{"action":"created","comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments/66363862","id":66363862,"diff_hunk":"@@ -0,0 +1,109 @@\n+/*\n+Copyright 2016 The Kubernetes Authors All rights reserved.\n+\n+Licensed under the Apache License, Version 2.0 (the \"License\");\n+you may not use this file except in compliance with the License.\n+You may obtain a copy of the License at\n+\n+    http://www.apache.org/licenses/LICENSE-2.0\n+\n+Unless required by applicable law or agreed to in writing, software\n+distributed under the License is distributed on an \"AS IS\" BASIS,\n+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n+See the License for the specific language governing permissions and\n+limitations under the License.\n+*/\n+\n+package audit\n+\n+import (\n+\t\"bufio\"\n+\t\"net\"\n+\t\"net/http\"\n+\n+\t\"github.com/golang/glog\"\n+\t\"github.com/pborman/uuid\"\n+\n+\t\"k8s.io/kubernetes/pkg/api\"\n+\tutilnet \"k8s.io/kubernetes/pkg/util/net\"\n+)\n+\n+// auditResponseWriter implements http.ResponseWriter interface.\n+type auditResponseWriter struct {\n+\thttp.ResponseWriter\n+\tid string\n+}\n+\n+func (a *auditResponseWriter) WriteHeader(code int) {\n+\tglog.Infof(\"AUDIT: id=%q response=\\\"%d\\\"\", a.id, code)","path":"pkg/apiserver/audit/audit.go","position":38,"original_position":38,"commit_id":"752c551c39be25f16e03d37bec8a3c2567467370","original_commit_id":"752c551c39be25f16e03d37bec8a3c2567467370","user":{"login":"lavalamp","id":647318,"avatar_url":"https://avatars.githubusercontent.com/u/647318?v=3","gravatar_id":"","url":"https://api.github.com/users/lavalamp","html_url":"https://github.com/lavalamp","followers_url":"https://api.github.com/users/lavalamp/followers","following_url":"https://api.github.com/users/lavalamp/following{/other_user}","gists_url":"https://api.github.com/users/lavalamp/gists{/gist_id}","starred_url":"https://api.github.com/users/lavalamp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lavalamp/subscriptions","organizations_url":"https://api.github.com/users/lavalamp/orgs","repos_url":"https://api.github.com/users/lavalamp/repos","events_url":"https://api.github.com/users/lavalamp/events{/privacy}","received_events_url":"https://api.github.com/users/lavalamp/received_events","type":"User","site_admin":false},"body":"The log is already hard enough to read-- I think I'd prefer a separate file.\n\nAlso I think it might be good to put the audit ID in the context? I guess\nwe can do that when we have a use case.\n\nOn Wed, Jun 8, 2016 at 4:07 PM, Clayton Coleman <notifications@github.com>\nwrote:\n\n> In pkg/apiserver/audit/audit.go\n> <https://github.com/kubernetes/kubernetes/pull/27087#discussion_r66356421>\n> :\n>\n> > +\n> > +\t\"github.com/golang/glog\"\n> > +\t\"github.com/pborman/uuid\"\n> > +\n> > +\t\"k8s.io/kubernetes/pkg/api\"\n> > +\tutilnet \"k8s.io/kubernetes/pkg/util/net\"\n> > +)\n> > +\n> > +// auditResponseWriter implements http.ResponseWriter interface.\n> > +type auditResponseWriter struct {\n> > +\thttp.ResponseWriter\n> > +\tid string\n> > +}\n> > +\n> > +func (a *auditResponseWriter) WriteHeader(code int) {\n> > +\tglog.Infof(\"AUDIT: id=%q response=\\\"%d\\\"\", a.id, code)\n>\n> A separate log file is not uncommon (depends on whether you want your logs\n> in one place or two places) - putting this behind an interface certainly\n> can't hurt though, and fleshing out the implementation.\n> … <#m_-3854526224780300919_>\n> On Wed, Jun 8, 2016 at 6:56 PM, Daniel Smith ***@***.***> wrote: In\n> pkg/apiserver/audit/audit.go <#27087 (comment)\n> <https://github.com/kubernetes/kubernetes/pull/27087#discussion_r66355213>>\n> : > + > + \"github.com/golang/glog\" > + \"github.com/pborman/uuid\" > + > + \"\n> k8s.io/kubernetes/pkg/api\" > + utilnet \"k8s.io/kubernetes/pkg/util/net\" >\n> +) > + > +// auditResponseWriter implements http.ResponseWriter interface.\n> > +type auditResponseWriter struct { > + http.ResponseWriter > + id string\n> > +} > + > +func (a *auditResponseWriter) WriteHeader(code int) { > +\n> glog.Infof(\"AUDIT: id=%q response=\\\"%d\\\"\", a.id, code) Is writing to\n> stdout really the best way to produce audit logs? I guess I'd expect a\n> separate output file, though I've never made audit logs before. — You are\n> receiving this because you were mentioned. Reply to this email directly,\n> view it on GitHub <\n> https://github.com/kubernetes/kubernetes/pull/27087/files/752c551c39be25f16e03d37bec8a3c2567467370#r66355213>,\n> or mute the thread <\n> https://github.com/notifications/unsubscribe/ABG_p4gePInwAQlDTfd0K-tGyId2SyZeks5qJ0iqgaJpZM4Ixcs->\n> .\n>\n> —\n> You are receiving this because you were assigned.\n> Reply to this email directly, view it on GitHub\n> <https://github.com/kubernetes/kubernetes/pull/27087/files/752c551c39be25f16e03d37bec8a3c2567467370#r66356421>,\n> or mute the thread\n> <https://github.com/notifications/unsubscribe/AAngljnZIzH5MvZkcNtqBs9oe67OxgN5ks5qJ0sjgaJpZM4Ixcs->\n> .\n>\n","created_at":"2016-06-09T00:09:12Z","updated_at":"2016-06-09T00:09:12Z","html_url":"https://github.com/kubernetes/kubernetes/pull/27087#discussion_r66363862","pull_request_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/27087","_links":{"self":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments/66363862"},"html":{"href":"https://github.com/kubernetes/kubernetes/pull/27087#discussion_r66363862"},"pull_request":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/27087"}}},"pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/27087","id":73128217,"html_url":"https://github.com/kubernetes/kubernetes/pull/27087","diff_url":"https://github.com/kubernetes/kubernetes/pull/27087.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/27087.patch","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/27087","number":27087,"state":"open","locked":false,"title":"Basic audit log","user":{"login":"soltysh","id":576341,"avatar_url":"https://avatars.githubusercontent.com/u/576341?v=3","gravatar_id":"","url":"https://api.github.com/users/soltysh","html_url":"https://github.com/soltysh","followers_url":"https://api.github.com/users/soltysh/followers","following_url":"https://api.github.com/users/soltysh/following{/other_user}","gists_url":"https://api.github.com/users/soltysh/gists{/gist_id}","starred_url":"https://api.github.com/users/soltysh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/soltysh/subscriptions","organizations_url":"https://api.github.com/users/soltysh/orgs","repos_url":"https://api.github.com/users/soltysh/repos","events_url":"https://api.github.com/users/soltysh/events{/privacy}","received_events_url":"https://api.github.com/users/soltysh/received_events","type":"User","site_admin":false},"body":"Fixes #2203 by introducing simple audit logging, including the information about impersonation. We currently have something identical in openshift, but I'm open to any suggestions. Sample logs look like that:\r\n\r\nas `<self>`:\r\n```\r\nAUDIT: id=\"75114bb5-970a-47d5-a5f1-1e99cea0574c\" ip=\"127.0.0.1\" method=\"GET\" user=\"test-admin\" as=\"<self>\" namespace=\"openshift\" uri=\"/api/v1/namespaces/openshift/pods/python\"\r\nAUDIT: id=\"75114bb5-970a-47d5-a5f1-1e99cea0574c\" response=200\r\n```\r\n\r\nas user:\r\n```\r\nAUDIT: id=\"b0a443ae-f7d8-408c-a355-eb9501fd5c59\" ip=\"192.168.121.118\" method=\"GET\" user=\"system:admin\" as=\"test-admin\" namespace=\"openshift\" uri=\"/api/v1/namespaces/openshift/pods/python\"\r\nAUDIT: id=\"b0a443ae-f7d8-408c-a355-eb9501fd5c59\" response=200\r\n```\r\n\r\n```release-note\r\n* Add basic audit logging\r\n```\r\n\r\n@ericchiang @smarterclayton @roberthbailey @erictune @ghodss \r\n\r\n[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/.github/PULL_REQUEST_TEMPLATE.md?pixel)]()\r\n\r\n","created_at":"2016-06-08T22:02:03Z","updated_at":"2016-06-09T00:09:13Z","closed_at":null,"merged_at":null,"merge_commit_sha":"2a897b040adbfca10968016d33cef75404d5c8cb","assignee":{"login":"lavalamp","id":647318,"avatar_url":"https://avatars.githubusercontent.com/u/647318?v=3","gravatar_id":"","url":"https://api.github.com/users/lavalamp","html_url":"https://github.com/lavalamp","followers_url":"https://api.github.com/users/lavalamp/followers","following_url":"https://api.github.com/users/lavalamp/following{/other_user}","gists_url":"https://api.github.com/users/lavalamp/gists{/gist_id}","starred_url":"https://api.github.com/users/lavalamp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lavalamp/subscriptions","organizations_url":"https://api.github.com/users/lavalamp/orgs","repos_url":"https://api.github.com/users/lavalamp/repos","events_url":"https://api.github.com/users/lavalamp/events{/privacy}","received_events_url":"https://api.github.com/users/lavalamp/received_events","type":"User","site_admin":false},"milestone":null,"commits_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/27087/commits","review_comments_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/27087/comments","review_comment_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments{/number}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/27087/comments","statuses_url":"https://api.github.com/repos/kubernetes/kubernetes/statuses/752c551c39be25f16e03d37bec8a3c2567467370","head":{"label":"soltysh:audit_log","ref":"audit_log","sha":"752c551c39be25f16e03d37bec8a3c2567467370","user":{"login":"soltysh","id":576341,"avatar_url":"https://avatars.githubusercontent.com/u/576341?v=3","gravatar_id":"","url":"https://api.github.com/users/soltysh","html_url":"https://github.com/soltysh","followers_url":"https://api.github.com/users/soltysh/followers","following_url":"https://api.github.com/users/soltysh/following{/other_user}","gists_url":"https://api.github.com/users/soltysh/gists{/gist_id}","starred_url":"https://api.github.com/users/soltysh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/soltysh/subscriptions","organizations_url":"https://api.github.com/users/soltysh/orgs","repos_url":"https://api.github.com/users/soltysh/repos","events_url":"https://api.github.com/users/soltysh/events{/privacy}","received_events_url":"https://api.github.com/users/soltysh/received_events","type":"User","site_admin":false},"repo":{"id":22375428,"name":"kubernetes","full_name":"soltysh/kubernetes","owner":{"login":"soltysh","id":576341,"avatar_url":"https://avatars.githubusercontent.com/u/576341?v=3","gravatar_id":"","url":"https://api.github.com/users/soltysh","html_url":"https://github.com/soltysh","followers_url":"https://api.github.com/users/soltysh/followers","following_url":"https://api.github.com/users/soltysh/following{/other_user}","gists_url":"https://api.github.com/users/soltysh/gists{/gist_id}","starred_url":"https://api.github.com/users/soltysh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/soltysh/subscriptions","organizations_url":"https://api.github.com/users/soltysh/orgs","repos_url":"https://api.github.com/users/soltysh/repos","events_url":"https://api.github.com/users/soltysh/events{/privacy}","received_events_url":"https://api.github.com/users/soltysh/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/soltysh/kubernetes","description":"Container Cluster Manager","fork":true,"url":"https://api.github.com/repos/soltysh/kubernetes","forks_url":"https://api.github.com/repos/soltysh/kubernetes/forks","keys_url":"https://api.github.com/repos/soltysh/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/soltysh/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/soltysh/kubernetes/teams","hooks_url":"https://api.github.com/repos/soltysh/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/soltysh/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/soltysh/kubernetes/events","assignees_url":"https://api.github.com/repos/soltysh/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/soltysh/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/soltysh/kubernetes/tags","blobs_url":"https://api.github.com/repos/soltysh/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/soltysh/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/soltysh/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/soltysh/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/soltysh/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/soltysh/kubernetes/languages","stargazers_url":"https://api.github.com/repos/soltysh/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/soltysh/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/soltysh/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/soltysh/kubernetes/subscription","commits_url":"https://api.github.com/repos/soltysh/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/soltysh/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/soltysh/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/soltysh/kubernetes/issues/comments{/number}","contents_url":"https://api.github.com/repos/soltysh/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/soltysh/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/soltysh/kubernetes/merges","archive_url":"https://api.github.com/repos/soltysh/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/soltysh/kubernetes/downloads","issues_url":"https://api.github.com/repos/soltysh/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/soltysh/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/soltysh/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/soltysh/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/soltysh/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/soltysh/kubernetes/releases{/id}","deployments_url":"https://api.github.com/repos/soltysh/kubernetes/deployments","created_at":"2014-07-29T09:56:32Z","updated_at":"2016-01-11T08:57:41Z","pushed_at":"2016-06-08T21:56:18Z","git_url":"git://github.com/soltysh/kubernetes.git","ssh_url":"git@github.com:soltysh/kubernetes.git","clone_url":"https://github.com/soltysh/kubernetes.git","svn_url":"https://github.com/soltysh/kubernetes","homepage":null,"size":260901,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"kubernetes:master","ref":"master","sha":"e79f0469909c4cc779cd167e9554ca3340cc08cb","user":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars.githubusercontent.com/u/13629408?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"repo":{"id":20580498,"name":"kubernetes","full_name":"kubernetes/kubernetes","owner":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars.githubusercontent.com/u/13629408?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/kubernetes/kubernetes","description":"Production-Grade Container Scheduling and Management","fork":false,"url":"https://api.github.com/repos/kubernetes/kubernetes","forks_url":"https://api.github.com/repos/kubernetes/kubernetes/forks","keys_url":"https://api.github.com/repos/kubernetes/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kubernetes/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kubernetes/kubernetes/teams","hooks_url":"https://api.github.com/repos/kubernetes/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/kubernetes/kubernetes/events","assignees_url":"https://api.github.com/repos/kubernetes/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/kubernetes/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/kubernetes/kubernetes/tags","blobs_url":"https://api.github.com/repos/kubernetes/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kubernetes/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kubernetes/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/kubernetes/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kubernetes/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/kubernetes/kubernetes/languages","stargazers_url":"https://api.github.com/repos/kubernetes/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/kubernetes/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/kubernetes/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/kubernetes/kubernetes/subscription","commits_url":"https://api.github.com/repos/kubernetes/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/kubernetes/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments{/number}","contents_url":"https://api.github.com/repos/kubernetes/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/kubernetes/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kubernetes/kubernetes/merges","archive_url":"https://api.github.com/repos/kubernetes/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kubernetes/kubernetes/downloads","issues_url":"https://api.github.com/repos/kubernetes/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/kubernetes/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/kubernetes/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/kubernetes/kubernetes/releases{/id}","deployments_url":"https://api.github.com/repos/kubernetes/kubernetes/deployments","created_at":"2014-06-06T22:56:04Z","updated_at":"2016-06-08T22:51:50Z","pushed_at":"2016-06-09T00:08:05Z","git_url":"git://github.com/kubernetes/kubernetes.git","ssh_url":"git@github.com:kubernetes/kubernetes.git","clone_url":"https://github.com/kubernetes/kubernetes.git","svn_url":"https://github.com/kubernetes/kubernetes","homepage":"http://kubernetes.io","size":470594,"stargazers_count":14815,"watchers_count":14815,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":4549,"mirror_url":null,"open_issues_count":3754,"forks":4549,"open_issues":3754,"watchers":14815,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/27087"},"html":{"href":"https://github.com/kubernetes/kubernetes/pull/27087"},"issue":{"href":"https://api.github.com/repos/kubernetes/kubernetes/issues/27087"},"comments":{"href":"https://api.github.com/repos/kubernetes/kubernetes/issues/27087/comments"},"review_comments":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/27087/comments"},"review_comment":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/27087/commits"},"statuses":{"href":"https://api.github.com/repos/kubernetes/kubernetes/statuses/752c551c39be25f16e03d37bec8a3c2567467370"}}}}
{"actor":{"display_login":"lavalamp"}}