github
/
k3s
mirror of https://github.com/k3s-io/k3s
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Remove closing audit log file and add error check when writing to audit

pull/6/head
Maciej Szulik 2016-09-21 15:23:38 +02:00
parent d17c6b903a
commit 5873c2679c
2 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
pkg/apiserver/audit/audit.go
View File

@ -24,6 +24,7 @@ import (
"net/http" "net/http"
"time" "time"
"github.com/golang/glog"
"github.com/pborman/uuid" "github.com/pborman/uuid"
"k8s.io/kubernetes/pkg/apiserver" "k8s.io/kubernetes/pkg/apiserver"
@ -39,7 +40,11 @@ type auditResponseWriter struct {
} }
func (a *auditResponseWriter) WriteHeader(code int) { func (a *auditResponseWriter) WriteHeader(code int) {
fmt.Fprintf(a.out, "%s AUDIT: id=%q response=\"%d\"\n", time.Now().Format(time.RFC3339Nano), a.id, code) line := fmt.Sprintf("%s AUDIT: id=%q response=\"%d\"\n", time.Now().Format(time.RFC3339Nano), a.id, code)
if _, err := fmt.Fprint(a.out, line); err != nil {
glog.Errorf("Unable to write audit log: %s, the error is: %v", line, err)
}
a.ResponseWriter.WriteHeader(code) a.ResponseWriter.WriteHeader(code)
} }
@ -92,8 +97,11 @@ func WithAudit(handler http.Handler, attributeGetter apiserver.RequestAttributeG
} }
id := uuid.NewRandom().String() id := uuid.NewRandom().String()
fmt.Fprintf(out, "%s AUDIT: id=%q ip=%q method=%q user=%q as=%q namespace=%q uri=%q\n", line := fmt.Sprintf("%s AUDIT: id=%q ip=%q method=%q user=%q as=%q namespace=%q uri=%q\n",
time.Now().Format(time.RFC3339Nano), id, utilnet.GetClientIP(req), req.Method, attribs.GetUser().GetName(), asuser, namespace, req.URL) time.Now().Format(time.RFC3339Nano), id, utilnet.GetClientIP(req), req.Method, attribs.GetUser().GetName(), asuser, namespace, req.URL)
if _, err := fmt.Fprint(out, line); err != nil {
glog.Errorf("Unable to write audit log: %s, the error is: %v", line, err)
}
respWriter := decorateResponseWriter(w, out, id) respWriter := decorateResponseWriter(w, out, id)
handler.ServeHTTP(respWriter, req) handler.ServeHTTP(respWriter, req)
}) })

3
pkg/genericapiserver/config.go
View File

@ -377,6 +377,7 @@ func (c Config) New() (*GenericAPIServer, error) {
attributeGetter := apiserver.NewRequestAttributeGetter(c.RequestContextMapper, s.NewRequestInfoResolver()) attributeGetter := apiserver.NewRequestAttributeGetter(c.RequestContextMapper, s.NewRequestInfoResolver())
handler = apiserver.WithAuthorizationCheck(handler, attributeGetter, c.Authorizer) handler = apiserver.WithAuthorizationCheck(handler, attributeGetter, c.Authorizer)
handler = apiserver.WithImpersonation(handler, c.RequestContextMapper, c.Authorizer)
if len(c.AuditLogPath) != 0 { if len(c.AuditLogPath) != 0 {
// audit handler must comes before the impersonationFilter to read the original user // audit handler must comes before the impersonationFilter to read the original user
writer := &lumberjack.Logger{ writer := &lumberjack.Logger{
@ -386,9 +387,7 @@ func (c Config) New() (*GenericAPIServer, error) {
MaxSize: c.AuditLogMaxSize, MaxSize: c.AuditLogMaxSize,
} }
handler = audit.WithAudit(handler, attributeGetter, writer) handler = audit.WithAudit(handler, attributeGetter, writer)
defer writer.Close()
} }
handler = apiserver.WithImpersonation(handler, c.RequestContextMapper, c.Authorizer)
// Install Authenticator // Install Authenticator
if c.Authenticator != nil { if c.Authenticator != nil {