-
Notifications
You must be signed in to change notification settings - Fork 361
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[MON-1786] Enable audit logs by default for Prometheus Adapter #1377
[MON-1786] Enable audit logs by default for Prometheus Adapter #1377
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Overall looks good. Would be good to have some link in the commit message, PR or changelog etc as some context as to where the various options are coming from.
Probably needs an e2e test in https://github.com/openshift/cluster-monitoring-operator/blob/master/test/e2e/config_test.go?
03dc9d5
to
6878fff
Compare
6878fff
to
9262ef5
Compare
32bead3
to
6058474
Compare
6058474
to
ede41f8
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Overall looks good to me with few nits.
@simonpasquier @dgrisonnet , I have removed the |
ede41f8
to
f4317a7
Compare
@sferich888 We have set the fix version to 4.10. Could you please approve? |
e39375a
to
222add7
Compare
/lgtm |
Who set qe-approved on this? I ask because its not QE acked in https://issues.redhat.com/browse/MON-1988 (as part of the planning processes). /label px-approved |
If you are asking why QE approval was set rather than who ... I believe it was given based on the previous epic. MON-1988 was created recently to narrow down the scope of otherwise a large/never-ending epic |
222add7
to
4b3ea08
Compare
/retest |
Enabling audit logs helps troubleshoot issues in Prometheus Adapter. The details of the audit level can be tweaked by selecting an audit profile which corresponds to audit Log Level. See: https://kubernetes.io/docs/tasks/debug-application-cluster/audit/#audit-policy The following profiles are provided: - Metadata: The default audit profile - None - Request - RequestResponse User can pick any of the profile by modifying the CMO configmap as follows ``` apiVersion: v1 kind: ConfigMap metadata: name: cluster-monitoring-config namespace: openshift-monitoring data: config.yaml: | k8sPrometheusAdapter: audit: profile: Request ``` Signed-off-by: Sunil Thaha <sthaha@redhat.com>
4b3ea08
to
ce499ef
Compare
/retest |
/lgtm |
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: dgrisonnet, simonpasquier, sthaha The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
/label docs-approved as per agreement with the docs team |
@sthaha: The following test failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
/hold cancel |
/retest-required Please review the full test history for this PR and help us cut down flakes. |
1 similar comment
/retest-required Please review the full test history for this PR and help us cut down flakes. |
This PR is part of the Monitoring story[1] to enable audit logs for Prometheus Adapter[2]. The patch adds the functionality to gather audit logs from prometheus-adapter pod which is available from OpenShift version 4.10. Running `oc adm must-gather -- /usr/bin/gather_audit_logs` will now gather prometheus-adapter audit logs and will be stored under `monitoring/<prometheus-adapter-pod>` directory. [1]: JIRA: https://issues.redhat.com/browse/MON-1786 [2]: openshift/cluster-monitoring-operator#1377 Signed-off-by: Sunil Thaha <sthaha@redhat.com>
Enabling audit logs helps troubleshoot issues in Prometheus Adapter. The
details of the audit level can be tweaked by selecting an audit profile
just like in OpenShift API server.
The following profiles are provided which corresponds to Audit Log Levels
User can pick any of the profile by modifying the CMO configmap as follows
CMO picks up the change and (re)deploys
prometheus-adapter
with appropriate--audit-
flags.Signed-off-by: Sunil Thaha sthaha@redhat.com