Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add auditd to photon OS #271

Merged
merged 1 commit into from
Jul 9, 2020
Merged

Add auditd to photon OS #271

merged 1 commit into from
Jul 9, 2020

Conversation

EleanorRigby
Copy link
Contributor

@EleanorRigby EleanorRigby commented Jul 2, 2020 •
edited
Loading

Add auditd to Node image for photon OS

  • Add auditd service
  • Enable on boot
  • Recreate log dir once sysprep cleans log dirs
  • Add containerd audit rules
  • Make sure all auditd customizations happen for photon OS only

SYSPREP ROLE

  • Include Photon OS tasks at end.
  • Move machine mode fact out of OS specific sysprep role to set
    at begining of role execution.

@k8s-ci-robot k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Jul 2, 2020
@k8s-ci-robot k8s-ci-robot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Jul 2, 2020
@EleanorRigby
Copy link
Contributor Author

cc: @codenrhoden

@EleanorRigby
Copy link
Contributor Author

Also, I think auditd tasks need to go in node role rather than setup as setup applies to haproxy as well. Making that change

@k8s-ci-robot k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jul 6, 2020
@EleanorRigby EleanorRigby changed the title Add auditd to photon OS WIP : Add auditd to photon OS Jul 6, 2020
@k8s-ci-robot k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 6, 2020
@EleanorRigby EleanorRigby force-pushed the ta-photon-auditd branch 2 times, most recently from bd017c2 to 3f8beda Compare July 7, 2020 01:58
@EleanorRigby EleanorRigby changed the title WIP : Add auditd to photon OS Add auditd to photon OS Jul 7, 2020
@k8s-ci-robot k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 7, 2020
codenrhoden
codenrhoden suggested changes Jul 7, 2020
View reviewed changes
Copy link
Contributor

@codenrhoden codenrhoden left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for working on this @EleanorRigby! I mostly have a few nits for you to consider, but also have a couple of questions.

Also (I can't comment on an empty file), it looks like an empty file is added (images/capi/ansible/roles/setup/handlers/main.yml) and that can be removed from this commit.

images/capi/ansible/roles/node/tasks/photon.yml Outdated Show resolved Hide resolved
images/capi/ansible/roles/node/tasks/photon.yml Outdated Show resolved Hide resolved
images/capi/ansible/roles/node/tasks/photon.yml Show resolved Hide resolved
images/capi/ansible/roles/setup/tasks/photon.yml Outdated Show resolved Hide resolved
images/capi/ansible/roles/sysprep/tasks/main.yml Outdated Show resolved Hide resolved
images/capi/ansible/roles/sysprep/tasks/main.yml Outdated Show resolved Hide resolved
@EleanorRigby EleanorRigby force-pushed the ta-photon-auditd branch 2 times, most recently from 1e8251b to 37013ad Compare July 7, 2020 23:21
@EleanorRigby
Add auditd to Node image for photon OS
4882ebe 
  - Add auditd service
  - Enable on boot
  - Recreate log dir once sysprep cleans log dirs
  - Add containerd audit rules
  - Make sure all auditd customizations happen for photon OS only

  SYSPREP ROLE
  - Include Photon OS tasks at end.
  - Move machine mode fact out of OS specific sysprep role to set
  at begining of role execution.
codenrhoden
codenrhoden approved these changes Jul 9, 2020
View reviewed changes
Copy link
Contributor

@codenrhoden codenrhoden left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
/approve

Thanks @EleanorRigby! I verified that I could build this image, and booted it up and checked out the new audit log and it was full of containerd entries. I think the auditd rules as they are may be more globally applicable beyond Photon (e.g. to AL2 as well) and if we find that to be the case, we'll start dropping them in for other OS's as well.

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 9, 2020
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: codenrhoden, EleanorRigby

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 9, 2020
@k8s-ci-robot k8s-ci-robot merged commit 30ede4f into kubernetes-sigs:master Jul 9, 2020
@EleanorRigby
Copy link
Contributor Author

/lgtm
/approve

Thanks @EleanorRigby! I verified that I could build this image, and booted it up and checked out the new audit log and it was full of containerd entries. I think the auditd rules as they are may be more globally applicable beyond Photon (e.g. to AL2 as well) and if we find that to be the case, we'll start dropping them in for other OS's as well.

Agreed.

@EleanorRigby EleanorRigby mentioned this pull request Jul 10, 2020
Closed
voor added a commit to voor/image-builder that referenced this pull request Jul 15, 2020
@voor
Squashed commit of the following:
9e7ef18 
commit d56a6d9
Merge: 30ede4f 40e8f02
Author: Kubernetes Prow Robot <k8s-ci-robot@users.noreply.github.com>
Date:   Mon Jul 13 20:39:20 2020 -0700

    Merge pull request kubernetes-sigs#286 from EleanorRigby/ta-goss-ova

    Add GOSS provisioner to node OVA builder

commit 40e8f02
Author: Tushar Aggarwal <taggarwal@vmware.com>
Date:   Thu Jul 9 15:54:32 2020 -0700

    Add GOSS provisioner to node OVA builder

      - Runs goss verifier on node OVA
      - Extract out goss args in common config
      - Update GOSS version

commit 30ede4f
Merge: 00377e8 4882ebe
Author: Kubernetes Prow Robot <k8s-ci-robot@users.noreply.github.com>
Date:   Thu Jul 9 15:46:34 2020 -0700

    Merge pull request kubernetes-sigs#271 from EleanorRigby/ta-photon-auditd

    Add auditd to photon OS

commit 4882ebe
Author: Tushar Aggarwal <taggarwal@vmware.com>
Date:   Wed Jul 1 19:18:44 2020 -0700

    Add auditd to Node image for photon OS

      - Add auditd service
      - Enable on boot
      - Recreate log dir once sysprep cleans log dirs
      - Add containerd audit rules
      - Make sure all auditd customizations happen for photon OS only

      SYSPREP ROLE
      - Include Photon OS tasks at end.
      - Move machine mode fact out of OS specific sysprep role to set
      at begining of role execution.

commit 00377e8
Merge: b5b9fd5 e2d88dd
Author: Kubernetes Prow Robot <k8s-ci-robot@users.noreply.github.com>
Date:   Fri Jul 3 04:16:48 2020 -0700

    Merge pull request kubernetes-sigs#273 from justinsb/kops_1_17_0_image

    Legacy images for kops: preload assets

commit e2d88dd
Author: Justin SB <justinsb@google.com>
Date:   Thu Jul 2 15:43:13 2020 -0400

    Legacy images for kops: preload assets

    Create stretch-based images using the legacy image-builder; main
    change is preloading the correct assets.

    We are maintaining the availability of this image-stream as part of
    our deprecation.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@voor voor voor left review comments

@codenrhoden codenrhoden codenrhoden approved these changes

@ncdc ncdc Awaiting requested review from ncdc

@vincepri vincepri Awaiting requested review from vincepri

Assignees

@codenrhoden codenrhoden

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@EleanorRigby @k8s-ci-robot @voor @codenrhoden