From 9741ceca77f7996e0e2bf4dcf0c3574c04efa30b Mon Sep 17 00:00:00 2001 From: vivekhiwarkar Date: Wed, 17 Aug 2022 12:42:00 +0530 Subject: [PATCH 1/4] Adding audit points --- pkg/sentry/kubeconfig/kubeconfig.go | 2 + pkg/service/apikey.go | 2 + pkg/service/audit_utils.go | 59 +++++++++++++++++++++++++++-- pkg/service/user.go | 1 + 4 files changed, 61 insertions(+), 3 deletions(-) diff --git a/pkg/sentry/kubeconfig/kubeconfig.go b/pkg/sentry/kubeconfig/kubeconfig.go index 1cb715a..3c980e3 100644 --- a/pkg/sentry/kubeconfig/kubeconfig.go +++ b/pkg/sentry/kubeconfig/kubeconfig.go @@ -17,6 +17,7 @@ import ( commonv3 "github.com/paralus/paralus/proto/types/commonpb/v3" sentry "github.com/paralus/paralus/proto/types/sentry" + //"go.uber.org/zap" clientcmdapiv1 "k8s.io/client-go/tools/clientcmd/api/v1" "sigs.k8s.io/yaml" @@ -342,6 +343,7 @@ func GetConfigForUser(ctx context.Context, bs service.BootstrapService, aps serv message, groups) */ + //service.DownloadKubeconfigAuditEvent(ctx, zap.L(), username) return yaml.JSONToYAML(jb) } diff --git a/pkg/service/apikey.go b/pkg/service/apikey.go index 6cd14ef..e1c976d 100644 --- a/pkg/service/apikey.go +++ b/pkg/service/apikey.go @@ -105,6 +105,7 @@ func (s *apiKeyService) Get(ctx context.Context, req *rpcv3.ApiKeyRequest) (*mod if err == sql.ErrNoRows { return nil, nil } + GenerateApiKeyAuditEvent(ctx, s.al, AuditActionGenerate, req.Username) return &apikey, err } @@ -114,5 +115,6 @@ func (s *apiKeyService) GetByKey(ctx context.Context, req *rpcv3.ApiKeyRequest) if err != nil { return nil, err } + GenerateApiKeyAuditEvent(ctx, s.al, AuditActionGenerate, req.Username) return &apikey, err } diff --git a/pkg/service/audit_utils.go b/pkg/service/audit_utils.go index 9db7faa..fcf4027 100644 --- a/pkg/service/audit_utils.go +++ b/pkg/service/audit_utils.go @@ -16,9 +16,11 @@ import ( ) const ( - AuditActionCreate = "create" - AuditActionDelete = "delete" - AuditActionUpdate = "update" + AuditActionCreate = "create" + AuditActionDelete = "delete" + AuditActionUpdate = "update" + AuditActionGenerate = "generate" + AuditActionDownload = "download" ) func CreateUserAuditEvent(ctx context.Context, al *zap.Logger, db bun.IDB, action string, name string, id uuid.UUID, rolesBefore, rolesAfter, groupsBefore, groupsAfter []uuid.UUID) { @@ -389,6 +391,57 @@ func CreateApiKeyAuditEvent(ctx context.Context, al *zap.Logger, action string, } } +func GenerateApiKeyAuditEvent(ctx context.Context, al *zap.Logger, action string, id string) { + sd, ok := GetSessionDataFromContext(ctx) + if !ok { + _log.Warn("unable to create audit event: could not fetch info from context") + return + } + + detail := &audit.EventDetail{ + Message: fmt.Sprintf("ApiKey %sd for user %s", action, id), + Meta: map[string]string{ + "apikey": id, + }, + } + if err := audit.CreateV1Event(al, sd, detail, fmt.Sprintf("apikey.%s.success", action), ""); err != nil { + _log.Warn("unable to create audit event", err) + } +} + +func DownloadKubeconfigAuditEvent(ctx context.Context, al *zap.Logger, user string) { + sd, ok := GetSessionDataFromContext(ctx) + if !ok { + _log.Warn("unable to create audit event: could not fetch info from context") + return + } + + detail := &audit.EventDetail{ + Message: fmt.Sprintf("Kubeconfig Downloaded for user %s", user), + } + _log.Infow(fmt.Sprintf("Kubeconfig Downloaded for user %s", user)) + if err := audit.CreateV1Event(al, sd, detail, fmt.Sprintf("Kubeconfig Download success %s", user), ""); err != nil { + _log.Warn("unable to create audit event", err) + } + _log.Infow("Audit event created") +} + +func DownloadCliConfigAuditEvent(ctx context.Context, al *zap.Logger, action string, user string) { + sd, ok := GetSessionDataFromContext(ctx) + if !ok { + _log.Warn("unable to create audit event: could not fetch info from context") + return + } + + detail := &audit.EventDetail{ + Message: fmt.Sprintf("CLI config Downloaded for %s", user), + } + _log.Infow(fmt.Sprintf("CLI config Downloaded for %s", user)) + if err := audit.CreateV1Event(al, sd, detail, fmt.Sprintf("CLI Config.%s.success", action), ""); err != nil { + _log.Warn("unable to create audit event", err) + } +} + func RevokeKubeconfigAuditEvent(ctx context.Context, al *zap.Logger, user string) { sd, ok := GetSessionDataFromContext(ctx) if !ok { diff --git a/pkg/service/user.go b/pkg/service/user.go index 5233222..adeef98 100644 --- a/pkg/service/user.go +++ b/pkg/service/user.go @@ -954,6 +954,7 @@ func (s *userService) RetrieveCliConfig(ctx context.Context, req *userrpcv3.ApiK Partner: part.Name, } + DownloadCliConfigAuditEvent(ctx, s.al, AuditActionCreate, req.Username) return cliConfig, nil } From 43b3bc8c7b41bfcbadbce38db25b3fede6e6f81b Mon Sep 17 00:00:00 2001 From: vivekhiwarkar Date: Thu, 18 Aug 2022 16:11:15 +0530 Subject: [PATCH 2/4] review comment changes --- pkg/sentry/kubeconfig/kubeconfig.go | 2 -- pkg/service/apikey.go | 2 -- pkg/service/audit_utils.go | 45 +++++------------------------ pkg/service/user.go | 4 ++- 4 files changed, 10 insertions(+), 43 deletions(-) diff --git a/pkg/sentry/kubeconfig/kubeconfig.go b/pkg/sentry/kubeconfig/kubeconfig.go index 3c980e3..1cb715a 100644 --- a/pkg/sentry/kubeconfig/kubeconfig.go +++ b/pkg/sentry/kubeconfig/kubeconfig.go @@ -17,7 +17,6 @@ import ( commonv3 "github.com/paralus/paralus/proto/types/commonpb/v3" sentry "github.com/paralus/paralus/proto/types/sentry" - //"go.uber.org/zap" clientcmdapiv1 "k8s.io/client-go/tools/clientcmd/api/v1" "sigs.k8s.io/yaml" @@ -343,7 +342,6 @@ func GetConfigForUser(ctx context.Context, bs service.BootstrapService, aps serv message, groups) */ - //service.DownloadKubeconfigAuditEvent(ctx, zap.L(), username) return yaml.JSONToYAML(jb) } diff --git a/pkg/service/apikey.go b/pkg/service/apikey.go index e1c976d..6cd14ef 100644 --- a/pkg/service/apikey.go +++ b/pkg/service/apikey.go @@ -105,7 +105,6 @@ func (s *apiKeyService) Get(ctx context.Context, req *rpcv3.ApiKeyRequest) (*mod if err == sql.ErrNoRows { return nil, nil } - GenerateApiKeyAuditEvent(ctx, s.al, AuditActionGenerate, req.Username) return &apikey, err } @@ -115,6 +114,5 @@ func (s *apiKeyService) GetByKey(ctx context.Context, req *rpcv3.ApiKeyRequest) if err != nil { return nil, err } - GenerateApiKeyAuditEvent(ctx, s.al, AuditActionGenerate, req.Username) return &apikey, err } diff --git a/pkg/service/audit_utils.go b/pkg/service/audit_utils.go index fcf4027..c858acb 100644 --- a/pkg/service/audit_utils.go +++ b/pkg/service/audit_utils.go @@ -19,7 +19,6 @@ const ( AuditActionCreate = "create" AuditActionDelete = "delete" AuditActionUpdate = "update" - AuditActionGenerate = "generate" AuditActionDownload = "download" ) @@ -386,46 +385,14 @@ func CreateApiKeyAuditEvent(ctx context.Context, al *zap.Logger, action string, "apikey": id, }, } - if err := audit.CreateV1Event(al, sd, detail, fmt.Sprintf("apikey.%s.success", action), ""); err != nil { - _log.Warn("unable to create audit event", err) - } -} - -func GenerateApiKeyAuditEvent(ctx context.Context, al *zap.Logger, action string, id string) { - sd, ok := GetSessionDataFromContext(ctx) - if !ok { - _log.Warn("unable to create audit event: could not fetch info from context") - return - } - - detail := &audit.EventDetail{ - Message: fmt.Sprintf("ApiKey %sd for user %s", action, id), - Meta: map[string]string{ - "apikey": id, - }, + if action == AuditActionDownload { + detail.Message = fmt.Sprintf("ApiKey %sed for %s", action, id) } if err := audit.CreateV1Event(al, sd, detail, fmt.Sprintf("apikey.%s.success", action), ""); err != nil { _log.Warn("unable to create audit event", err) } } -func DownloadKubeconfigAuditEvent(ctx context.Context, al *zap.Logger, user string) { - sd, ok := GetSessionDataFromContext(ctx) - if !ok { - _log.Warn("unable to create audit event: could not fetch info from context") - return - } - - detail := &audit.EventDetail{ - Message: fmt.Sprintf("Kubeconfig Downloaded for user %s", user), - } - _log.Infow(fmt.Sprintf("Kubeconfig Downloaded for user %s", user)) - if err := audit.CreateV1Event(al, sd, detail, fmt.Sprintf("Kubeconfig Download success %s", user), ""); err != nil { - _log.Warn("unable to create audit event", err) - } - _log.Infow("Audit event created") -} - func DownloadCliConfigAuditEvent(ctx context.Context, al *zap.Logger, action string, user string) { sd, ok := GetSessionDataFromContext(ctx) if !ok { @@ -434,10 +401,12 @@ func DownloadCliConfigAuditEvent(ctx context.Context, al *zap.Logger, action str } detail := &audit.EventDetail{ - Message: fmt.Sprintf("CLI config Downloaded for %s", user), + Message: fmt.Sprintf("CLI config %sed for %s", action, user), + Meta: map[string]string{ + "username": user, + }, } - _log.Infow(fmt.Sprintf("CLI config Downloaded for %s", user)) - if err := audit.CreateV1Event(al, sd, detail, fmt.Sprintf("CLI Config.%s.success", action), ""); err != nil { + if err := audit.CreateV1Event(al, sd, detail, fmt.Sprintf("cliconfig.%s.success", action), ""); err != nil { _log.Warn("unable to create audit event", err) } } diff --git a/pkg/service/user.go b/pkg/service/user.go index adeef98..0be26bb 100644 --- a/pkg/service/user.go +++ b/pkg/service/user.go @@ -943,6 +943,8 @@ func (s *userService) RetrieveCliConfig(ctx context.Context, req *userrpcv3.ApiK } } + CreateApiKeyAuditEvent(ctx, s.al, AuditActionDownload, req.Username) + cliConfig := &common.CliConfigDownloadData{ Profile: s.cc.Profile, RestEndpoint: s.cc.RestEndpoint, @@ -954,7 +956,7 @@ func (s *userService) RetrieveCliConfig(ctx context.Context, req *userrpcv3.ApiK Partner: part.Name, } - DownloadCliConfigAuditEvent(ctx, s.al, AuditActionCreate, req.Username) + DownloadCliConfigAuditEvent(ctx, s.al, AuditActionDownload, req.Username) return cliConfig, nil } From 411bc6049ab22c595cf1dc92cbe3fb92a959b4ad Mon Sep 17 00:00:00 2001 From: vivekhiwarkar Date: Mon, 22 Aug 2022 12:06:13 +0530 Subject: [PATCH 3/4] changes for review comments --- CHANGELOG.md | 5 +++++ pkg/service/audit_utils.go | 3 --- pkg/service/user.go | 3 +-- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5fbbab3..3c9a826 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,9 +3,14 @@ All notable changes to this project will be documented in this file. ## Unreleased + ## Fixed - Fixed init failing with db validation error from [meain](https://github.com/meain) +## Added + +- Adding more audit points for better visibility from [vivekhiwarkar](https://github.com/vivekhiwarkar) + ## [0.1.1] - 2022-08-09 ### Fixed diff --git a/pkg/service/audit_utils.go b/pkg/service/audit_utils.go index c858acb..51556c8 100644 --- a/pkg/service/audit_utils.go +++ b/pkg/service/audit_utils.go @@ -385,9 +385,6 @@ func CreateApiKeyAuditEvent(ctx context.Context, al *zap.Logger, action string, "apikey": id, }, } - if action == AuditActionDownload { - detail.Message = fmt.Sprintf("ApiKey %sed for %s", action, id) - } if err := audit.CreateV1Event(al, sd, detail, fmt.Sprintf("apikey.%s.success", action), ""); err != nil { _log.Warn("unable to create audit event", err) } diff --git a/pkg/service/user.go b/pkg/service/user.go index 0be26bb..0f653dc 100644 --- a/pkg/service/user.go +++ b/pkg/service/user.go @@ -941,10 +941,9 @@ func (s *userService) RetrieveCliConfig(ctx context.Context, req *userrpcv3.ApiK if err != nil { return nil, err } + CreateApiKeyAuditEvent(ctx, s.al, AuditActionCreate, req.Username) } - CreateApiKeyAuditEvent(ctx, s.al, AuditActionDownload, req.Username) - cliConfig := &common.CliConfigDownloadData{ Profile: s.cc.Profile, RestEndpoint: s.cc.RestEndpoint, From ccf9df60dac6dd5262eeacc04d8d02df1dfccccb Mon Sep 17 00:00:00 2001 From: vivekhiwarkar Date: Mon, 22 Aug 2022 12:27:22 +0530 Subject: [PATCH 4/4] Resolving conflict --- CHANGELOG.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3c9a826..5cb2435 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -20,6 +20,7 @@ All notable changes to this project will be documented in this file. ### Added - Initial release -[Unreleased]: https://github.com/paralus/paralus/compare/v0.1.1...HEAD +[Unreleased]: https://github.com/paralus/paralus/compare/v0.1.2...HEAD +[0.1.1]: https://github.com/paralus/paralus/compare/v0.1.1...v0.1.2 [0.1.1]: https://github.com/paralus/paralus/compare/v0.1.0...v0.1.1 [0.1.0]: https://github.com/paralus/paralus/releases/tag/v0.1.0