feat: log details on log denies

[acpana]

Smallest of patches to log the details of a violation. I don't think this has a place in audit but am open to reconsider.

Addresses #2790

Example:

{
  "level": "info",
  "ts": 1685780064.9552832,
  "logger": "webhook",
  "msg": "denied admission: All namespaces must have an `owner` label that points to your company username",
  "hookType": "validation",
  "process": "admission",
  "event_type": "violation",
  "constraint_name": "all-must-have-owner",
  "constraint_group": "constraints.gatekeeper.sh",
  "constraint_api_version": "v1beta1",
  "constraint_kind": "K8sRequiredLabelsOptimized",
  "constraint_action": "deny",
  "violation_metadata": {
    "details": {
      "missing_labels": [
        "owner"
      ]
    }
  },
  "resource_group": "",
  "resource_api_version": "v1",
  "resource_kind": "Namespace",
  "resource_namespace": "",
  "resource_name": "disallowed-namespace",
  "request_username": "kubernetes-admin"
}

[codecov-commenter]

Codecov Report

Patch coverage: 4.54% and project coverage change: +0.12 🎉

Comparison is base (ba39189) 52.73% compared to head (5bff76d) 52.86%.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2813      +/-   ##
==========================================
+ Coverage   52.73%   52.86%   +0.12%     
==========================================
  Files         132      132              
  Lines       11629    11632       +3     
==========================================
+ Hits         6133     6149      +16     
+ Misses       5013     5005       -8     
+ Partials      483      478       -5     

Flag	Coverage Δ
unittests	52.86% <4.54%> (+0.12%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
pkg/util/wildcard.go	100.00% <ø> (ø)
pkg/webhook/mutation.go	24.65% <0.00%> (-0.86%)	⬇️
pkg/webhook/policy.go	35.97% <7.69%> (-0.56%)	⬇️

... and 1 file with indirect coverage changes

☔ View full report in Codecov by Sentry.
📢 Do you have feedback about the report comment? Let us know in this issue.

[maxsmythe]

Why don't you think audit should also report details?

[maxsmythe]

FWIW audit already reports details:

gatekeeper/pkg/audit/manager.go

Line 1115 in b7230e0

logging.Details, details,

[maxsmythe]

We should be consistent with how audit handles the details field:

gatekeeper/pkg/audit/manager.go

Line 1115 in b7230e0

logging.Details, details,

[acpana]

Oh I missed that! 🤦🏼

Deduping this comment with the audit logging. I figured that logging the details of the rego evaluations for every object for every audit run would be too noisy. At present, we only log details for a violation in audit so this should be consistent w the audit behavior now:

gatekeeper/pkg/audit/manager.go

Lines 1106 to 1131 in b7230e0

	func logViolation(l logr.Logger,
	constraint *unstructured.Unstructured,
	enforcementAction util.EnforcementAction, resourceGroupVersionKind schema.GroupVersionKind, rnamespace, rname, message string, details interface{}, rlabels map[string]string,
	) {
	userConstraintAnnotations := constraint.GetAnnotations()
	delete(userConstraintAnnotations, "kubectl.kubernetes.io/last-applied-configuration")
	l.Info(
	message,
	logging.Details, details,
	logging.EventType, "violation_audited",
	logging.ConstraintGroup, constraint.GroupVersionKind().Group,
	logging.ConstraintAPIVersion, constraint.GroupVersionKind().Version,
	logging.ConstraintKind, constraint.GetKind(),
	logging.ConstraintName, constraint.GetName(),
	logging.ConstraintNamespace, constraint.GetNamespace(),
	logging.ConstraintAction, enforcementAction,
	logging.ConstraintAnnotations, userConstraintAnnotations,
	logging.ResourceGroup, resourceGroupVersionKind.Group,
	logging.ResourceAPIVersion, resourceGroupVersionKind.Version,
	logging.ResourceKind, resourceGroupVersionKind.Kind,
	logging.ResourceNamespace, rnamespace,
	logging.ResourceName, rname,
	logging.ResourceLabels, rlabels,
	)
	}

[acpana]

@maxsmythe PTAL when you have some time 🙏🏼 ; this is a one liner now hehe

[sozercan]

LGTM

[maxsmythe]

LGTM