Skip to content

Commit 7e2d039

Browse files
anish-mudaraddianish-mudaraddi
committed
add users and roles for logging
add opensearch config for setting up roles and users for writing and reading logs add separate tenants for each environment so that we can setup separate RBAC policies
1 parent af814ab commit 7e2d039

File tree

2 files changed

+180
-29
lines changed

2 files changed

+180
-29
lines changed

‎clusters/dev/worker/opensearch-values.yaml‎

Lines changed: 168 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -22,31 +22,172 @@ ingress:
2222
hosts:
2323
- nodes.dev.nubes.stfc.ac.uk
2424

25+
# This is a Opensearch cluster that collects logs from all clusters
26+
# and stores in different tenants
2527
users:
26-
# for ingesting k8s container logs
27-
- name: fluentbit
28-
passwordFrom:
29-
name: fluentbit-credentials-secret
30-
key: password
31-
backendRoles:
32-
- kibana_user
33-
34-
roles:
35-
# for ingesting k8s container logs
36-
- name: fluentbit
37-
clusterPermissions:
38-
- cluster_composite_ops
39-
- cluster_monitor
40-
indexPermissions:
41-
- indexPatterns:
42-
- audit-*
43-
- container-*
44-
- access-*
45-
allowedActions:
46-
- create_index
47-
- index
48-
- write
49-
50-
roleMappings:
51-
- roleName: fluentbit
52-
user: fluentbit
28+
log_writer_dev:
29+
reserved: false
30+
backend_roles:
31+
- k8s_log_writer_dev
32+
description: "user for writing dev k8s logs"
33+
34+
log_writer_staging:
35+
reserved: false
36+
backend_roles:
37+
- k8s_log_writer_staging
38+
description: "user for writing staging k8s logs"
39+
40+
log_writer_prod:
41+
reserved: false
42+
backend_roles:
43+
- k8s_log_writer_prod
44+
description: "user for writing prod k8s logs"
45+
46+
tenants:
47+
cloud_dev:
48+
reserved: true
49+
description: "logs from dev k8s clusters"
50+
cloud:
51+
reserved: true
52+
description: "logs for prod/staging k8s clusters"
53+
54+
roles:
55+
write_only_dev:
56+
reserved: false
57+
cluster_permissions: []
58+
index_permissions:
59+
- index_patterns:
60+
- "k8s_logs_dev_*_cluster*"
61+
- "trivy_logs_dev_*_cluster*"
62+
allowed_actions:
63+
- "indices:data/write/bulk"
64+
- "indices:data/write/index"
65+
- "indices:data/write/update"
66+
- "indices:admin/create"
67+
tenant_permissions:
68+
tenant_patterns:
69+
- cloud_dev
70+
71+
read_only_dev:
72+
reserved: false
73+
cluster_permissions: []
74+
index_permissions:
75+
- index_patterns:
76+
- "k8s_logs_dev_*_cluster*"
77+
- "trivy_logs_dev_*_cluster*"
78+
allowed_actions:
79+
- "indices:data/write/*",
80+
- "indices:data/read/*",
81+
- "indices:admin/*"
82+
tenant_permissions:
83+
tenant_patterns:
84+
- cloud_dev
85+
allowed_actions:
86+
# so to allow creating dashboards
87+
- kibana_all_write
88+
89+
write_only_staging:
90+
reserved: false
91+
cluster_permissions: []
92+
index_permissions:
93+
- index_patterns:
94+
- "k8s_logs_staging_*_cluster*"
95+
- "trivy_logs_staging_*_cluster*"
96+
allowed_actions:
97+
- "indices:data/write/bulk"
98+
- "indices:data/write/index"
99+
- "indices:data/write/update"
100+
- "indices:admin/create"
101+
tenant_permissions:
102+
tenant_patterns:
103+
- cloud
104+
105+
read_only_staging:
106+
reserved: false
107+
cluster_permissions: []
108+
index_permissions:
109+
- index_patterns:
110+
- "k8s_logs_staging_*_cluster*"
111+
- "trivy_logs_staging_*_cluster*"
112+
allowed_actions:
113+
- "indices:data/write/*"
114+
- "indices:data/read/*"
115+
- "indices:admin/*"
116+
tenant_permissions:
117+
tenant_patterns:
118+
- cloud
119+
allowed_actions:
120+
# so to allow creating dashboards
121+
- kibana_all_write
122+
123+
write_only_prod:
124+
reserved: false
125+
cluster_permissions: []
126+
index_permissions:
127+
- index_patterns:
128+
- "k8s_logs_prod_*_cluster*"
129+
- "trivy_logs_prod_*_cluster*"
130+
allowed_actions:
131+
- "indices:data/write/bulk"
132+
- "indices:data/write/index"
133+
- "indices:data/write/update"
134+
- "indices:admin/create"
135+
tenant_permissions:
136+
tenant_patterns:
137+
- cloud
138+
139+
read_only_prod:
140+
reserved: false
141+
cluster_permissions: []
142+
index_permissions:
143+
- index_patterns:
144+
- "k8s_logs_prod_*_cluster*"
145+
- "trivy_logs_prod_*_cluster*"
146+
allowed_actions:
147+
- "indices:data/write/*"
148+
- "indices:data/read/*"
149+
- "indices:admin/*"
150+
tenant_permissions:
151+
tenant_patterns:
152+
- cloud
153+
allowed_actions:
154+
# so to allow creating dashboards
155+
- kibana_all_write
156+
157+
rolesMapping:
158+
k8s_log_writer_dev:
159+
backend_roles:
160+
- write_only_dev
161+
user:
162+
- log_writer_dev
163+
description: "map dev log writer role"
164+
k8s_log_writer_staging:
165+
backend_roles:
166+
- write_only_staging
167+
user:
168+
- log_writer_staging
169+
description: "map staging log writer role"
170+
k8s_log_writer_prod:
171+
backend_roles:
172+
- write_only_prod
173+
user:
174+
- log_writer_prod
175+
description: "map prod log writer role"
176+
177+
k8s_dev:
178+
backend_roles:
179+
- read_only_dev
180+
- stfc-cloud-dev
181+
user:
182+
- log_writer_dev
183+
description: "map dev users to dev read role"
184+
k8s_prod:
185+
backend_roles:
186+
- read_only_staging
187+
- read_only_prod
188+
- read_only_dev
189+
- stfc-cloud/team
190+
user:
191+
- log_writer_dev
192+
description: "map cloud team users to all read roles"
193+

‎secrets/dev/worker/opensearch.yaml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,16 @@ admin:
1010
openid:
1111
clientID: ENC[AES256_GCM,data:uMvsOIjTttBfy/BKplxEGhmuNLhKddQH1MlBicQ+UbStPiko,iv:H8+om/9YGfh2vxf8Xh+E90tNLyrKTpXPQjybgt62Ou0=,tag:eqjGOGyi/va5Bs1vDSQQ/g==,type:str]
1212
clientSecret: ENC[AES256_GCM,data:3qhDQuypewAKxtR5p488hv5Q/+4qIBFvvEAZZSOEyS4icCEaZSd2Viwr7oWdts95R9cqLM7ruoQlI5s+XzNbQiG9BUkc0mjEOuuR92CRCa6GIuaXwvg=,iv:5UJuqz2JkJAqtYRglzrC3U8eZzkSv3nT0WMhhg+yN5c=,tag:alMz/tPl1d7RAQZCeIyLFg==,type:str]
13+
users:
14+
log_writer_dev:
15+
#ENC[AES256_GCM,data:T6AsRPPxir0nRfAnbSmvbyKq8gTD,iv:LebgnKjMwmMMXIhySW6y3HPc+z6gS83PyTRM0Uhk2sk=,tag:+W4JcdR6mzfOtR294moj8Q==,type:comment]
16+
hash: ENC[AES256_GCM,data:ENyIoA43q6y7zl1WUH57tET2tHRbYGSyV7FMrqB9lQEEu9+vxL6Q05DyHB77b/slfXX+5ohD5FkXcKIz,iv:Ano1xzAD9OMKW8Qhku+OFpuSlkyLDoeXsNUwew9f0mQ=,tag:G2BhBAQwO2WG7tVGrvRyFQ==,type:str]
17+
log_writer_staging:
18+
#ENC[AES256_GCM,data:72O6y7b7FxqbFeFlqwbsQYoY8DHG,iv:tjdHjDBrUOPlHrMfTslEl3OjKoGNMmZwbv0a7dwqPUk=,tag:9k6iGparJF6R+0+7P6KIsw==,type:comment]
19+
hash: ENC[AES256_GCM,data:dWKTVf85bk9vf5Jt5ivY2jqFt+pigoyiMqPBC6GMC5Kms4UYud5+SooCAg0tTvZzGmoA7KM6rdFt7bP9,iv:EOkAB0JwdTq8BDYm6gK8fqHC49u6tIt4QOZ+5Wm/BWU=,tag:iO3kN09kM6yolYrnZqN8QA==,type:str]
20+
log_writer_prod:
21+
#ENC[AES256_GCM,data:XMEEo0SuFnKVacAk6RAigNdPfjql,iv:TtiYab4aBJ2hYCZ+RLWdY0mGpsSWtxRu3kF3cM0PV20=,tag:Wgr8IPaWMF3NDreMOArwIw==,type:comment]
22+
hash: ENC[AES256_GCM,data:u8NB+pXqYec50UOnWomUfT87/TGWLLZ+W1YBGVXEl1UuUardj8Vw3J+wW6iHf+1dyMRWCoAkl3taTkEC,iv:9fMWXnPrpzeO7NQGcLk2kZNLJ2YMOEVqO4igWufRXxo=,tag:kzNFzH98kZVi9Qmr16dyjw==,type:str]
1323
sops:
1424
kms: []
1525
gcp_kms: []
@@ -61,8 +71,8 @@ sops:
6171
UG9MN0lCWElaUVNLQ0pJTEJKMHVFa2cKgetiuhLepPcjva1pR2hEQLrwc67ygux+
6272
jqHXJ+BVReG0Sq7HZoCDv6iMQM5DrL0DwmGAZy+5S83zQeTUE1kwaA==
6373
-----END AGE ENCRYPTED FILE-----
64-
lastmodified: "2024-10-15T21:13:56Z"
65-
mac: ENC[AES256_GCM,data:Im6TOCdWj6XBgC9HO/nHbfdg68dRmYwIz+FQw5hmBmsTjQPFl/zNNiBcS/UbwpxuOoIMfrsdhKa0A/DaU+0D+HucFGD7QMGcflTguN/k+gTxBI/BQIQEfAlSJUzhwFbJUJ075KcrmgKQOX9a8GmRyv44uhZwm4be8NYUIapEhnQ=,iv:N2ABX3eovw/Swc8mmppaNC6h8oHH1KKxuLFN16ol66g=,tag:8YhncBZ2MZLELl8uvpb6MQ==,type:str]
74+
lastmodified: "2024-10-16T12:58:59Z"
75+
mac: ENC[AES256_GCM,data:4X0GJQxFFFVLDYaB5rQeJYJc04bOlzSN8cimFKDLsei058bM3+hRWYUuSnYRB4iaVR0UlOdVaZS/nKCbcW7VUMP0bTBcVbYg6hLQ9jUO4ugOTAOsWixkviSTrYyG79Aa8fzZ3LzqzzULk+0IUwzOddvawejBlhjIVCWaBfOZbVo=,iv:XCieT5ci3H4KiLpEQYmCCg1JttpAMDhkD/nQ/kV9Zsc=,tag:kj54RUuqRNHFczYGS2U37g==,type:str]
6676
pgp: []
6777
unencrypted_regex: ^(apiVersion|metadata|kind|type)$
6878
version: 3.8.1

0 commit comments

Comments
 (0)