diff --git a/architecture.drawio.svg b/architecture.drawio.svg index 3d5d88e..d0e7d23 100644 --- a/architecture.drawio.svg +++ b/architecture.drawio.svg @@ -1,4 +1,4 @@ - + @@ -54,7 +54,7 @@ - + @@ -89,12 +89,12 @@ - - + + -
+
cluster forwarding @@ -104,13 +104,13 @@
- + cluster forwarding... - - + + @@ -145,7 +145,7 @@ - + @@ -233,11 +233,11 @@ - + -
+
External Audit Sinks @@ -247,7 +247,7 @@
- + External Audit Sinks... @@ -292,7 +292,7 @@ - + @@ -314,6 +314,25 @@ + + + + +
+
+
+ audittailer-vpn-gateway +
+
+
+ + + audittailer-vpn-gateway + + + + + diff --git a/charts/gardener-extension-audit/templates/deployment.yaml b/charts/gardener-extension-audit/templates/deployment.yaml index fdb9a5f..b1c8e9d 100644 --- a/charts/gardener-extension-audit/templates/deployment.yaml +++ b/charts/gardener-extension-audit/templates/deployment.yaml @@ -19,6 +19,9 @@ spec: {{- end }} checksum/configmap-{{ include "name" . }}-config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} labels: + networking.gardener.cloud/to-runtime-apiserver: allowed + networking.gardener.cloud/to-dns: allowed + networking.resources.gardener.cloud/to-all-shoots-kube-apiserver-tcp-443: allowed {{ include "labels" . | indent 8 }} spec: containers: diff --git a/charts/images.yaml b/charts/images.yaml index 10113b4..d1ceb6d 100644 --- a/charts/images.yaml +++ b/charts/images.yaml @@ -2,7 +2,7 @@ images: - name: audit-forwarder sourceRepository: https://github.com/metal-stack/audit-forwarder repository: ghcr.io/metal-stack/audit-forwarder - tag: "latest" + tag: "support-audit-extension" # TODO: Pinning - name: fluent-bit sourceRepository: https://github.com/fluent/fluent-bit repository: fluent/fluent-bit diff --git a/example/controller-registration.yaml b/example/controller-registration.yaml index e102be4..fec1daa 100644 --- a/example/controller-registration.yaml +++ b/example/controller-registration.yaml @@ -5,7 +5,7 @@ metadata: name: audit type: helm providerConfig: - chart: H4sIAAAAAAAAA+0ca2/bOLKf9SsIdxdogZNkO46zENC7S1PfbnBtEiS9LA6HQ0BLtK1GErUUlSbX9r/f8CGZkmXLTlKn3XpQwBJFzgw5D86Qk04xC0hCmE1uOUmykCY2zoOQu88eD7oAB/v78heg/iufe3uDXn+/PxyK9t5gMOw+Q/uPyMNSyDOOGULPGKV8Vb+2798pTJfJ/2iGGXfucBw9mIYQ8HAwWCr/fnevJv/hAH5Q9xHm1wo/uPxxGl4SJuTuoZuehdN0/tp1ek7XCkjmszDlsu0Q/UaiGPlCOdCEMsRnBEmFQaUCWQmOiYeWaZZ1UyPw1EvwQ8NS+w+o70zpo9Bos//BsFez/32Anf1vA1x3Sr2p0ADMCcpmyPZRx3Fc+HdDkoAydxryWT52fBq7hbLMH2bYv3aL4bZPE85oFIE6MTINMw6toFEOoFU+wkE/vfAx/EoCl6Pzi+PTk5f6ldziOI2IuwyL2IvQqFBTT2LsWJbrojPgAk+JdkskweOIZKgysTxNqXZZujFMptJ7+ZQx4nM0J4sqZK3UxP5n81ZL7Z8TEAYsXfbwSHDz+G842B/u4r9twBryv5qRKIU92+Hp/WLBFv/f6/f2q/Lvdw8ODnb+fxvw6ZONAjIJE4I6Im7rIPvLF2tp7Ca6w7YgO1nm2AiPSZQ5ED861+ROYZEv+ZiwhIAeOSF1BYUKjiUobnCUa1Y+fUJh4kd5UDLoID1wBSOLY+sMCiweWtJD05eUFmcRJqAziU/kcOecRARnxDkB5ho5K1kLY9hGFGcIiS/hBM1wdsbg+y3qZDPc3x96QPZSkAdSor/D8RSVI1IWJnyCOj9nf/85q/dkJKVZyCm7W4UC5kiaEHr3RgiTNeZdF0hA0ojexSThOvAvlSNzIeMwl+upjeEHhDX8PwRGk3Aa49SWwr+BYIkym4I0P7KQk/Yzgvb4v5b/gxns7fz/VkC7oYp5X0oJnxYCVk6wckxwHSaBh46kYrzDqRUTjgPMsQcuQWX/zW67WYP0oAwC7QafKpuVt1Ee2mvw6wL9Z2gEXeZoIHoX7EiK2VVVXT30WSBZOesqOsO7PbXIHhU2sf/7nga2xX/D+vlfv7fX3eX/W4HHMuxSSb6qMSsqpQkjANu25a85EanBjuA9ckq9zhw9ulB5x49oHkAMgqN0hnsSSzl/fRSgViJXRwFWzVlqfH4UAqPQMwEPAt3U9IDZWrsnW4FT3yepaAfG+Pu7lGRynRj5Iw8ZCVCnBb+ziACFWTm+08Zf03jNslzhonVDroyRm7FjDiz5+CPddFVgxGZ0xYCS3jhnGd+QohyzGU015BvaT9bw//MA/p4bQIv/H3YPenX/D087/78NqLhNnZIpJ/imFPvau8BX8f1ZSnxBmJGbUPD5W5iJjPRtGIdgsF35JY1CHyuHUVigbjyiecIV0Qx4ESGe8sMx5v7s7Xp8DBWCwiQ0AmNRpFtPEsrlPpEVTWWW3xZeF939GfGvszw2ci5pjc1xc0UML2Qmj35y3msundew8GeYz1BnrRSu81JOWZ1CAA8mX4a3WsHqytDgHsy2sLWmEv1SjCgUqdjmcAh+r5SV3abZCuT6eahTzx7Ms5IvX7yFz+rEpFPFc5ZH0RkFNb2rqK4akZYfK8tO4xiDeZYNNnKXntbN+9haCq9cwn23eY564V0jyKpgiPGtwOLnjMG62oyIlzAi2SuD9/ktinzWnS/uEj8zpyHwzQiO+Ezq0ea4jcFtdMJpQhmxaUpUGGfPLXUZdjXktBhxWA6o4/5IxjNKr/Xq2qX3e7XC+S0dnREGFmmLiyqTMd1LhaKO6nQmLrNq2IIwExdfxi1cZfX053lsm4GNfKBhgjp/6Zi4SHJjqpcyi7ejwzej86vR29HR++PTk6uTw3eji7PDo1HZEyF5avoPRmPPaERoEpIoOCeTaqtuFzbvlb7UKRfwvh604Pf43eGvo0tg9vT86vRydP77+fH7BV495MpLPeN4wG08L1jlCIW4ssUFK2Sr5GVQLl2PkGHF7tcRNNBjlFOfQgL0/uisnpIwktGc+aRiBGWj9JWc/ltcpC6O+IwS7TJ73VqIWq4ajfKYvBN7asOUlRobrMaio5Jwu995qMSXHS01MbMgdaMfIzg4TSJwyZzlZLnkhXxCnxz6vkB80r55PEd4MgmTkN95ZYtQn+Aw4eFhwydUJhZvctgvpxfg7oI8gqdj6Z908+iW+LmZYD7X6yI3w4tK1FN8lAsiIqDRbQoakJlRy7yHja7J3dJLkvIaZWEcQsrZAlV0nDR8ltbXQFCQXONKpjqM05RGdHr3T8Frp3pVM6MZl4LQY5QCL2z6NQ30i/MP02WtffxRQEAmOI/4OxrAuEG/qz9tpN7rKffm/LYZywrev4WsdQePBWvk/+ChIHZguSwBHOfBlGx4ENB2/7M/OKjl/3uDwS7/3wpobzTl6IXIyJqy55eoV78CSmVe4t70xhC4FQcGZzR4U+rJa6kn38bJASQX/0rwDQ4jEQBL9Fk+bp3wg08MvgdvuYb9szH2H1QI3mL/e4N+v17/A487+98GiOsT07KlsHHOZ5SF/1MFkNe/yFBqfjsUwZoRdk4jsol9b2K5LI9EkKZ/bHG58yujeSoDNxsZdzrVyxyrkuyIrr5iNoMXCHPGulW4Jhkhh5l6+Chse5EQDuJQBseVilC1IIu04pzLslKdx/nm3dF6DIinPIUFJYp5yEX0Y9rM4AYrMe9ae3XBAni+PoNpndUFrkrKrUzFOIFANChb12bCWBpjweasBeC6m1jrdBaZyAhg42pZykD+aVgpN8F7KmwTTojzE17Dt4rnBaQ+pSwIk9XKL3fr5VTaGN+MRtEug4OaeusTc+gbiG0tUjdvVcaMOYuVfY6CRNzi+cBDBupAYkgq0ZggLErBdX78twdZHxDQ+Guvm1jfw5z1a2gA7/TVfDaQ0Kd8xTKt4NAq79qN3aSFHwjaPoA05Y6gBl9UzmAeJ8Z86h15u7BG/KcPuu4fArbmf92F+G9X/70laKz/0Wb1bWRvXJaiaDdxfFZJy9a7ty1P6G356KHBYE9mdNWjdHmWiBn43o1O5p9agg+D9e0fKyd7DzfQZv/9Qb3+o7+3P9jZ/zZglf0X2+qTuoGnXqA/OSy1f3VF8yj/AUBr/e/BQf3v/4b7u/PfrYCqZ5H5SlG/4qHpzGcii5AVtDYskPgj3+VFJhxPPST3CvGWGkUtx5MTys8gFRJVZJZ5xuqhnjVPkdCnL5Zl1C3oWl+zqsND+9BolH2oQ9nGXkvLNzw0wVFGLGuxGMJD//lv0fy72u5VG2SHTXd0ov5Y3ECqegFPPhe3dSnOM1WHIS/6LXVTqSZ7bq7z/E+r59eW5uM4omM3xiLyccd5GAWuRO2+of41YZMQcqbiotjAqoQ3pXQakat5pZMaa+M4GA70MCm5zp7T7eiG8v9m6Dm9nnP7fc+qtzCrzl9fiZn11QfHcSyrEtp5lrrXL4ozRKBo+eWn5orupnpunEpVF53cDxlNCl2d11Y39pBVz72uum7VJcm9va5V/kGmZ5mz6ex2xx3sYAc72MEOdrA5/B/CcOBuAFAAAA== + chart: H4sIAAAAAAAAA+0ca2/bOLKf9SsIdxdogZNkO7azENC7S1PfbnBtEiS9LA6HQ0BLtK1GErUUlSbX9r/f8CGZkmXLTtKk3XoQwDLFGQ45D85w6MwwC0hCmE1uOEmykCY2zoOQu88eDroA+8Oh/ASof8rn3t6g1x/2RyPR3hsMRt1naPiAPKyEPOOYIfSMUcrX9Wt7/53CbJX8D+eYcecWx9G9xxACHg0GK+Xf7+7V5D8awAfqPsD8WuEHlz9OwwvChNw9dN2zcJouvnadntO1ApL5LEy5bDtAv5EoRr5QDjSlDPE5QVJhUKlAVoJj4qFVmmVd1wZ46iX4oWGl/QfUd2b0QcZos//BqFez/yHAzv4fA1x3Rr2Z0ADMCcrmyPZRx3Fc+LsmSUCZOwv5PJ84Po3dQlkWD3PsX7kFuu3ThDMaRaBOjMzCjEMraJQDZJWPcNBPL3wMn3KAi/HZ+dHJ8Uv9ldzgOI2Iu4qK2IvQuFBTT1LsWJbrolPgAs+IdkskwZOIZKgysTxNqXZZujFMZtJ7+ZQx4nO0GBZVhrVSk/qfzVuttH9OQBiwdNn9I8Ht47/RYDjaxX+PARvI/3JOohT2bIend4sFW/x/r98bVuXf7+7v7+/8/2PAp082Csg0TAjqiLitg+wvX6yVsZvoDtuC7GSZuBGekChzIH50rsitoiK/5BPCEgJ65ITUFSNUaKwgcY2jXLPy6RMKEz/Kg5JBB2nENYws49YZFFQ8tKKHHl+OtDyLMAGdSXwi0Z0zEhGcEecYmGvkrGQtjGEbUZwhJN6EUzTH2SmD9zeok81xfzjyYNgLMTwMJfo7HM9QiZGyMOFT1Pk5+/vPWb0nIynNQk7Z7ToSMEfSRNC7M0GYrDHvukACkkb0NiYJ14F/qRyZCxmHuVxPbQw/IGzg/yEwmoazGKe2FP41BEuU2RSk+ZGFnLSfEbTH/7X8H8xgb+f/HwW0G6qY94WU8EkhYOUEK8cEV2ESeOhQKsY7nFox4TjAHHvgElT23+y2mzVII2UQaDf4VNmsvI3y0F6DXxfkP0Mj6DJHA9G7YEeOmF1W1dVDnwWRtbOukjO821OL7EFhG/u/62lgW/w3qp//9Xt73V3+/yjwUIZdKslXNWY1SmnCCMC2bflpTkRqsCN4j5xSrzNHYxcq7/gRzQOIQXCUznFPUinnr48C1Erk6ijAqjlLTc+PQmAUeibgQaCbmh4wW2v3ZCtw6vskFe3AGH9/m5JMrhMjf+QhIwHqtNB3lgmgMCvxO238NeFrluUKF61bcmVgbseOiVjy8Ue67aoAxnbjCoRyvEnOMr7liBJnuzEVyje0n2zg/xcB/B03gBb/Pxp06/l/b9jfxX+PAhW3qVMy5QTflGLfeBf4Kr4/S4kvBmbkOhR8/hZmIiN9G8YhGGxXvkmj0MfKYRQWqBsPaZ5wNWgGvIgQT/nhGHN//nYzPkaKQGESmoCxKNKtJwnlcp/IiqYyy28Lr4vu/pz4V1keGzmXtMbmuLkihhcyk0c/Oe81l85rWPhTzOeos1EK13kpp6xOIYAHky/DW61hdW1ocAdmW9gqlKjgKCH8I2WgvEtbPKc2AzUIY2KDvmeEwcRB3aOIfiTBZvgBSHUdBiMZzZkPMl7GBTQ7m4P/yGxxkLTgweZ+ag8GewvKLYr4SzH7wiiKLRuHMGK5FnablSqQuuChTj0TMs99vnzxll6r059Olc5pHkWnFEzutmKGCiMtX1ZUiMYxBldTNtjIXXnyuOhja4165RLuu81z1ErkGgFjhUKMbwQVP2cM1tVmRHwJI5K9MnhfVITks+58fpv4mTkNQW9OcMTn0ia2p20gt40TzhLKiE1TokJSe+F1VlFXKCcFxkGJUKf9kUxASa/06tqlJ3+1xpGvxNYKLopuJmO6lwqrHdXpVBTmatSCMBNFPKOiWFk9/XoRp2dgIx9omKDOXzomLZJcm+qlzOLt+ODN+Oxy/HZ8+P7o5Pjy+ODd+Pz04HBc9kRIngD/g9HYMxoRmoYkCs7ItNqq24X/8sp9wSkX8K67QcHv0buDX8cXwOzJ2eXJxfjs97Oj90u8esiVBUrjqMNtPPtY59SFuLLlBStkq+RljFy6HiHDit1vImgYj1FOfQrJ3PvD03p6VbpUE6dslJs2p/8WReFljM8o0S6z162F2+Wq0SiPyTsRHzRMWamxwWosOioJt/ud+0p81TFZEzNLUjf6MYKDkyQCl8xZTlZLXsgn9MmB7wvCx+2bx3OEp9MwCfmtV7YI9QkOYJs9aHiFyiTpTQ57/+wc3F2QR/B0JP2Tbh7fED83k+Xnel3kZnheieCKl3JBRDQ3vklBAzIzAlv0sNEVuV1Z8ClLQkt4CClnC6Oio6ThtbS+hgHFkBuUl6ponKY0orPbfwpeO9Wy05xmXApC4ygFXtr0axroF2c5psva+CingIBMcR7xdzQAvEG/q19tpd6bKff2/LYZyxrev4UM/Glhg/wfrBr2W5bLK4CTPJiRLQ8C2uo/w8F+Lf/fGwxGu/z/MUBb8IyjFyIja8qeX6JevQSUyljeve5NINgpDgxOafCm1JPXUk++jZMDCMj/leBrHEYiaJTks3zSOuF7nxh8Dx5mA/tnE+zf6yJ4i/3vDfr9+v0feNzZ/2OAKJ+Yli2FjXM+pyz8n7oAefWLDD8W1aEI1oywMxqRbex7G8tleSQCG/1hi+LOr4zmqQx2bGTUdKqnLVYlQRBdfcVsBl8gNJjoVuGaZFQZZurho7Dt5YFwEIcyoKzcCFULsjxWnHN5rVTnPr5ZO9qMAfGUp7CgRDEP8bt+TJsZ3GIlFl1rX12wAJ5vzmBaZ3WJq1WHYQ1LhhMI3oKydWMmjKUxFmzBWgCuu4m1TmeZiYwANa6WpQx+n4aVchO8o8I20YTYOOE1eut4XiLqU8qCMFmv/HK3Xj1KG+PbjVG0y+Cgpt76xBz6BmJbi1TlrcqYMWexss9RkIgqng88ZKAOJIZEDE0IwuIquM4p/3Yv64MBNP3a122s737O+jU0gHf6aj4bhtAnY8UyreHQKmvtxm7Swg8EbR9AmnJHUMjnlXOLh4kxn3pHflzYIP7Th0N3DwFb87/uUvy3u//9SNB4/0eb1beRvXF5FUW7iaPTSlq2Wd22PNW25aOHBoM9mdFVj5/l+Rtm4Hu3Os1+agneDza3f6yc7B3cQJv99we13//1+3vDwc7+HwPW2X+xrT6pG3jqBfqTw0r7V2WNB/kHAK33f/f367//Gw1357+PAuoOiMxXijsfHprNfSayCHmD1oYFEj/yXX0xg+OZh+ReIb6lxkWQo+kx5aeQColbZJZ5xuqhnrVIkdCnL5Zl1Pr1XV/zJoSHhtBoXJVQh7KNvVZeefDQFEcZsazlCwQe+s9/i+bf1Xav2iA7bKprifvHomqnauyefC4qXCnOM3V3QRbHLVXdU5M9M9d58dPqRanPfJxEdOLGWEQ+7iQPo8CVpN031L8ibBpCzlQUVw2qSngzSmcRuVzcDlK4No6D0UCjScl19pxuRzeU/5uh5/R6zs33Pave0qw6f30lZtZXLxzHsaxKaOdZqhZeXGgQgaLll6+ab3Q33efGqVR10cn9kNGk0NXF3erGHvLWc6+rSpT6SnJvr2uVP8j0LHM2nd3uuIMd7GAHO9jBDraH/wM5NEJSAFAAAA== values: image: tag: v0.1.0 diff --git a/example/shoot.yaml b/example/shoot.yaml index 880ee2f..c8909e1 100644 --- a/example/shoot.yaml +++ b/example/shoot.yaml @@ -42,9 +42,6 @@ spec: providerConfig: apiVersion: calico.networking.extensions.gardener.cloud/v1alpha1 kind: NetworkConfig - backend: none - typha: - enabled: false provider: type: local workers: @@ -58,8 +55,11 @@ spec: maxSurge: 1 maxUnavailable: 0 kubernetes: - version: 1.25.4 + version: 1.26.0 kubelet: + seccompDefault: true serializeImagePulls: false registryPullQPS: 10 registryBurst: 20 + protectKernelDefaults: true + streamingConnectionIdleTimeout: 5m diff --git a/pkg/controller/actuator.go b/pkg/controller/actuator.go index c5c4b65..2f2a5c5 100644 --- a/pkg/controller/actuator.go +++ b/pkg/controller/actuator.go @@ -658,7 +658,7 @@ func seedObjects(auditConfig *v1alpha1.AuditConfig, secrets map[string]*corev1.S Name forward Match audit Host audit-cluster-forwarding-vpn-gateway - Port 9090 + Port 9876 Require_ack_response True Compress gzip tls On @@ -748,9 +748,53 @@ func seedObjects(auditConfig *v1alpha1.AuditConfig, secrets map[string]*corev1.S Name: "AUDIT_TLS_VHOST", Value: "audittailer", }, + { + Name: "AUDIT_PROXY_HOST", + Value: "vpn-seed-server", + }, + { + Name: "AUDIT_PROXY_PORT", + Value: "9443", + }, + { + Name: "AUDIT_PROXY_CA_FILE", + Value: "/proxy/ca/bundle.crt", + }, + { + Name: "AUDIT_PROXY_CLIENT_CRT_FILE", + Value: "/proxy/client/tls.crt", + }, + { + Name: "AUDIT_PROXY_CLIENT_KEY_FILE", + Value: "/proxy/client/tls.key", + }, + }, + VolumeMounts: []corev1.VolumeMount{ + { + Name: "ca-vpn", + MountPath: "/proxy/ca", + ReadOnly: true, + }, + { + Name: "http-proxy", + MountPath: "/proxy/client", + ReadOnly: true, + }, }, }, }, + Volumes: []corev1.Volume{ + { + Name: "ca-vpn", + MountPath: "/proxy/ca", + ReadOnly: true, + }, + { + Name: "http-proxy", + MountPath: "/proxy/client", + ReadOnly: true, + }, + }, }, }, }, @@ -760,7 +804,28 @@ func seedObjects(auditConfig *v1alpha1.AuditConfig, secrets map[string]*corev1.S return nil, err } - objects = append(objects, auditForwarder) + auditforwarderService := &corev1.Service{ + ObjectMeta: metav1.ObjectMeta{ + Name: "audit-cluster-forwarding-vpn-gateway", + Namespace: namespace, + Labels: map[string]string{ + "app": "audit-cluster-forwarding-vpn-gateway", + }, + }, + Spec: corev1.ServiceSpec{ + Selector: map[string]string{ + "app": "audit-cluster-forwarding-vpn-gateway", + }, + Ports: []corev1.ServicePort{ + { + Port: 9876, + TargetPort: intstr.FromInt(9876), + }, + }, + }, + } + + objects = append(objects, auditForwarder, auditforwarderService) auditforwarderNetworkpolicies := []client.Object{ &networkingv1.NetworkPolicy{ @@ -913,6 +978,10 @@ func shootObjects(secrets map[string]*corev1.Secret) ([]client.Object, error) { } ) + audittailerServerSecret := secrets["audittailer-server"].DeepCopy() + audittailerServerSecret.Namespace = v1alpha1.ShootAudittailerNamespace + audittailerServerSecret.ObjectMeta.ResourceVersion = "" + return []client.Object{ &corev1.Namespace{ ObjectMeta: metav1.ObjectMeta{ @@ -922,6 +991,7 @@ func shootObjects(secrets map[string]*corev1.Secret) ([]client.Object, error) { }, }, }, + audittailerServerSecret, audittailerConfig, &appsv1.Deployment{ ObjectMeta: metav1.ObjectMeta{ @@ -1083,7 +1153,7 @@ func shootObjects(secrets map[string]*corev1.Secret) ([]client.Object, error) { Subjects: []rbacv1.Subject{ { Kind: "ServiceAccount", - Name: "audittailer-client", + Name: "audit-cluster-forwarding-vpn-gateway", Namespace: "kube-system", }, },