Auditlog Forwarder

A Kubernetes audit log forwarder that receives audit events from Kubernetes API servers via webhook, enriches them with metadata annotations, and forwards them to configured outputs. This project is part of the Gardener ecosystem for managing Kubernetes clusters.

Overview

The auditlog-forwarder acts as a webhook endpoint that:

1. Receives Kubernetes audit events from API servers
2. Processes events through configurable processors (annotation injection, filtering, etc.)
3. Forwards enriched events to multiple outputs (HTTP endpoints, OTLP, etc.)

Key Features

• Webhook Integration: Seamless integration with Kubernetes audit webhook functionality
• Annotation Injection: Enrich audit events with custom metadata for better observability
• Multiple Backends: Forward to multiple destinations simultaneously (work in progress)
• TLS Security: Mutual TLS support for secure communication
• Configurable Processing: Pluggable processor architecture for extensible event handling

Architecture

┌─────────────────┐     HTTP POST       ┌──────────────────────┐     Forward      ┌─────────────────┐
│ Kubernetes API  │────────────────────▶│  auditlog-forwarder  │─────────────────▶│    Backend 1    │
│    Server       │    /audit endpoint  │                      │                  │     (HTTPS)     │
└─────────────────┘                     │  - Receive events    │                  └─────────────────┘
                                        │  - Process & enrich  │
                                        │  - Forward to all    │     Forward      ┌─────────────────┐
                                        │    outputs           │─────────────────▶│    Backend N    │
                                        │                      │                  │     (HTTPS)     │
                                        └──────────────────────┘                  └─────────────────┘

Development

Quick Start

For developers looking to get started quickly, please refer to the Getting Started Locally guide. This guide provides step-by-step instructions for setting up and running the project locally with a complete KinD-based development environment.

Testing

# Run all tests
make test

# Verify code conventions
make check

Code Generation

# Generate deepcopy and default functions
make generate

Contributing

Please see CONTRIBUTING.md for guidelines on how to contribute to this project.