Skip to content

Kubernetes Audit log update - added datatype for annotations.pod-security_kubernetes_io/audit-violation - #12227

Merged
tetianakravchenko merged 0 commit into
elastic:mainfrom
neu7ron2:audit-datatype-fix
Jan 9, 2025
Merged

Kubernetes Audit log update - added datatype for annotations.pod-security_kubernetes_io/audit-violation#12227
tetianakravchenko merged 0 commit into
elastic:mainfrom
neu7ron2:audit-datatype-fix

Conversation

@neu7ron2

@neu7ron2 neu7ron2 commented Jan 4, 2025 •
edited by tetianakravchenko
Loading

Copy link
Copy Markdown
Contributor
  • Enhancement

Proposed commit message

Added the data type for the 'audit-violation' field as type TEXT in the Kubernetes Audit logs ingest mapping. This will allow users to search for and do alerts on this field. In Kubernetes, this field is generated in the audit logs when a user tries to deploy a deployment/pod into a namespace that has security restrictions applied to it. Alerts for this sort of violation are important.

Kubernetes documentation regarding the audit logs annotation pod-security.kubernetes.io/audit-violations: https://kubernetes.io/docs/reference/labels-annotations-taints/audit-annotations/#pod-security-kubernetes-io-audit-violations

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • [] I have added an entry to my package's changelog.yml file.
  • [>=8.16.0 ] I have verified that Kibana version constraints are current according to guidelines.
  • [n/a ] I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

  • [ ]

How to test this PR locally

Add a Kubernetes Pod Security standard of type audit=restricted to the namespace. Try to deploy a pod or deployment and a new field will be generated in the Kubernetes Audit log file which will be picked up by elastic and ingested with the correct datatype.

Related issues

Screenshots
@neu7ron2
neu7ron2 requested a review from a team as a code owner January 4, 2025 07:39
@cla-checker-service

cla-checker-service Bot commented Jan 4, 2025 •
edited
Loading

Copy link
Copy Markdown

💚 CLA has been signed
@andrewkroh andrewkroh added Integration:kubernetes Kubernetes needs CLA User must sign the Elastic Contributor License before review. Team:Cloudnative-Monitoring Cloud Native Monitoring team [elastic/obs-cloudnative-monitoring] labels Jan 4, 2025
@MichaelKatsoulis

MichaelKatsoulis commented Jan 7, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

hey @neu7ron2 . Can you sign a CLA ?

Also as part of your PR, you should update the manifest.yml

integrations/packages/kubernetes/manifest.yml

Line 4 in 191eb51

version: 1.68.1

and the changelog.yml

integrations/packages/kubernetes/changelog.yml

Line 2 in 191eb51

- version: 1.68.1

You can set the version of the kubernetes integration to 1.68.2
@andrewkroh andrewkroh added enhancement New feature or request and removed needs CLA User must sign the Elastic Contributor License before review. labels Jan 8, 2025
@neu7ron2

neu7ron2 commented Jan 8, 2025

Copy link
Copy Markdown
Contributor Author

HI @MichaelKatsoulis, the CLA has been signed (not sure why it didn't pick it up previously). I've updated the Manifest and changelog.
Thanks
@MichaelKatsoulis

MichaelKatsoulis commented Jan 8, 2025

Copy link
Copy Markdown
Contributor

@tetianakravchenko could you also take a look at this PR ?
tetianakravchenko
tetianakravchenko reviewed Jan 8, 2025
View reviewed changes
Comment thread packages/kubernetes/changelog.yml Outdated

@tetianakravchenko tetianakravchenko Jan 8, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- version: 1.68.2
- version: 1.69.0

since it is an enhancement (not a bugfix), it should be 1.69.0
otherwise PR looks good to me, I've also added a doc link regarding well-known annotations https://kubernetes.io/docs/reference/labels-annotations-taints/audit-annotations/#pod-security-kubernetes-io-audit-violations to description

@neu7ron2 neu7ron2 Jan 9, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've updated the manifest.yaml and the changelog.yaml to version 1.69.0
Comment thread packages/kubernetes/manifest.yml Outdated
@tetianakravchenko

tetianakravchenko commented Jan 9, 2025

Copy link
Copy Markdown
Contributor

/test
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jan 9, 2025

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport
@elasticmachine

elasticmachine commented Jan 9, 2025

Copy link
Copy Markdown

💚 Build Succeeded
@elastic-sonarqube

elastic-sonarqube Bot commented Jan 9, 2025

Copy link
Copy Markdown

Quality Gate passed Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
33.3% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube
@tetianakravchenko
tetianakravchenko merged commit 6c8fd62 into elastic:main Jan 9, 2025
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jan 9, 2025

Copy link
Copy Markdown
Contributor

Package kubernetes - 1.69.0 containing this change is available at https://epr.elastic.co/package/kubernetes/1.69.0/
harnish-crest-data pushed a commit to chavdaharnish/integrations that referenced this pull request Feb 4, 2025
@neu7ron2 @tetianakravchenko
Kubernetes Audit log update - added datatype for annotations.pod-secu…
fde0c4b 
…rity_kubernetes_io/audit-violation (elastic#12227)

* Added a table entry for: kubernetes.audit.annotations.pod-security_kubernetes_io/audit-violations

Added an table entry for the new kubernetes.audit.annotations.pod-security_kubernetes_io/audit-violations

* Added the data type for field pod-security_kubernetes_io/audit-violations

Added the data type for field pod-security_kubernetes_io/audit-violations.
This is defined in the offical kubernetes documentation here: https://kubernetes.io/docs/reference/labels-annotations-taints/audit-annotations/#pod-security-kubernetes-io-enforce-policy

* Updated version to 1.68.2

* Update changelog.yml

* Update packages/kubernetes/manifest.yml

Co-authored-by: Tetiana Kravchenko <tanya.kravchenko.v@gmail.com>

* Update change number to 1.69.0

* Update version to 1.69.0

---------

Co-authored-by: Tetiana Kravchenko <tanya.kravchenko.v@gmail.com>
harnish-crest-data pushed a commit to chavdaharnish/integrations that referenced this pull request Feb 5, 2025
@neu7ron2 @tetianakravchenko
Kubernetes Audit log update - added datatype for annotations.pod-secu…
7220899 
…rity_kubernetes_io/audit-violation (elastic#12227)

* Added a table entry for: kubernetes.audit.annotations.pod-security_kubernetes_io/audit-violations

Added an table entry for the new kubernetes.audit.annotations.pod-security_kubernetes_io/audit-violations

* Added the data type for field pod-security_kubernetes_io/audit-violations

Added the data type for field pod-security_kubernetes_io/audit-violations.
This is defined in the offical kubernetes documentation here: https://kubernetes.io/docs/reference/labels-annotations-taints/audit-annotations/#pod-security-kubernetes-io-enforce-policy

* Updated version to 1.68.2

* Update changelog.yml

* Update packages/kubernetes/manifest.yml

Co-authored-by: Tetiana Kravchenko <tanya.kravchenko.v@gmail.com>

* Update change number to 1.69.0

* Update version to 1.69.0

---------

Co-authored-by: Tetiana Kravchenko <tanya.kravchenko.v@gmail.com>
@neu7ron2
neu7ron2 deleted the audit-datatype-fix branch February 7, 2025 06:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request Integration:kubernetes Kubernetes Team:Cloudnative-Monitoring Cloud Native Monitoring team [elastic/obs-cloudnative-monitoring]

5 participants

@neu7ron2 @MichaelKatsoulis @tetianakravchenko @elasticmachine @andrewkroh