Emit audit events for most k8s requests

lib/events/api.go

@@ -343,6 +343,10 @@ const (
 	// Maximum is an event field specifying a maximal value (e.g. the value
 	// of `max_connections` for a `session.rejected` event).
 	Maximum = "max"
+
+	// KubeRequestEvent fires when a proxy handles a generic kubernetes
+	// request.
+	KubeRequestEvent = "kube.request"
 )
 
 const (

lib/events/codes.go

@@ -338,6 +338,11 @@ const (
 	X11ForwardCode = "T3008I"
 	// X11ForwardFailureCode is the x11 forward failure event code.
 	X11ForwardFailureCode = "T3008W"
+	// KubeRequestCode is an event code for a generic kubernetes request.
+	//
+	// Note: some requests (like exec into a pod) use other codes (like
+	// ExecCode).
+	KubeRequestCode = "T3009I"
 
 	// SessionCommandCode is a session command code.
 	SessionCommandCode = "T4000I"

lib/events/convert.go

@@ -365,6 +365,10 @@ func ToOneOf(in AuditEvent) (*OneOf, error) {
 		out.Event = &OneOf_SAMLConnectorDelete{
 			SAMLConnectorDelete: e,
 		}
+	case *KubeRequest:
+		out.Event = &OneOf_KubeRequest{
+			KubeRequest: e,
+		}
 	default:
 		return nil, trace.BadParameter("event type %T is not supported", in)
 	}
@@ -443,6 +447,8 @@ func FromOneOf(in OneOf) (AuditEvent, error) {
 		return e, nil
 	} else if e := in.GetSAMLConnectorDelete(); e != nil {
 		return e, nil
+	} else if e := in.GetKubeRequest(); e != nil {
+		return e, nil
 	} else {
 		return nil, trace.BadParameter("received unsupported event %T", in.Event)
 	}

lib/events/events.proto

@@ -903,6 +903,40 @@ message SAMLConnectorDelete {
         [ (gogoproto.nullable) = false, (gogoproto.embed) = true, (gogoproto.jsontag) = "" ];
 }
 
+// KubeRequest specifies a Kubernetes API request event.
+message KubeRequest {
+    // Metadata is a common event metadata
+    Metadata Metadata = 1
+        [ (gogoproto.nullable) = false, (gogoproto.embed) = true, (gogoproto.jsontag) = "" ];
+
+    // User is a common user event metadata
+    UserMetadata User = 2
+        [ (gogoproto.nullable) = false, (gogoproto.embed) = true, (gogoproto.jsontag) = "" ];
+
+    // ConnectionMetadata holds information about the connection
+    ConnectionMetadata Connection = 3
+        [ (gogoproto.nullable) = false, (gogoproto.embed) = true, (gogoproto.jsontag) = "" ];
+
+    // ServerMetadata is a common server metadata
+    ServerMetadata Server = 4
+        [ (gogoproto.nullable) = false, (gogoproto.embed) = true, (gogoproto.jsontag) = "" ];
+
+    // RequestPath is the raw request URL path.
+    string RequestPath = 5 [ (gogoproto.jsontag) = "request_path" ];
+    // Verb is the HTTP verb used for this request (e.g. GET, POST, etc)
+    string Verb = 6 [ (gogoproto.jsontag) = "verb" ];
+    // ResourceAPIGroup is the resource API group.
+    string ResourceAPIGroup = 7 [ (gogoproto.jsontag) = "resource_api_group,omitempty" ];
+    // ResourceNamespace is the resource namespace.
+    string ResourceNamespace = 8 [ (gogoproto.jsontag) = "resource_namespace,omitempty" ];
+    // ResourceKind is the API resource kind (e.g. "pod", "service", etc).
+    string ResourceKind = 9 [ (gogoproto.jsontag) = "resource_kind,omitempty" ];
+    // ResourceName is the API resource name.
+    string ResourceName = 10 [ (gogoproto.jsontag) = "resource_name,omitempty" ];
+    // ResponseCode is the HTTP response code for this request.
+    int32 ResponseCode = 11 [ (gogoproto.jsontag) = "response_code" ];
+}
+
 // OneOf is a union of one of audit events submitted to the auth service
 message OneOf {
     // Event is one of the audit events
@@ -942,6 +976,7 @@ message OneOf {
         events.OIDCConnectorDelete OIDCConnectorDelete = 33;
         events.SAMLConnectorCreate SAMLConnectorCreate = 34;
         events.SAMLConnectorDelete SAMLConnectorDelete = 35;
+        events.KubeRequest KubeRequest = 36;
     }
 }
 

lib/kube/proxy/forwarder.go

@@ -907,7 +907,41 @@ func (f *Forwarder) catchAll(ctx *authContext, w http.ResponseWriter, req *http.
 		f.Errorf("Failed to set up forwarding headers: %v.", err)
 		return nil, trace.Wrap(err)
 	}
+
+	w = &responseStatusRecorder{ResponseWriter: w}
 	sess.forwarder.ServeHTTP(w, req)
+
+	event := &events.KubeRequest{
+		Metadata: events.Metadata{
+			Type: events.KubeRequestEvent,
+			Code: events.KubeRequestCode,
+		},
+		UserMetadata: events.UserMetadata{
+			User:  ctx.User.GetName(),
+			Login: ctx.User.GetName(),
+		},
+		ConnectionMetadata: events.ConnectionMetadata{
+			RemoteAddr: req.RemoteAddr,
+			LocalAddr:  sess.cluster.targetAddr,
+			Protocol:   events.EventProtocolKube,
+		},
+		ServerMetadata: events.ServerMetadata{
+			ServerID:        f.ServerID,
+			ServerNamespace: f.Namespace,
+		},
+		RequestPath:  req.URL.Path,
+		Verb:         req.Method,
+		ResponseCode: int32(w.(*responseStatusRecorder).getStatus()),
+	}
+	r := parseResourcePath(req.URL.Path)
+	if r.skipEvent {
+		return nil, nil
+	}
+	r.populateEvent(event)
+	if err := f.Client.EmitAuditEvent(f.Context, event); err != nil {
+		f.WithError(err).Warn("Failed to emit event.")
+	}
+
 	return nil, nil
 }
 
@@ -1260,3 +1294,22 @@ func (f *Forwarder) requestCertificate(ctx authContext) (*tls.Config, error) {
 
 	return tlsConfig, nil
 }
+
+type responseStatusRecorder struct {
+	http.ResponseWriter
+	status int
+}
+
+func (r *responseStatusRecorder) WriteHeader(status int) {
+	r.status = status
+	r.ResponseWriter.WriteHeader(status)
+}
+
+func (r *responseStatusRecorder) getStatus() int {
+	// http.ResponseWriter implicitly sets StatusOK, if WriteHeader hasn't been
+	// explicitly called.
+	if r.status == 0 {
+		return http.StatusOK
+	}
+	return r.status
+}

lib/kube/proxy/url.go

@@ -0,0 +1,145 @@
+/*
+Copyright 2020 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package proxy
+
+import (
+	"fmt"
+	"path"
+	"strings"
+
+	"github.com/gravitational/teleport/lib/events"
+)
+
+type apiResource struct {
+	apiGroup     string
+	namespace    string
+	resourceKind string
+	resourceName string
+	skipEvent    bool
+}
+
+// parseResourcePath does best-effort parsing of a Kubernetes API request path.
+// All fields of the returned apiResource may be empty.
+func parseResourcePath(p string) apiResource {
+	// Kubernetes API reference: https://kubernetes.io/docs/reference/kubernetes-api/
+	// Let's try to parse this. Here be dragons!
+	//
+	// URLs have a prefix that defines an "API group":
+	// - /api/v1/ - the special "core" API group (e.g. pods, secrets, etc. belong here)
+	// - /apis/{group}/{version} - the other properly named groups (e.g. apps/v1 or rbac.authorization.k8s.io/v1beta1)
+	//
+	// After the prefix, we have the resource info:
+	// - /namespaces/{namespace}/{resource kind}/{resource name} for namespaced resources
+	//   - turns out, namespace is optional when you query across all
+	//     namespaces (e.g. /api/v1/pods to get pods in all namespaces)
+	// - /{resource kind}/{resource name} for cluster-scoped resources (e.g. namespaces or nodes)
+	//
+	// If {resource name} is missing, the request refers to all resources of
+	// that kind (e.g. list all pods).
+	//
+	// There can be more items after {resource name} (a "subresource"), like
+	// pods/foo/exec, but the depth is arbitrary (e.g.
+	// /api/v1/namespaces/{namespace}/pods/{name}/proxy/{path})
+	//
+	// And the cherry on top - watch endpoints, e.g.
+	// /api/v1/watch/namespaces/{namespace}/pods/{name}
+	// for live updates on resources (specific resources or all of one kind)
+	var r apiResource
+
+	// Clean up the path and make it absolute.
+	p = path.Clean(p)
+	if !path.IsAbs(p) {
+		p = "/" + p
+	}
+
+	parts := strings.Split(p, "/")
+	switch {
+	// Core API group has a "special" URL prefix /api/v1/.
+	case len(parts) >= 3 && parts[1] == "api" && parts[2] == "v1":
+		r.apiGroup = "core/v1"
+		parts = parts[3:]
+	// Other API groups have URL prefix /apis/{group}/{version}.
+	case len(parts) >= 4 && parts[1] == "apis":
+		r.apiGroup = fmt.Sprintf("%s/%s", parts[2], parts[3])
+		parts = parts[4:]
+	case len(parts) >= 2 && (parts[1] == "api" || parts[1] == "apis"):
+		// /api or /apis.
+		// This is part of API discovery. Don't emit to audit log to reduce
+		// noise.
+		r.skipEvent = true
+		return r
+	default:
+		// Doesn't look like a k8s API path, return empty result.
+		return r
+	}
+
+	// Watch API endpoints have an extra /watch/ prefix. For now, silently
+	// strip it from our result.
+	if len(parts) > 0 && parts[0] == "watch" {
+		parts = parts[1:]
+	}
+
+	switch len(parts) {
+	case 0:
+		// e.g. /apis/apps/v1
+		// This is part of API discovery. Don't emit to audit log to reduce
+		// noise.
+		r.skipEvent = true
+		return r
+	case 1:
+		// e.g. /api/v1/pods - list pods in all namespaces
+		r.resourceKind = parts[0]
+	case 2:
+		// e.g. /api/v1/clusterroles/{name} - read a cluster-level resource
+		r.resourceKind = parts[0]
+		r.resourceName = parts[1]
+	case 3:
+		if parts[0] == "namespaces" {
+			// e.g. /api/v1/namespaces/{namespace}/pods - list pods in a
+			// specific namespace
+			r.namespace = parts[1]
+			r.resourceKind = parts[2]
+		} else {
+			// e.g. /apis/apiregistration.k8s.io/v1/apiservices/{name}/status
+			kind := append([]string{parts[0]}, parts[2:]...)
+			r.resourceKind = strings.Join(kind, "/")
+			r.resourceName = parts[1]
+		}
+	default:
+		// e.g. /api/v1/namespaces/{namespace}/pods/{name} - get a specific pod
+		// or /api/v1/namespaces/{namespace}/pods/{name}/exec - exec command in a pod
+		if parts[0] == "namespaces" {
+			r.namespace = parts[1]
+			kind := append([]string{parts[2]}, parts[4:]...)
+			r.resourceKind = strings.Join(kind, "/")
+			r.resourceName = parts[3]
+		} else {
+			// e.g. /api/v1/nodes/{name}/proxy/{path}
+			kind := append([]string{parts[0]}, parts[2:]...)
+			r.resourceKind = strings.Join(kind, "/")
+			r.resourceName = parts[1]
+		}
+	}
+	return r
+}
+
+func (r apiResource) populateEvent(e *events.KubeRequest) {
+	e.ResourceAPIGroup = r.apiGroup
+	e.ResourceNamespace = r.namespace
+	e.ResourceKind = r.resourceKind
+	e.ResourceName = r.resourceName
+}

lib/kube/proxy/url_test.go

@@ -0,0 +1,67 @@
+/*
+Copyright 2020 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package proxy
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestParseResourcePath(t *testing.T) {
+	tests := []struct {
+		path string
+		want apiResource
+	}{
+		{path: "", want: apiResource{}},
+		{path: "/", want: apiResource{}},
+		{path: "/api", want: apiResource{skipEvent: true}},
+		{path: "/api/", want: apiResource{skipEvent: true}},
+		{path: "/api/v1", want: apiResource{skipEvent: true, apiGroup: "core/v1"}},
+		{path: "/api/v1/", want: apiResource{skipEvent: true, apiGroup: "core/v1"}},
+		{path: "/apis", want: apiResource{skipEvent: true}},
+		{path: "/apis/", want: apiResource{skipEvent: true}},
+		{path: "/apis/apps", want: apiResource{skipEvent: true}},
+		{path: "/apis/apps/", want: apiResource{skipEvent: true}},
+		{path: "/apis/apps/v1", want: apiResource{skipEvent: true, apiGroup: "apps/v1"}},
+		{path: "/apis/apps/v1/", want: apiResource{skipEvent: true, apiGroup: "apps/v1"}},
+		{path: "/api/v1/pods", want: apiResource{apiGroup: "core/v1", resourceKind: "pods"}},
+		{path: "/api/v1/watch/pods", want: apiResource{apiGroup: "core/v1", resourceKind: "pods"}},
+		{path: "/api/v1/namespaces/kube-system", want: apiResource{apiGroup: "core/v1", resourceKind: "namespaces", resourceName: "kube-system"}},
+		{path: "/api/v1/watch/namespaces/kube-system", want: apiResource{apiGroup: "core/v1", resourceKind: "namespaces", resourceName: "kube-system"}},
+		{path: "/apis/rbac.authorization.k8s.io/v1/clusterroles", want: apiResource{apiGroup: "rbac.authorization.k8s.io/v1", resourceKind: "clusterroles"}},
+		{path: "/apis/rbac.authorization.k8s.io/v1/watch/clusterroles", want: apiResource{apiGroup: "rbac.authorization.k8s.io/v1", resourceKind: "clusterroles"}},
+		{path: "/apis/rbac.authorization.k8s.io/v1/clusterroles/foo", want: apiResource{apiGroup: "rbac.authorization.k8s.io/v1", resourceKind: "clusterroles", resourceName: "foo"}},
+		{path: "/apis/rbac.authorization.k8s.io/v1/watch/clusterroles/foo", want: apiResource{apiGroup: "rbac.authorization.k8s.io/v1", resourceKind: "clusterroles", resourceName: "foo"}},
+		{path: "/api/v1/namespaces/kube-system/pods", want: apiResource{apiGroup: "core/v1", namespace: "kube-system", resourceKind: "pods"}},
+		{path: "/api/v1/watch/namespaces/kube-system/pods", want: apiResource{apiGroup: "core/v1", namespace: "kube-system", resourceKind: "pods"}},
+		{path: "/api/v1/namespaces/kube-system/pods/foo", want: apiResource{apiGroup: "core/v1", namespace: "kube-system", resourceKind: "pods", resourceName: "foo"}},
+		{path: "/api/v1/watch/namespaces/kube-system/pods/foo", want: apiResource{apiGroup: "core/v1", namespace: "kube-system", resourceKind: "pods", resourceName: "foo"}},
+		{path: "/api/v1/namespaces/kube-system/pods/foo/exec", want: apiResource{apiGroup: "core/v1", namespace: "kube-system", resourceKind: "pods/exec", resourceName: "foo"}},
+		{path: "/apis/apiregistration.k8s.io/v1/apiservices/foo/status", want: apiResource{apiGroup: "apiregistration.k8s.io/v1", resourceKind: "apiservices/status", resourceName: "foo"}},
+		{path: "/api/v1/nodes/foo/proxy/bar", want: apiResource{apiGroup: "core/v1", resourceKind: "nodes/proxy/bar", resourceName: "foo"}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.path, func(t *testing.T) {
+			got := parseResourcePath(tt.path)
+			diff := cmp.Diff(got, tt.want, cmp.AllowUnexported(apiResource{}))
+			assert.Empty(t, diff, "parsing path %q", tt.path)
+		})
+	}
+}