Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Introduce Experiment to Toggle Between Legacy Auditing Backends/EventLogger #21628

Merged
merged 3 commits into from
Jul 7, 2023
Merged

Introduce Experiment to Toggle Between Legacy Auditing Backends/EventLogger #21628

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
65bd972
introduce experiment to toggle between legacy auditing backends and e…
Jul 5, 2023
1d66519
provide changelog file
Jul 6, 2023
ca058f4
Merge branch 'main' into marcboudreau/VAULT-17772/experiments-toggle-…
Jul 6, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion helper/experiments/experiments.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,14 @@

package experiments

const VaultExperimentEventsAlpha1 = "events.alpha1"
const (
VaultExperimentEventsAlpha1 = "events.alpha1"
VaultExperimentCoreAuditEventsAlpha1 = "core.audit.events.alpha1"
)

var validExperiments = []string{
VaultExperimentEventsAlpha1,
VaultExperimentCoreAuditEventsAlpha1,
}

// ValidExperiments exposes the list without exposing a mutable global variable.
Expand Down
7 changes: 4 additions & 3 deletions vault/audit.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ import (

uuid "github.com/hashicorp/go-uuid"
"github.com/hashicorp/vault/audit"
"github.com/hashicorp/vault/helper/experiments"
"github.com/hashicorp/vault/helper/namespace"
"github.com/hashicorp/vault/sdk/helper/consts"
"github.com/hashicorp/vault/sdk/helper/jsonutil"
Expand Down Expand Up @@ -155,7 +156,7 @@ func (c *Core) enableAudit(ctx context.Context, entry *MountEntry, updateStorage
c.audit = newTable

// Register the backend
c.auditBroker.Register(entry.Path, backend, entry.Local)
c.auditBroker.Register(entry.Path, backend, entry.Local, c.IsExperimentEnabled(experiments.VaultExperimentCoreAuditEventsAlpha1))
if c.logger.IsInfo() {
c.logger.Info("enabled audit backend", "path", entry.Path, "type", entry.Type)
}
Expand Down Expand Up @@ -208,7 +209,7 @@ func (c *Core) disableAudit(ctx context.Context, path string, updateStorage bool
c.audit = newTable

// Unmount the backend
c.auditBroker.Deregister(path)
c.auditBroker.Deregister(path, c.IsExperimentEnabled(experiments.VaultExperimentCoreAuditEventsAlpha1))
if c.logger.IsInfo() {
c.logger.Info("disabled audit backend", "path", path)
}
Expand Down Expand Up @@ -416,7 +417,7 @@ func (c *Core) setupAudits(ctx context.Context) error {
}

// Mount the backend
broker.Register(entry.Path, backend, entry.Local)
broker.Register(entry.Path, backend, entry.Local, c.IsExperimentEnabled(experiments.VaultExperimentCoreAuditEventsAlpha1))

successCount++
}
Expand Down
28 changes: 18 additions & 10 deletions vault/audit_broker.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,20 +40,28 @@ func NewAuditBroker(log log.Logger) *AuditBroker {
}

// Register is used to add new audit backend to the broker
func (a *AuditBroker) Register(name string, b audit.Backend, local bool) {
a.Lock()
defer a.Unlock()
a.backends[name] = backendEntry{
backend: b,
local: local,
func (a *AuditBroker) Register(name string, b audit.Backend, local bool, useEventLogger bool) {
if useEventLogger {
// TODO: Coming soon
} else {
a.Lock()
defer a.Unlock()
a.backends[name] = backendEntry{
backend: b,
local: local,
}
}
}

// Deregister is used to remove an audit backend from the broker
func (a *AuditBroker) Deregister(name string) {
a.Lock()
defer a.Unlock()
delete(a.backends, name)
func (a *AuditBroker) Deregister(name string, useEventLogger bool) {
if useEventLogger {
// TODO: Coming soon
} else {
a.Lock()
defer a.Unlock()
delete(a.backends, name)
}
}

// IsRegistered is used to check if a given audit backend is registered
Expand Down
12 changes: 6 additions & 6 deletions vault/audit_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -343,8 +343,8 @@ func TestAuditBroker_LogRequest(t *testing.T) {
b := NewAuditBroker(l)
a1 := corehelpers.TestNoopAudit(t, nil)
a2 := corehelpers.TestNoopAudit(t, nil)
b.Register("foo", a1, false)
b.Register("bar", a2, false)
b.Register("foo", a1, false, false)
b.Register("bar", a2, false, false)

auth := &logical.Auth{
ClientToken: "foo",
Expand Down Expand Up @@ -430,8 +430,8 @@ func TestAuditBroker_LogResponse(t *testing.T) {
b := NewAuditBroker(l)
a1 := corehelpers.TestNoopAudit(t, nil)
a2 := corehelpers.TestNoopAudit(t, nil)
b.Register("foo", a1, false)
b.Register("bar", a2, false)
b.Register("foo", a1, false, false)
b.Register("bar", a2, false, false)

auth := &logical.Auth{
NumUses: 10,
Expand Down Expand Up @@ -537,8 +537,8 @@ func TestAuditBroker_AuditHeaders(t *testing.T) {
view := NewBarrierView(barrier, "headers/")
a1 := corehelpers.TestNoopAudit(t, nil)
a2 := corehelpers.TestNoopAudit(t, nil)
b.Register("foo", a1, false)
b.Register("bar", a2, false)
b.Register("foo", a1, false, false)
b.Register("bar", a2, false, false)

auth := &logical.Auth{
ClientToken: "foo",
Expand Down