vendor dependencies

vendor/k8s.io/apiserver/pkg/audit/policy/dynamic.go

@@ -0,0 +1,54 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package policy
+
+import (
+	"k8s.io/api/auditregistration/v1alpha1"
+	"k8s.io/apiserver/pkg/apis/audit"
+	"k8s.io/apiserver/pkg/authorization/authorizer"
+)
+
+// ConvertDynamicPolicyToInternal constructs an internal policy type from a
+// v1alpha1 dynamic type
+func ConvertDynamicPolicyToInternal(p *v1alpha1.Policy) *audit.Policy {
+	stages := make([]audit.Stage, len(p.Stages))
+	for i, stage := range p.Stages {
+		stages[i] = audit.Stage(stage)
+	}
+	return &audit.Policy{
+		Rules: []audit.PolicyRule{
+			{
+				Level: audit.Level(p.Level),
+			},
+		},
+		OmitStages: InvertStages(stages),
+	}
+}
+
+// NewDynamicChecker returns a new dynamic policy checker
+func NewDynamicChecker() Checker {
+	return &dynamicPolicyChecker{}
+}
+
+type dynamicPolicyChecker struct{}
+
+// LevelAndStages returns returns a fixed level of the full event, this is so that the downstream policy
+// can be applied per sink.
+// TODO: this needs benchmarking before the API moves to beta to determine the effect this has on the apiserver
+func (d *dynamicPolicyChecker) LevelAndStages(authorizer.Attributes) (audit.Level, []audit.Stage) {
+	return audit.LevelRequestResponse, []audit.Stage{}
+}

vendor/k8s.io/apiserver/pkg/audit/policy/enforce.go

@@ -0,0 +1,53 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package policy
+
+import (
+	"fmt"
+
+	"k8s.io/apiserver/pkg/apis/audit"
+)
+
+// EnforcePolicy drops any part of the event that doesn't conform to a policy level
+// or omitStages and sets the event level accordingly
+func EnforcePolicy(event *audit.Event, level audit.Level, omitStages []audit.Stage) (*audit.Event, error) {
+	for _, stage := range omitStages {
+		if event.Stage == stage {
+			return nil, nil
+		}
+	}
+	return enforceLevel(event, level)
+}
+
+func enforceLevel(event *audit.Event, level audit.Level) (*audit.Event, error) {
+	switch level {
+	case audit.LevelMetadata:
+		event.Level = audit.LevelMetadata
+		event.ResponseObject = nil
+		event.RequestObject = nil
+	case audit.LevelRequest:
+		event.Level = audit.LevelRequest
+		event.ResponseObject = nil
+	case audit.LevelRequestResponse:
+		event.Level = audit.LevelRequestResponse
+	case audit.LevelNone:
+		return nil, nil
+	default:
+		return nil, fmt.Errorf("level unknown: %s", level)
+	}
+	return event, nil
+}

vendor/k8s.io/apiserver/pkg/audit/policy/reader.go

@@ -22,18 +22,20 @@ import (
 
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	auditinternal "k8s.io/apiserver/pkg/apis/audit"
+	auditv1 "k8s.io/apiserver/pkg/apis/audit/v1"
 	auditv1alpha1 "k8s.io/apiserver/pkg/apis/audit/v1alpha1"
 	auditv1beta1 "k8s.io/apiserver/pkg/apis/audit/v1beta1"
 	"k8s.io/apiserver/pkg/apis/audit/validation"
 	"k8s.io/apiserver/pkg/audit"
 
-	"github.com/golang/glog"
+	"k8s.io/klog"
 )
 
 var (
 	apiGroupVersions = []schema.GroupVersion{
 		auditv1beta1.SchemeGroupVersion,
 		auditv1alpha1.SchemeGroupVersion,
+		auditv1.SchemeGroupVersion,
 	}
 	apiGroupVersionSet = map[schema.GroupVersion]bool{}
 )
@@ -53,17 +55,26 @@ func LoadPolicyFromFile(filePath string) (*auditinternal.Policy, error) {
 		return nil, fmt.Errorf("failed to read file path %q: %+v", filePath, err)
 	}
 
+	ret, err := LoadPolicyFromBytes(policyDef)
+	if err != nil {
+		return nil, fmt.Errorf("%v: from file %v", err.Error(), filePath)
+	}
+
+	return ret, nil
+}
+
+func LoadPolicyFromBytes(policyDef []byte) (*auditinternal.Policy, error) {
 	policy := &auditinternal.Policy{}
 	decoder := audit.Codecs.UniversalDecoder(apiGroupVersions...)
 
 	_, gvk, err := decoder.Decode(policyDef, nil, policy)
 	if err != nil {
-		return nil, fmt.Errorf("failed decoding file %q: %v", filePath, err)
+		return nil, fmt.Errorf("failed decoding: %v", err)
 	}
 
 	// Ensure the policy file contained an apiVersion and kind.
 	if !apiGroupVersionSet[schema.GroupVersion{Group: gvk.Group, Version: gvk.Version}] {
-		return nil, fmt.Errorf("unknown group version field %v in policy file %s", gvk, filePath)
+		return nil, fmt.Errorf("unknown group version field %v in policy", gvk)
 	}
 
 	if err := validation.ValidatePolicy(policy); err != nil {
@@ -72,8 +83,8 @@ func LoadPolicyFromFile(filePath string) (*auditinternal.Policy, error) {
 
 	policyCnt := len(policy.Rules)
 	if policyCnt == 0 {
-		return nil, fmt.Errorf("loaded illegal policy with 0 rules from file %s", filePath)
+		return nil, fmt.Errorf("loaded illegal policy with 0 rules")
 	}
-	glog.V(4).Infof("Loaded %d audit policy rules from file %s", policyCnt, filePath)
+	klog.V(4).Infof("Loaded %d audit policy rules", policyCnt)
 	return policy, nil
 }

vendor/k8s.io/apiserver/pkg/audit/policy/util.go

@@ -0,0 +1,68 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package policy
+
+import (
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apiserver/pkg/apis/audit"
+)
+
+// AllStages returns all possible stages
+func AllStages() sets.String {
+	return sets.NewString(
+		audit.StageRequestReceived,
+		audit.StageResponseStarted,
+		audit.StageResponseComplete,
+		audit.StagePanic,
+	)
+}
+
+// AllLevels returns all possible levels
+func AllLevels() sets.String {
+	return sets.NewString(
+		string(audit.LevelNone),
+		string(audit.LevelMetadata),
+		string(audit.LevelRequest),
+		string(audit.LevelRequestResponse),
+	)
+}
+
+// InvertStages subtracts the given array of stages from all stages
+func InvertStages(stages []audit.Stage) []audit.Stage {
+	s := ConvertStagesToStrings(stages)
+	a := AllStages()
+	a.Delete(s...)
+	return ConvertStringSetToStages(a)
+}
+
+// ConvertStagesToStrings converts an array of stages to a string array
+func ConvertStagesToStrings(stages []audit.Stage) []string {
+	s := make([]string, len(stages))
+	for i, stage := range stages {
+		s[i] = string(stage)
+	}
+	return s
+}
+
+// ConvertStringSetToStages converts a string set to an array of stages
+func ConvertStringSetToStages(set sets.String) []audit.Stage {
+	stages := make([]audit.Stage, len(set))
+	for i, stage := range set.List() {
+		stages[i] = audit.Stage(stage)
+	}
+	return stages
+}