auditing struct {
@@ -96,6 +96,14 @@ func (a *auditing) K8sAuditingEnabled() bool {
//
func (a *auditing) LogRequestObject(req *http.Request, info *request.RequestInfo) *auditv1alpha1.Event {
// Ignore the dryRun k8s request.
if info.IsKubernetesRequest {
if len(req.URL.Query()["dryRun"]) != 0 {
klog.V(6).Infof("ignore dryRun request %s", req.URL.Path)
return nil
}
}
e := &auditv1alpha1.Event{
Workspace: info.Workspace,
Cluster: info.Cluster,
@@ -175,7 +183,7 @@ func (a *auditing) LogRequestObject(req *http.Request, info *request.RequestInfo
return e
}
func (a *auditing) LogResponseObject(e *auditv1alpha1.Event, resp *ResponseCapture, info *request.RequestInfo) {
func (a *auditing) LogResponseObject(e *auditv1alpha1.Event, resp *ResponseCapture) {
e.StageTimestamp = v1.NewMicroTime(time.Now())
e.ResponseStatus = &v1.Status{Code: int32(resp.StatusCode())}

2
pkg/apiserver/auditing/types_test.go
View File

@@ -252,7 +252,7 @@ func TestAuditing_LogResponseObject(t *testing.T) {
resp := NewResponseCapture(httptest.NewRecorder())
resp.WriteHeader(200)
a.LogResponseObject(e, resp, info)
a.LogResponseObject(e, resp)
expectedEvent := &v1alpha12.Event{
Event: audit.Event{

11
pkg/apiserver/filters/auditing.go
View File

@@ -33,10 +33,13 @@ func WithAuditing(handler http.Handler, a auditing.Auditing) http.Handler {
}
e := a.LogRequestObject(req, info)
req = req.WithContext(request.WithAuditEvent(req.Context(), e))
resp := auditing.NewResponseCapture(w)
handler.ServeHTTP(resp, req)
if e != nil {
resp := auditing.NewResponseCapture(w)
handler.ServeHTTP(resp, req)
go a.LogResponseObject(e, resp, info)
go a.LogResponseObject(e, resp)
} else {
handler.ServeHTTP(w, req)
}
})
}

9
pkg/apiserver/request/context.go
View File

@@ -18,9 +18,8 @@ package request
import (
"context"
"kubesphere.io/kubesphere/pkg/apiserver/auditing/v1alpha1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apiserver/pkg/apis/audit"
"k8s.io/apiserver/pkg/authentication/user"
)
@@ -87,12 +86,12 @@ func UserFrom(ctx context.Context) (user.Info, bool) {
}
// WithAuditEvent returns set audit event struct.
func WithAuditEvent(parent context.Context, ev *v1alpha1.Event) context.Context {
func WithAuditEvent(parent context.Context, ev *audit.Event) context.Context {
return WithValue(parent, auditKey, ev)
}
// AuditEventFrom returns the audit event struct on the ctx
func AuditEventFrom(ctx context.Context) *v1alpha1.Event {
ev, _ := ctx.Value(auditKey).(*v1alpha1.Event)
func AuditEventFrom(ctx context.Context) *audit.Event {
ev, _ := ctx.Value(auditKey).(*audit.Event)
return ev
}