Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Follow Up] Audit Logging support K8s Networkpolicy #4099

Merged
merged 1 commit into from
Aug 15, 2022
Merged

[Follow Up] Audit Logging support K8s Networkpolicy #4099

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 2 additions & 5 deletions docs/antrea-network-policy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -644,8 +644,8 @@ which the rule is applied. These log files can then be retrieved for further
analysis. By default, rules are not logged. The example policy logs all
traffic that matches the "DropToThirdParty" egress rule, while the rule
"AllowFromFrontend" is not logged. Specifically for drop and reject rules,
deduplication is applied to simplify multiple logs. Duplication buffer length is set as 1 second.
The rules are logged in the following format:
deduplication is applied to reduce duplicated logs, and duplication buffer
length is set to 1 second. The rules are logged in the following format:

```text
<yyyy/mm/dd> <time> <ovs-table-name> <antrea-native-policy-reference> <action> <openflow-priority> <source-ip> <source-port> <destination-ip> <destination-port> <protocol> <packet-length>
Expand All @@ -664,9 +664,6 @@ for all NetworkPolicies in the Namespace. Packets of any connection that match
a NetworkPolicy rule will be logged with a reference to the NetworkPolicy name,
but packets dropped by the implicit "default drop" (not allowed by any NetworkPolicy)
will only be logged with consistent name `K8sNetworkPolicy` for reference.
Note that currently, Antrea only retrieves the logging Annotation once when adding
NetworkPolicies and in case of agent restart, users should not update Namespace
logging Annotations, otherwise it would risk NetworkPolicies working in a stale state.
The rules are logged in the following format:

```text
Expand Down
6 changes: 3 additions & 3 deletions test/e2e/antreapolicy_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2646,7 +2646,7 @@ func testAuditLoggingBasic(t *testing.T, data *TestData) {
// testAuditLoggingEnableNP tests that audit logs are generated when K8s NP is applied
// tests both Allow traffic by K8s NP and Drop traffic by implicit K8s policy drop
func testAuditLoggingEnableNP(t *testing.T, data *TestData) {
data.updateNamespaceWithAnnotations(namespaces["x"], map[string]string{networkpolicy.EnableNPLoggingAnnotationKey: "true"})
failOnError(data.updateNamespaceWithAnnotations(namespaces["x"], map[string]string{networkpolicy.EnableNPLoggingAnnotationKey: "true"}), t)
// Add a K8s namespaced NetworkPolicy in ns x that allow ingress traffic from
// Pod x/b to x/a which default denies other ingress including from Pod x/c to x/a
k8sNPBuilder := &NetworkPolicySpecBuilder{}
Expand Down Expand Up @@ -2731,9 +2731,9 @@ func testAuditLoggingEnableNP(t *testing.T, data *TestData) {
t.Errorf("Error when polling audit log files for required entries: %v", err)
}
failOnError(k8sUtils.DeleteNetworkPolicy(namespaces["x"], "allow-x-b-to-x-a"), t)
data.UpdateNamespace(namespaces["x"], func(namespace *v1.Namespace) {
failOnError(data.UpdateNamespace(namespaces["x"], func(namespace *v1.Namespace) {
delete(namespace.Annotations, networkpolicy.EnableNPLoggingAnnotationKey)
})
}), t)
}

func testAppliedToPerRule(t *testing.T) {
Expand Down