initial commit

.github/release-drafter.yml

@@ -0,0 +1,30 @@
+name-template: 'v$RESOLVED_VERSION'
+tag-template: 'v$RESOLVED_VERSION'
+
+template: |
+  ## General Changes
+
+  $CHANGES
+
+categories:
+- title: '🚀 Features'
+  labels:
+  - 'feature'
+  - 'enhancement'
+- title: '🐛 Bug Fixes'
+  labels:
+  - 'fix'
+  - 'bugfix'
+  - 'bug'
+
+version-resolver:
+  major:
+    labels:
+    - 'major'
+  minor:
+    labels:
+    - 'minor'
+  patch:
+    labels:
+    - 'patch'
+  default: patch

.github/workflows/docker.yaml

@@ -0,0 +1,45 @@
+---
+name: Docker Build Action
+on:
+  pull_request:
+    branches:
+      - main
+  release:
+    types:
+      - published
+  push:
+    branches:
+      - main
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build:
+    name: Docker Build
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Log in to the container registry
+      uses: docker/login-action@v2
+      with:
+        registry: ${{ env.REGISTRY }}
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Checkout
+      uses: actions/checkout@v3
+
+    - name: Make tag
+      run: |
+        [ "${GITHUB_EVENT_NAME}" == 'pull_request' ] && echo "tag=${GITHUB_HEAD_REF##*/}" >> $GITHUB_ENV || true
+        [ "${GITHUB_EVENT_NAME}" == 'release' ] && echo "tag=${GITHUB_REF##*/}" >> $GITHUB_ENV || true
+        [ "${GITHUB_EVENT_NAME}" == 'push' ] && echo "tag=latest" >> $GITHUB_ENV || true
+
+    - name: Build and push image
+      uses: docker/build-push-action@v4
+      with:
+        context: .
+        push: true
+        tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.tag }}

.github/workflows/release-drafter.yaml

@@ -0,0 +1,15 @@
+---
+name: Release Drafter Action
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: release-drafter/release-drafter@v5
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/test.yaml

@@ -0,0 +1,35 @@
+---
+name: Test Action
+on:
+  pull_request:
+    branches:
+      - main
+  release:
+    types:
+      - published
+  push:
+    branches:
+      - main
+
+jobs:
+  build:
+    name: Test and Lint
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v3
+
+    - name: Setup Go
+      uses: actions/setup-go@v4
+      with:
+        go-version-file: 'go.mod'
+        cache: false
+
+    - name: Lint
+      uses: golangci/golangci-lint-action@v3
+      with:
+        args: --build-tags integration -p bugs -p unused --timeout=3m
+
+    - name: Test
+      run: make test

.gitignore

@@ -0,0 +1,8 @@
+.idea/
+vendor
+tools/vendor
+VERSION
+helm
+.vscode
+hack/tools/bin/*
+bin

.golangci.yaml

@@ -0,0 +1,7 @@
+run:
+  concurrency: 4
+  deadline: 10m
+
+linters:
+  disable:
+  - unused

Dockerfile

@@ -0,0 +1,12 @@
+FROM golang:1.21 AS builder
+
+WORKDIR /go/src/github.com/metal-stack/gardener-extension-audit
+COPY . .
+RUN make install \
+ && strip /go/bin/gardener-extension-audit
+
+FROM alpine:3.18
+WORKDIR /
+COPY charts /charts
+COPY --from=builder /go/bin/gardener-extension-audit /gardener-extension-audit
+CMD ["/gardener-extension-audit"]

Dockerfile.dev

@@ -0,0 +1,3 @@
+FROM alpine:3.17
+COPY bin/gardener-extension-audit /gardener-extension-audit
+CMD ["/gardener-extension-audit"]

LICENCE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2020 by the metal-stack.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

Makefile

@@ -0,0 +1,98 @@
+IMAGE_TAG                   := $(or ${GITHUB_TAG_NAME}, latest)
+REGISTRY                    := ghcr.io/metal-stack
+IMAGE_PREFIX                := $(REGISTRY)
+REPO_ROOT                   := $(shell dirname "$(realpath $(lastword $(MAKEFILE_LIST)))")
+HACK_DIR                    := $(REPO_ROOT)/hack
+HOSTNAME                    := $(shell hostname)
+LD_FLAGS                    := "-w -X github.com/metal-stack/gardener-extension-audit/pkg/version.Version=$(IMAGE_TAG)"
+VERIFY                      := true
+LEADER_ELECTION             := false
+IGNORE_OPERATION_ANNOTATION := false
+WEBHOOK_CONFIG_URL          := localhost
+
+GOLANGCI_LINT_VERSION := v1.54.2
+GO_VERSION := 1.21
+
+ifeq ($(CI),true)
+  DOCKER_TTY_ARG=""
+else
+  DOCKER_TTY_ARG=t
+endif
+
+export GO111MODULE := on
+
+TOOLS_DIR := hack/tools
+-include vendor/github.com/gardener/gardener/hack/tools.mk
+
+#################################################################
+# Rules related to binary build, Docker image build and release #
+#################################################################
+
+.PHONY: build
+build:
+	go build -ldflags $(LD_FLAGS) -tags netgo -o bin/gardener-extension-audit ./cmd/gardener-extension-audit
+
+.PHONY: install
+install: revendor $(HELM)
+	@LD_FLAGS="-w -X github.com/gardener/$(EXTENSION_PREFIX)-$(NAME)/pkg/version.Version=$(VERSION)" \
+	$(REPO_ROOT)/vendor/github.com/gardener/gardener/hack/install.sh ./...
+
+.PHONY: docker-image
+docker-image:
+	@docker build --no-cache \
+		--build-arg VERIFY=$(VERIFY) \
+		--tag $(IMAGE_PREFIX)/gardener-extension-audit:$(IMAGE_TAG) \
+		--file Dockerfile --memory 6g .
+
+.PHONY: docker-push
+docker-push:
+	@docker push $(IMAGE_PREFIX)/gardener-extension-audit:$(IMAGE_TAG)
+
+#####################################################################
+# Rules for verification, formatting, linting, testing and cleaning #
+#####################################################################
+
+.PHONY: revendor
+revendor:
+	@GO111MODULE=on go mod vendor
+	@GO111MODULE=on go mod tidy
+	@chmod +x $(REPO_ROOT)/vendor/github.com/gardener/gardener/hack/*
+	@chmod +x $(REPO_ROOT)/vendor/github.com/gardener/gardener/hack/.ci/*
+	@$(REPO_ROOT)/hack/update-github-templates.sh
+
+.PHONY: clean
+clean:
+	@$(shell find ./example -type f -name "controller-registration.yaml" -exec rm '{}' \;)
+	@$(REPO_ROOT)/vendor/github.com/gardener/gardener/hack/clean.sh ./cmd/... ./pkg/...
+
+.PHONY: check-generate
+check-generate:
+	@$(REPO_ROOT)/vendor/github.com/gardener/gardener/hack/check-generate.sh $(REPO_ROOT)
+
+.PHONY: generate
+generate: $(HELM)
+	@$(REPO_ROOT)/vendor/github.com/gardener/gardener/hack/generate.sh ./charts/... ./cmd/... ./pkg/...
+
+.PHONY: generate-in-docker
+generate-in-docker: revendor $(HELM)
+	# comment back in after first release:
+	# echo $(shell git describe --abbrev=0 --tags) > VERSION
+	docker run --rm -i$(DOCKER_TTY_ARG) -v $(PWD):/go/src/github.com/metal-stack/gardener-extension-audit golang:$(GO_VERSION) \
+		sh -c "cd /go/src/github.com/metal-stack/gardener-extension-audit \
+				&& make generate \
+				# && make install generate \
+				&& chown -R $(shell id -u):$(shell id -g) ."
+
+.PHONY: test
+test:
+	go test -v ./...
+
+.PHONY: push-to-gardener-local
+push-to-gardener-local:
+	CGO_ENABLED=1 go build \
+		-ldflags "-extldflags '-static -s -w'" \
+		-tags 'osusergo netgo static_build' \
+		-o bin/gardener-extension-audit \
+		./cmd/gardener-extension-audit
+	docker build -f Dockerfile.dev -t ghcr.io/metal-stack/gardener-extension-audit:latest .
+	kind --name gardener-local load docker-image ghcr.io/metal-stack/gardener-extension-audit:latest

README.md

@@ -0,0 +1,7 @@
+# gardener-extension-audit
+
+Provides a Gardener extension for sending audit traces to a backend and forwarding them into the shoot cluster.
+
+## Supported Backends
+
+- Splunk