vendor dependencies

vendor/k8s.io/apiserver/pkg/audit/OWNERS

@@ -0,0 +1,9 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+approvers:
+- sig-auth-audit-approvers
+reviewers:
+- sig-auth-audit-reviewers
+labels:
+- sig/auth
+

vendor/k8s.io/apiserver/pkg/audit/event/attributes.go

@@ -0,0 +1,147 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package event
+
+import (
+	"fmt"
+	"net/url"
+
+	"k8s.io/apiserver/pkg/apis/audit"
+	authuser "k8s.io/apiserver/pkg/authentication/user"
+	"k8s.io/apiserver/pkg/authorization/authorizer"
+)
+
+var _ authorizer.Attributes = &attributes{}
+
+// attributes implements the authorizer attributes interface
+// with event data. This is used for enforced audit backends
+type attributes struct {
+	event *audit.Event
+	path  string
+}
+
+// NewAttributes returns a new attributes struct and parsed request uri
+// if needed
+func NewAttributes(event *audit.Event) (authorizer.Attributes, error) {
+	a := attributes{
+		event: event,
+	}
+	if event.ObjectRef == nil {
+		u, err := url.ParseRequestURI(a.event.RequestURI)
+		if err != nil {
+			return nil, fmt.Errorf("could not parse url: %v", err)
+		}
+		a.path = u.Path
+	}
+	return &a, nil
+}
+
+// GetUser returns the user. This is only used for checking audit policy,
+// and the audit policy user check is based off the original user,
+// not the impersonated user.
+func (a *attributes) GetUser() authuser.Info {
+	return user(a.event.User)
+}
+
+// GetVerb returns the verb
+func (a *attributes) GetVerb() string {
+	return a.event.Verb
+}
+
+// IsReadOnly determines if the verb is a read only action
+func (a *attributes) IsReadOnly() bool {
+	return a.event.Verb == "get" || a.event.Verb == "list" || a.event.Verb == "watch"
+}
+
+// GetNamespace returns the object namespace if present
+func (a *attributes) GetNamespace() string {
+	if a.event.ObjectRef == nil {
+		return ""
+	}
+	return a.event.ObjectRef.Namespace
+}
+
+// GetResource returns the object resource if present
+func (a *attributes) GetResource() string {
+	if a.event.ObjectRef == nil {
+		return ""
+	}
+	return a.event.ObjectRef.Resource
+}
+
+// GetSubresource returns the object subresource if present
+func (a *attributes) GetSubresource() string {
+	if a.event.ObjectRef == nil {
+		return ""
+	}
+	return a.event.ObjectRef.Subresource
+}
+
+// GetName returns the object name if present
+func (a *attributes) GetName() string {
+	if a.event.ObjectRef == nil {
+		return ""
+	}
+	return a.event.ObjectRef.Name
+}
+
+// GetAPIGroup returns the object api group if present
+func (a *attributes) GetAPIGroup() string {
+	if a.event.ObjectRef == nil {
+		return ""
+	}
+	return a.event.ObjectRef.APIGroup
+}
+
+// GetAPIVersion returns the object api version if present
+func (a *attributes) GetAPIVersion() string {
+	if a.event.ObjectRef == nil {
+		return ""
+	}
+	return a.event.ObjectRef.APIVersion
+}
+
+// IsResourceRequest determines if the request was acted on a resource
+func (a *attributes) IsResourceRequest() bool {
+	return a.event.ObjectRef != nil
+}
+
+// GetPath returns the path uri accessed
+func (a *attributes) GetPath() string {
+	return a.path
+}
+
+// user represents the event user
+type user audit.UserInfo
+
+// GetName returns the user name
+func (u user) GetName() string { return u.Username }
+
+// GetUID returns the user uid
+func (u user) GetUID() string { return u.UID }
+
+// GetGroups returns the user groups
+func (u user) GetGroups() []string { return u.Groups }
+
+// GetExtra returns the user extra data
+func (u user) GetExtra() map[string][]string {
+	m := map[string][]string{}
+	for k, v := range u.Extra {
+		m[k] = []string(v)
+	}
+	return m
+}

vendor/k8s.io/apiserver/pkg/audit/metrics.go

@@ -19,9 +19,9 @@ package audit
 import (
 	"fmt"
 
-	"github.com/golang/glog"
 	"github.com/prometheus/client_golang/prometheus"
 	auditinternal "k8s.io/apiserver/pkg/apis/audit"
+	"k8s.io/klog"
 )
 
 const (
@@ -52,12 +52,22 @@ var (
 		},
 		[]string{"level"},
 	)
+
+	ApiserverAuditDroppedCounter = prometheus.NewCounter(
+		prometheus.CounterOpts{
+			Subsystem: subsystem,
+			Name:      "requests_rejected_total",
+			Help: "Counter of apiserver requests rejected due to an error " +
+				"in audit logging backend.",
+		},
+	)
 )
 
 func init() {
 	prometheus.MustRegister(eventCounter)
 	prometheus.MustRegister(errorCounter)
 	prometheus.MustRegister(levelCounter)
+	prometheus.MustRegister(ApiserverAuditDroppedCounter)
 }
 
 // ObserveEvent updates the relevant prometheus metrics for the generated audit event.
@@ -83,5 +93,5 @@ func HandlePluginError(plugin string, err error, impacted ...*auditinternal.Even
 	for _, ev := range impacted {
 		msg = msg + EventString(ev) + "\n"
 	}
-	glog.Error(msg)
+	klog.Error(msg)
 }

vendor/k8s.io/apiserver/pkg/audit/policy/dynamic.go

@@ -0,0 +1,54 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package policy
+
+import (
+	"k8s.io/api/auditregistration/v1alpha1"
+	"k8s.io/apiserver/pkg/apis/audit"
+	"k8s.io/apiserver/pkg/authorization/authorizer"
+)
+
+// ConvertDynamicPolicyToInternal constructs an internal policy type from a
+// v1alpha1 dynamic type
+func ConvertDynamicPolicyToInternal(p *v1alpha1.Policy) *audit.Policy {
+	stages := make([]audit.Stage, len(p.Stages))
+	for i, stage := range p.Stages {
+		stages[i] = audit.Stage(stage)
+	}
+	return &audit.Policy{
+		Rules: []audit.PolicyRule{
+			{
+				Level: audit.Level(p.Level),
+			},
+		},
+		OmitStages: InvertStages(stages),
+	}
+}
+
+// NewDynamicChecker returns a new dynamic policy checker
+func NewDynamicChecker() Checker {
+	return &dynamicPolicyChecker{}
+}
+
+type dynamicPolicyChecker struct{}
+
+// LevelAndStages returns returns a fixed level of the full event, this is so that the downstream policy
+// can be applied per sink.
+// TODO: this needs benchmarking before the API moves to beta to determine the effect this has on the apiserver
+func (d *dynamicPolicyChecker) LevelAndStages(authorizer.Attributes) (audit.Level, []audit.Stage) {
+	return audit.LevelRequestResponse, []audit.Stage{}
+}

vendor/k8s.io/apiserver/pkg/audit/policy/enforce.go

@@ -0,0 +1,53 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package policy
+
+import (
+	"fmt"
+
+	"k8s.io/apiserver/pkg/apis/audit"
+)
+
+// EnforcePolicy drops any part of the event that doesn't conform to a policy level
+// or omitStages and sets the event level accordingly
+func EnforcePolicy(event *audit.Event, level audit.Level, omitStages []audit.Stage) (*audit.Event, error) {
+	for _, stage := range omitStages {
+		if event.Stage == stage {
+			return nil, nil
+		}
+	}
+	return enforceLevel(event, level)
+}
+
+func enforceLevel(event *audit.Event, level audit.Level) (*audit.Event, error) {
+	switch level {
+	case audit.LevelMetadata:
+		event.Level = audit.LevelMetadata
+		event.ResponseObject = nil
+		event.RequestObject = nil
+	case audit.LevelRequest:
+		event.Level = audit.LevelRequest
+		event.ResponseObject = nil
+	case audit.LevelRequestResponse:
+		event.Level = audit.LevelRequestResponse
+	case audit.LevelNone:
+		return nil, nil
+	default:
+		return nil, fmt.Errorf("level unknown: %s", level)
+	}
+	return event, nil
+}

vendor/k8s.io/apiserver/pkg/audit/policy/reader.go

@@ -22,18 +22,20 @@ import (
 
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	auditinternal "k8s.io/apiserver/pkg/apis/audit"
+	auditv1 "k8s.io/apiserver/pkg/apis/audit/v1"
 	auditv1alpha1 "k8s.io/apiserver/pkg/apis/audit/v1alpha1"
 	auditv1beta1 "k8s.io/apiserver/pkg/apis/audit/v1beta1"
 	"k8s.io/apiserver/pkg/apis/audit/validation"
 	"k8s.io/apiserver/pkg/audit"
 
-	"github.com/golang/glog"
+	"k8s.io/klog"
 )
 
 var (
 	apiGroupVersions = []schema.GroupVersion{
 		auditv1beta1.SchemeGroupVersion,
 		auditv1alpha1.SchemeGroupVersion,
+		auditv1.SchemeGroupVersion,
 	}
 	apiGroupVersionSet = map[schema.GroupVersion]bool{}
 )
@@ -53,17 +55,26 @@ func LoadPolicyFromFile(filePath string) (*auditinternal.Policy, error) {
 		return nil, fmt.Errorf("failed to read file path %q: %+v", filePath, err)
 	}
 
+	ret, err := LoadPolicyFromBytes(policyDef)
+	if err != nil {
+		return nil, fmt.Errorf("%v: from file %v", err.Error(), filePath)
+	}
+
+	return ret, nil
+}
+
+func LoadPolicyFromBytes(policyDef []byte) (*auditinternal.Policy, error) {
 	policy := &auditinternal.Policy{}
 	decoder := audit.Codecs.UniversalDecoder(apiGroupVersions...)
 
 	_, gvk, err := decoder.Decode(policyDef, nil, policy)
 	if err != nil {
-		return nil, fmt.Errorf("failed decoding file %q: %v", filePath, err)
+		return nil, fmt.Errorf("failed decoding: %v", err)
 	}
 
 	// Ensure the policy file contained an apiVersion and kind.
 	if !apiGroupVersionSet[schema.GroupVersion{Group: gvk.Group, Version: gvk.Version}] {
-		return nil, fmt.Errorf("unknown group version field %v in policy file %s", gvk, filePath)
+		return nil, fmt.Errorf("unknown group version field %v in policy", gvk)
 	}
 
 	if err := validation.ValidatePolicy(policy); err != nil {
@@ -72,8 +83,8 @@ func LoadPolicyFromFile(filePath string) (*auditinternal.Policy, error) {
 
 	policyCnt := len(policy.Rules)
 	if policyCnt == 0 {
-		return nil, fmt.Errorf("loaded illegal policy with 0 rules from file %s", filePath)
+		return nil, fmt.Errorf("loaded illegal policy with 0 rules")
 	}
-	glog.V(4).Infof("Loaded %d audit policy rules from file %s", policyCnt, filePath)
+	klog.V(4).Infof("Loaded %d audit policy rules", policyCnt)
 	return policy, nil
 }

vendor/k8s.io/apiserver/pkg/audit/policy/util.go

@@ -0,0 +1,68 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package policy
+
+import (
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apiserver/pkg/apis/audit"
+)
+
+// AllStages returns all possible stages
+func AllStages() sets.String {
+	return sets.NewString(
+		audit.StageRequestReceived,
+		audit.StageResponseStarted,
+		audit.StageResponseComplete,
+		audit.StagePanic,
+	)
+}
+
+// AllLevels returns all possible levels
+func AllLevels() sets.String {
+	return sets.NewString(
+		string(audit.LevelNone),
+		string(audit.LevelMetadata),
+		string(audit.LevelRequest),
+		string(audit.LevelRequestResponse),
+	)
+}
+
+// InvertStages subtracts the given array of stages from all stages
+func InvertStages(stages []audit.Stage) []audit.Stage {
+	s := ConvertStagesToStrings(stages)
+	a := AllStages()
+	a.Delete(s...)
+	return ConvertStringSetToStages(a)
+}
+
+// ConvertStagesToStrings converts an array of stages to a string array
+func ConvertStagesToStrings(stages []audit.Stage) []string {
+	s := make([]string, len(stages))
+	for i, stage := range stages {
+		s[i] = string(stage)
+	}
+	return s
+}
+
+// ConvertStringSetToStages converts a string set to an array of stages
+func ConvertStringSetToStages(set sets.String) []audit.Stage {
+	stages := make([]audit.Stage, len(set))
+	for i, stage := range set.List() {
+		stages[i] = audit.Stage(stage)
+	}
+	return stages
+}

vendor/k8s.io/apiserver/pkg/audit/request.go

@@ -20,13 +20,13 @@ import (
 	"bytes"
 	"fmt"
 	"net/http"
+	"reflect"
 	"time"
 
-	"github.com/golang/glog"
 	"github.com/pborman/uuid"
+	"k8s.io/klog"
 
-	"reflect"
-
+	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
@@ -37,15 +37,20 @@ import (
 	"k8s.io/apiserver/pkg/authorization/authorizer"
 )
 
+const (
+	maxUserAgentLength      = 1024
+	userAgentTruncateSuffix = "...TRUNCATED"
+)
+
 func NewEventFromRequest(req *http.Request, level auditinternal.Level, attribs authorizer.Attributes) (*auditinternal.Event, error) {
 	ev := &auditinternal.Event{
 		RequestReceivedTimestamp: metav1.NewMicroTime(time.Now()),
-		Verb:       attribs.GetVerb(),
-		RequestURI: req.URL.RequestURI(),
+		Verb:                     attribs.GetVerb(),
+		RequestURI:               req.URL.RequestURI(),
+		UserAgent:                maybeTruncateUserAgent(req),
+		Level:                    level,
 	}
 
-	ev.Level = level
-
 	// prefer the id from the headers. If not available, create a new one.
 	// TODO(audit): do we want to forbid the header for non-front-proxy users?
 	ids := req.Header.Get(auditinternal.HeaderAuditID)
@@ -112,8 +117,9 @@ func LogRequestObject(ae *auditinternal.Event, obj runtime.Object, gvr schema.Gr
 	if ae.ObjectRef == nil {
 		ae.ObjectRef = &auditinternal.ObjectReference{}
 	}
-	if acc, ok := obj.(metav1.ObjectMetaAccessor); ok {
-		meta := acc.GetObjectMeta()
+
+	// meta.Accessor is more general than ObjectMetaAccessor, but if it fails, we can just skip setting these bits
+	if meta, err := meta.Accessor(obj); err == nil {
 		if len(ae.ObjectRef.Namespace) == 0 {
 			ae.ObjectRef.Namespace = meta.GetNamespace()
 		}
@@ -147,7 +153,7 @@ func LogRequestObject(ae *auditinternal.Event, obj runtime.Object, gvr schema.Gr
 	ae.RequestObject, err = encodeObject(obj, gvr.GroupVersion(), s)
 	if err != nil {
 		// TODO(audit): add error slice to audit event struct
-		glog.Warningf("Auditing failed of %v request: %v", reflect.TypeOf(obj).Name(), err)
+		klog.Warningf("Auditing failed of %v request: %v", reflect.TypeOf(obj).Name(), err)
 		return
 	}
 }
@@ -186,7 +192,7 @@ func LogResponseObject(ae *auditinternal.Event, obj runtime.Object, gv schema.Gr
 	var err error
 	ae.ResponseObject, err = encodeObject(obj, gv, s)
 	if err != nil {
-		glog.Warningf("Audit failed for %q response: %v", reflect.TypeOf(obj).Name(), err)
+		klog.Warningf("Audit failed for %q response: %v", reflect.TypeOf(obj).Name(), err)
 	}
 }
 
@@ -218,7 +224,7 @@ func LogAnnotation(ae *auditinternal.Event, key, value string) {
 		ae.Annotations = make(map[string]string)
 	}
 	if v, ok := ae.Annotations[key]; ok && v != value {
-		glog.Warningf("Failed to set annotations[%q] to %q for audit:%q, it has already been set to %q", key, value, ae.AuditID, ae.Annotations[key])
+		klog.Warningf("Failed to set annotations[%q] to %q for audit:%q, it has already been set to %q", key, value, ae.AuditID, ae.Annotations[key])
 		return
 	}
 	ae.Annotations[key] = value
@@ -233,3 +239,13 @@ func LogAnnotations(ae *auditinternal.Event, annotations map[string]string) {
 		LogAnnotation(ae, key, value)
 	}
 }
+
+// truncate User-Agent if too long, otherwise return it directly.
+func maybeTruncateUserAgent(req *http.Request) string {
+	ua := req.UserAgent()
+	if len(ua) > maxUserAgentLength {
+		ua = ua[:maxUserAgentLength] + userAgentTruncateSuffix
+	}
+
+	return ua
+}

vendor/k8s.io/apiserver/pkg/audit/scheme.go

@@ -18,10 +18,13 @@ limitations under the License.
 package audit
 
 import (
-	"k8s.io/apimachinery/pkg/apis/meta/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/runtime/serializer"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	auditinternal "k8s.io/apiserver/pkg/apis/audit"
+	"k8s.io/apiserver/pkg/apis/audit/v1"
 	"k8s.io/apiserver/pkg/apis/audit/v1alpha1"
 	"k8s.io/apiserver/pkg/apis/audit/v1beta1"
 )
@@ -30,7 +33,10 @@ var Scheme = runtime.NewScheme()
 var Codecs = serializer.NewCodecFactory(Scheme)
 
 func init() {
-	v1.AddToGroupVersion(Scheme, schema.GroupVersion{Version: "v1"})
-	v1alpha1.AddToScheme(Scheme)
-	v1beta1.AddToScheme(Scheme)
+	metav1.AddToGroupVersion(Scheme, schema.GroupVersion{Version: "v1"})
+	utilruntime.Must(v1.AddToScheme(Scheme))
+	utilruntime.Must(v1alpha1.AddToScheme(Scheme))
+	utilruntime.Must(v1beta1.AddToScheme(Scheme))
+	utilruntime.Must(auditinternal.AddToScheme(Scheme))
+	utilruntime.Must(Scheme.SetVersionPriority(v1.SchemeGroupVersion, v1beta1.SchemeGroupVersion, v1alpha1.SchemeGroupVersion))
 }

vendor/k8s.io/apiserver/pkg/audit/types.go

@@ -25,7 +25,8 @@ type Sink interface {
 	// Errors might be logged by the sink itself. If an error should be fatal, leading to an internal
 	// error, ProcessEvents is supposed to panic. The event must not be mutated and is reused by the caller
 	// after the call returns, i.e. the sink has to make a deepcopy to keep a copy around if necessary.
-	ProcessEvents(events ...*auditinternal.Event)
+	// Returns true on success, may return false on error.
+	ProcessEvents(events ...*auditinternal.Event) bool
 }
 
 type Backend interface {
@@ -39,4 +40,7 @@ type Backend interface {
 	// events are delivered. It can be assumed that this method is called after
 	// the stopCh channel passed to the Run method has been closed.
 	Shutdown()
+
+	// Returns the backend PluginName.
+	String() string
 }

vendor/k8s.io/apiserver/pkg/audit/union.go

@@ -37,10 +37,12 @@ type union struct {
 	backends []Backend
 }
 
-func (u union) ProcessEvents(events ...*auditinternal.Event) {
+func (u union) ProcessEvents(events ...*auditinternal.Event) bool {
+	success := true
 	for _, backend := range u.backends {
-		backend.ProcessEvents(events...)
+		success = backend.ProcessEvents(events...) && success
 	}
+	return success
 }
 
 func (u union) Run(stopCh <-chan struct{}) error {

vendor/k8s.io/apiserver/pkg/audit/util/conversion.go

@@ -0,0 +1,43 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package util
+
+import (
+	"k8s.io/api/auditregistration/v1alpha1"
+	"k8s.io/apiserver/pkg/util/webhook"
+)
+
+// HookClientConfigForSink constructs a webhook.ClientConfig using a v1alpha1.AuditSink API object.
+// webhook.ClientConfig is used to create a HookClient and the purpose of the config struct is to
+// share that with other packages that need to create a HookClient.
+func HookClientConfigForSink(a *v1alpha1.AuditSink) webhook.ClientConfig {
+	c := a.Spec.Webhook.ClientConfig
+	ret := webhook.ClientConfig{Name: a.Name, CABundle: c.CABundle}
+	if c.URL != nil {
+		ret.URL = *c.URL
+	}
+	if c.Service != nil {
+		ret.Service = &webhook.ClientConfigService{
+			Name:      c.Service.Name,
+			Namespace: c.Service.Namespace,
+		}
+		if c.Service.Path != nil {
+			ret.Service.Path = *c.Service.Path
+		}
+	}
+	return ret
+}