-
Notifications
You must be signed in to change notification settings - Fork 1.1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[PLAT-9862]Observability: Audit log support for k8s
Summary:
This PR introduces support for managing audit log configurations in a Kubernetes-based universe. Enabling audit logs will perform the following actions:
- YBA will validate the presence of the OpenTelemetry Operator before enabling audit logs.
- The ysql_pg_conf_csv parameter will be updated based on the audit log settings specified in taskParams.
- YBA will configure the OpenTelemetry Collector via Helm values
- The universe.userIntent will be updated to reflect the new audit log configuration.
Exporter settings (entire configuration)
```
otelCollector:
enabled: true
exporters:
datadog:
api:
key: <KEY>
site: <SITE>
retry_on_failure:
enabled: true
initial_interval: 1m
max_elapsed_time: 1800m
max_interval: 1800m
sending_queue:
enabled: true
storage: file_storage/queue
recievers:
ysql:
lineStartPattern: ([A-Z]\d{4})|((?P<timestamp_with_ms>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}[.]\d{3}
\w{3})[ ][[](?P<process_id>\d+)[]][ ])
regex: '(?P<timestamp_with_ms>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}[.]\d{3} \w{3})[
][[](?P<process_id>\d+)[]][ ](?P<log_level>\w+): AUDIT: (?P<audit_type>\w+),(?P<statement_id>\d+),(?P<substatement_id>\d+),(?P<class>\w+),(?P<command>[^,]+),(?P<object_type>[^,]*),(?P<object_name>[^,]*),(?P<statement>(.|\n|\r|\s)*)'
timestamp:
layout: '%Y-%m-%d %H:%M:%S.%L %Z'
parse_from: attributes.timestamp_with_ms
secretEnv: []
```
Test Plan:
- Create a k8s universe -> enable audit config -> Edit universe -> Disable audit config
- Enable multiple exporters via API
- Enable only audit logs (export disabled)
- Enable audit logs on a universe with RR
- Enable exporter on a cluster without opentelemetry operator installed -> Precheck fails
- Skip precheck by setting skip_opentelemetry_operator_check to true -> retry task -> task fails at future step
Reviewers: anijhawan, vkumar, skurapati, amalyshev, vbansal
Reviewed By: vkumar, amalyshev
Subscribers: svc_phabricator, yugaware
Differential Revision: https://phorge.dev.yugabyte.com/D41338- Loading branch information
Showing
23 changed files
with
654 additions
and
160 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
47 changes: 47 additions & 0 deletions
47
...in/java/com/yugabyte/yw/commissioner/tasks/subtasks/check/CheckOpentelemetryOperator.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| /* | ||
| * Copyright 2025 YugaByte, Inc. and Contributors | ||
| * | ||
| * Licensed under the Polyform Free Trial License 1.0.0 (the "License"); you | ||
| * may not use this file except in compliance with the License. You | ||
| * may obtain a copy of the License at | ||
| * | ||
| * http://github.com/YugaByte/yugabyte-db/blob/master/licenses/POLYFORM-FREE-TRIAL-LICENSE-1.0.0.txt | ||
| */ | ||
|
|
||
| package com.yugabyte.yw.commissioner.tasks.subtasks.check; | ||
|
|
||
| import com.google.inject.Inject; | ||
| import com.yugabyte.yw.commissioner.BaseTaskDependencies; | ||
| import com.yugabyte.yw.commissioner.tasks.KubernetesTaskBase; | ||
| import com.yugabyte.yw.common.ShellKubernetesManager; | ||
| import com.yugabyte.yw.forms.UniverseDefinitionTaskParams; | ||
| import lombok.extern.slf4j.Slf4j; | ||
|
|
||
| @Slf4j | ||
| public class CheckOpentelemetryOperator extends KubernetesTaskBase { | ||
|
|
||
| private final ShellKubernetesManager shellKubernetesManager; | ||
|
|
||
| @Inject | ||
| protected CheckOpentelemetryOperator( | ||
| BaseTaskDependencies baseTaskDependencies, ShellKubernetesManager shellKubernetesManager) { | ||
| super(baseTaskDependencies); | ||
| this.shellKubernetesManager = shellKubernetesManager; | ||
| } | ||
|
|
||
| @Override | ||
| public UniverseDefinitionTaskParams taskParams() { | ||
| return (UniverseDefinitionTaskParams) taskParams; | ||
| } | ||
|
|
||
| @Override | ||
| public void run() { | ||
| try { | ||
| shellKubernetesManager.checkOpentelemetryOperatorRunning(); | ||
| } catch (Exception e) { | ||
| log.error("Error executing task {} with error={}.", getName(), e.getMessage()); | ||
| throw e; | ||
| } | ||
| log.info("Opentelemetry collector is installed."); | ||
| } | ||
| } |
86 changes: 86 additions & 0 deletions
86
...n/java/com/yugabyte/yw/commissioner/tasks/upgrade/ModifyKubernetesAuditLoggingConfig.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,86 @@ | ||
| /* | ||
| * Copyright 2023 YugaByte, Inc. and Contributors | ||
| * | ||
| * Licensed under the Polyform Free Trial License 1.0.0 (the "License"); you | ||
| * may not use this file except in compliance with the License. You | ||
| * may obtain a copy of the License at | ||
| * | ||
| * http://github.com/YugaByte/yugabyte-db/blob/master/licenses/POLYFORM-FREE-TRIAL-LICENSE-1.0.0.txt | ||
| */ | ||
| package com.yugabyte.yw.commissioner.tasks.upgrade; | ||
|
|
||
| import com.yugabyte.yw.commissioner.BaseTaskDependencies; | ||
| import com.yugabyte.yw.commissioner.KubernetesUpgradeTaskBase; | ||
| import com.yugabyte.yw.commissioner.TaskExecutor.SubTaskGroup; | ||
| import com.yugabyte.yw.commissioner.UserTaskDetails.SubTaskGroupType; | ||
| import com.yugabyte.yw.commissioner.tasks.subtasks.check.CheckOpentelemetryOperator; | ||
| import com.yugabyte.yw.common.config.UniverseConfKeys; | ||
| import com.yugabyte.yw.common.operator.OperatorStatusUpdaterFactory; | ||
| import com.yugabyte.yw.forms.AuditLogConfigParams; | ||
| import com.yugabyte.yw.forms.UniverseDefinitionTaskParams.Cluster; | ||
| import com.yugabyte.yw.models.Universe; | ||
| import javax.inject.Inject; | ||
| import lombok.extern.slf4j.Slf4j; | ||
|
|
||
| @Slf4j | ||
| public class ModifyKubernetesAuditLoggingConfig extends KubernetesUpgradeTaskBase { | ||
|
|
||
| @Inject | ||
| protected ModifyKubernetesAuditLoggingConfig( | ||
| BaseTaskDependencies baseTaskDependencies, | ||
| OperatorStatusUpdaterFactory operatorStatusUpdaterFactory) { | ||
| super(baseTaskDependencies, operatorStatusUpdaterFactory); | ||
| } | ||
|
|
||
| @Override | ||
| protected AuditLogConfigParams taskParams() { | ||
| return (AuditLogConfigParams) taskParams; | ||
| } | ||
|
|
||
| @Override | ||
| public SubTaskGroupType getTaskSubGroupType() { | ||
| return SubTaskGroupType.Provisioning; | ||
| } | ||
|
|
||
| @Override | ||
| protected void createPrecheckTasks(Universe universe) { | ||
| super.createPrecheckTasks(universe); | ||
| addBasicPrecheckTasks(); | ||
| if (!confGetter.getConfForScope(universe, UniverseConfKeys.skipOpentelemetryOperatorCheck)) { | ||
| checkOtelOperatorInstallation(universe); | ||
| } | ||
| } | ||
|
|
||
| @Override | ||
| public void run() { | ||
| runUpgrade( | ||
| () -> { | ||
| Universe universe = getUniverse(); | ||
| Cluster cluster = universe.getUniverseDetails().getPrimaryCluster(); | ||
| cluster.userIntent.auditLogConfig = taskParams().auditLogConfig; | ||
|
|
||
| // Create Kubernetes Upgrade Task. | ||
| createUpgradeTask( | ||
| universe, | ||
| cluster.userIntent.ybSoftwareVersion, | ||
| /* upgradeMasters */ true, | ||
| /* upgradeTservers */ true, | ||
| universe.isYbcEnabled(), | ||
| universe.getUniverseDetails().getYbcSoftwareVersion()); | ||
| updateAndPersistAuditLoggingConfigTask(); | ||
| }); | ||
| } | ||
|
|
||
| private void checkOtelOperatorInstallation(Universe universe) { | ||
| if (confGetter.getConfForScope(universe, UniverseConfKeys.skipOpentelemetryOperatorCheck)) { | ||
| log.info("Skipping Opentelemetry Operator check."); | ||
| return; | ||
| } | ||
| SubTaskGroup subTaskGroup = | ||
| createSubTaskGroup("CheckOpentelemetryOperator", SubTaskGroupType.PreflightChecks); | ||
| CheckOpentelemetryOperator task = createTask(CheckOpentelemetryOperator.class); | ||
| task.initialize(universe.getUniverseDetails()); | ||
| subTaskGroup.addSubTask(task); | ||
| getRunnableTask().addSubTaskGroup(subTaskGroup); | ||
| } | ||
| } |
Oops, something went wrong.