Merge pull request #100 from wandera/JSCCE-9848

JSCCE-9848 Add audit policy config
wandera · Dec 15, 2022 · 86a47e6 · 86a47e6
2 parents 0bb243e + 17d6cac
commit 86a47e6
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 3 deletions.
diff --git a/aws/cluster/cluster-spec.tf b/aws/cluster/cluster-spec.tf
@@ -1,4 +1,6 @@
 locals {
+  audit_policy_file_path = "/srv/kubernetes/kube-apiserver/audit-policy-config.yaml"
+
   container_networking_params = {
     amazonvpc  = var.container-networking-params-amazonvpc
     calico     = var.container-networking-params-calico
@@ -64,8 +66,16 @@ locals {
         } : {})
       ]
       externalPolicies = var.external-policies
-      iam              = var.iam
-      keyStore         = "s3://${var.kops-state-bucket}/${var.cluster-name}/pki"
+      fileAssets = var.audit-policy-config == "" ? null : [
+        {
+          name    = "audit-policy-config"
+          path    = local.audit_policy_file_path
+          roles   = ["Master"]
+          content = var.audit-policy-config
+        }
+      ]
+      iam      = var.iam
+      keyStore = "s3://${var.kops-state-bucket}/${var.cluster-name}/pki"
       kubeAPIServer = merge({
         insecureBindAddress          = "127.0.0.1"
         enableAdmissionPlugins       = var.enable-admission-plugins
@@ -86,7 +96,11 @@ locals {
         oidcGroupsClaim   = var.oidc-groups-claim
         oidcIssuerURL     = var.oidc-issuer-url
         oidcUsernameClaim = var.oidc-username-claim
-      })
+        }, var.audit-policy-config == "" ? {} : {
+        auditLogPath    = "-"
+        auditPolicyFile = local.audit_policy_file_path
+        }
+      )
       kubeControllerManager = {
         allocateNodeCIDRs               = true
         attachDetachReconcileSyncPeriod = "1m0s"

diff --git a/aws/cluster/variables.tf b/aws/cluster/variables.tf
@@ -1066,3 +1066,8 @@ variable "containerd-log-level" {
   type    = string
   default = "warn"
 }
+
+variable "audit-policy-config" {
+  type    = string
+  default = ""
+}