Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Configuring auditing with timescaledb. #217

Merged
merged 8 commits into from
Feb 25, 2025
Merged

Configuring auditing with timescaledb. #217

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
2a0293b
Configuring auditing with timescaledb.
Gerrit91 Jan 24, 2025
546dde2
Merge branch 'master' into auditing-timescaledb
Gerrit91 Feb 12, 2025
3f94bef
Allow configuring both audit backends.
Gerrit91 Feb 12, 2025
7a74d99
Update.
Gerrit91 Feb 19, 2025
73680fe
Remove override.
Gerrit91 Feb 19, 2025
43d8b92
Merge branch 'master' into auditing-timescaledb
Gerrit91 Feb 20, 2025
67c5e12
Cleanup.
Gerrit91 Feb 20, 2025
2486c44
Cleanup.
Gerrit91 Feb 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions deploy_control_plane.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,11 @@
tags: ipam-db
- name: metal-roles/control-plane/roles/masterdata-db
tags: masterdata-db
- name: metal-roles/control-plane/roles/auditing-timescaledb
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it's not possible to toggle this role depending on a value switch like an environment variable, right?
If not: I think it would make sense for the mini-lab to include both backends for the mini-lab.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's now possible to use both backends. By default it's TimescaleDB, but backends can be toggled using the variables metal_auditing_timescaledb_enabled and metal_auditing_meili_enabled.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I really vote for only one backend, we should simplify not complicate things. If we are not convinced with the existing solution we should get rid of it completely. Same applies for the extra code in the metal-api

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After we gained confidence we can decide if we want to throw out one. Having both options during transition phase is I think helpful. And there will also be a Splunk backend I hope soon, which is not searchable, so in general it's good to have everything prepared for another backend.

when: metal_auditing_timescaledb_enabled
tags: auditing
- name: metal-roles/control-plane/roles/auditing-meili
when: metal_auditing_meili_enabled
tags: auditing
- name: metal-roles/control-plane/roles/metal
tags: metal
Expand Down
13 changes: 11 additions & 2 deletions inventories/group_vars/all/images.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,11 +18,10 @@ setup_yaml:
# metal_masterdata_api_image_tag:
# metal_console_image_name:
# metal_console_image_tag:
# metal_core_image_name:
# metal_core_image_tag:
# ...
#
# further overrides can be looked up in the metal-role projects where the mapping is defined:
# https://github.com/metal-stack/metal-roles/blob/master/defaults/main.yaml

##
## for ansible roles
Expand All @@ -31,3 +30,13 @@ setup_yaml:
# ansible_common_version:
# metal_roles_version:
# metal_ansible_modules_version:

##
## helm charts
##

# metal_helm_chart_version:
# metal_helm_chart_repo:

# further overrides can be looked up in the metal-role projects where the mapping is defined:
# https://github.com/metal-stack/metal-roles/blob/master/defaults/main.yaml
3 changes: 3 additions & 0 deletions inventories/group_vars/control-plane/auditing.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,6 @@
---
auditing_timescaledb_storage_size: 10Gi
auditing_timescaledb_resources: {}

auditing_meili_storage_size: 10Gi
auditing_meili_resources: {}
4 changes: 2 additions & 2 deletions inventories/group_vars/control-plane/metal.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,5 +150,5 @@ metal_api_grpc_certs_client_cert: "{{ lookup('file', 'certs/grpc/client.pem') }
metal_api_grpc_certs_ca_cert: "{{ lookup('file', 'certs/ca.pem') }}"

# auditing
metal_auditing_enabled: true
metal_auditing_index_prefix: metal
metal_auditing_timescaledb_enabled: true
metal_auditing_meili_enabled: false