{"action":"closed","number":5,"pull_request":{"url":"https://api.github.com/repos/drud/vault-consul-on-kube/pulls/5","id":98370294,"html_url":"https://github.com/drud/vault-consul-on-kube/pull/5","diff_url":"https://github.com/drud/vault-consul-on-kube/pull/5.diff","patch_url":"https://github.com/drud/vault-consul-on-kube/pull/5.patch","issue_url":"https://api.github.com/repos/drud/vault-consul-on-kube/issues/5","number":5,"state":"closed","locked":false,"title":"DRUD-502: Add audit log-shipping to vault","user":{"login":"rfay","id":112444,"avatar_url":"https://avatars.githubusercontent.com/u/112444?v=3","gravatar_id":"","url":"https://api.github.com/users/rfay","html_url":"https://github.com/rfay","followers_url":"https://api.github.com/users/rfay/followers","following_url":"https://api.github.com/users/rfay/following{/other_user}","gists_url":"https://api.github.com/users/rfay/gists{/gist_id}","starred_url":"https://api.github.com/users/rfay/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rfay/subscriptions","organizations_url":"https://api.github.com/users/rfay/orgs","repos_url":"https://api.github.com/users/rfay/repos","events_url":"https://api.github.com/users/rfay/events{/privacy}","received_events_url":"https://api.github.com/users/rfay/received_events","type":"User","site_admin":false},"body":"[DRUD-502](https://newmediadenver.atlassian.net/browse/DRUD-502)\r\n\r\nThis uses the sidecar technique in [fluentd-sidecar-gcp](https://github.com/kubernetes/contrib/blob/master/logging/fluentd-sidecar-gcp) to ship logs to google cloud logging. They are shipped as a jsonPayload and then can be queried by field in the logging interface, and can also be exported or sent via \"sink\" to bigQuery.\r\n\r\nTesting technique:\r\n\r\n1. [Deploy the vault deployments](https://github.com/drud/vault-consul-on-kube/blob/master/README.md) (vault-1 and vault-2), unseal the vault, make sure it works. (You could just interact with one vault server, it doesn't matter much for this one.)\r\n2. Make sure the audit log is turned on (`vault audit-enable file file_path=/vault/logs/audit.log`)\r\n3. Do some activities with the vault\r\n4. Study the logs on google cloud logging.\r\n\r\nExample advanced logging query (remember to change project if necessary):\r\n```\r\nresource.type=\"container\"\r\nresource.labels.cluster_name=\"vault-freshstart\"\r\nlogName=\"projects/vault-freshstart/logs/file.audit.log\"\r\n```\r\n\r\nExample bigQuery query with ingested logs:\r\n\r\n`SELECT jsonPayload.auth.display_name, jsonPayload.request.path FROM [vault-freshstart:auditlog.file_audit_log_20161216] LIMIT 1000\r\n`","created_at":"2016-12-16T17:10:20Z","updated_at":"2016-12-21T23:40:24Z","closed_at":"2016-12-21T23:40:24Z","merged_at":"2016-12-21T23:40:24Z","merge_commit_sha":"05beefdbb2fe7e34b2d680d87f571c17c0c9efb5","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/drud/vault-consul-on-kube/pulls/5/commits","review_comments_url":"https://api.github.com/repos/drud/vault-consul-on-kube/pulls/5/comments","review_comment_url":"https://api.github.com/repos/drud/vault-consul-on-kube/pulls/comments{/number}","comments_url":"https://api.github.com/repos/drud/vault-consul-on-kube/issues/5/comments","statuses_url":"https://api.github.com/repos/drud/vault-consul-on-kube/statuses/2c5f783a53a23a17ec572d105db551cc4867aab7","head":{"label":"rfay:20161215_sidecar_json_audit_log","ref":"20161215_sidecar_json_audit_log","sha":"2c5f783a53a23a17ec572d105db551cc4867aab7","user":{"login":"rfay","id":112444,"avatar_url":"https://avatars.githubusercontent.com/u/112444?v=3","gravatar_id":"","url":"https://api.github.com/users/rfay","html_url":"https://github.com/rfay","followers_url":"https://api.github.com/users/rfay/followers","following_url":"https://api.github.com/users/rfay/following{/other_user}","gists_url":"https://api.github.com/users/rfay/gists{/gist_id}","starred_url":"https://api.github.com/users/rfay/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rfay/subscriptions","organizations_url":"https://api.github.com/users/rfay/orgs","repos_url":"https://api.github.com/users/rfay/repos","events_url":"https://api.github.com/users/rfay/events{/privacy}","received_events_url":"https://api.github.com/users/rfay/received_events","type":"User","site_admin":false},"repo":{"id":75873223,"name":"vault-consul-on-kube","full_name":"rfay/vault-consul-on-kube","owner":{"login":"rfay","id":112444,"avatar_url":"https://avatars.githubusercontent.com/u/112444?v=3","gravatar_id":"","url":"https://api.github.com/users/rfay","html_url":"https://github.com/rfay","followers_url":"https://api.github.com/users/rfay/followers","following_url":"https://api.github.com/users/rfay/following{/other_user}","gists_url":"https://api.github.com/users/rfay/gists{/gist_id}","starred_url":"https://api.github.com/users/rfay/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rfay/subscriptions","organizations_url":"https://api.github.com/users/rfay/orgs","repos_url":"https://api.github.com/users/rfay/repos","events_url":"https://api.github.com/users/rfay/events{/privacy}","received_events_url":"https://api.github.com/users/rfay/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/rfay/vault-consul-on-kube","description":"HashiCorp's Vault + Consul on Kubernetes","fork":true,"url":"https://api.github.com/repos/rfay/vault-consul-on-kube","forks_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/forks","keys_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/keys{/key_id}","collaborators_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/teams","hooks_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/hooks","issue_events_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/issues/events{/number}","events_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/events","assignees_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/assignees{/user}","branches_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/branches{/branch}","tags_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/tags","blobs_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/git/refs{/sha}","trees_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/git/trees{/sha}","statuses_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/statuses/{sha}","languages_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/languages","stargazers_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/stargazers","contributors_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/contributors","subscribers_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/subscribers","subscription_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/subscription","commits_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/commits{/sha}","git_commits_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/git/commits{/sha}","comments_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/comments{/number}","issue_comment_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/issues/comments{/number}","contents_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/contents/{+path}","compare_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/compare/{base}...{head}","merges_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/merges","archive_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/downloads","issues_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/issues{/number}","pulls_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/pulls{/number}","milestones_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/milestones{/number}","notifications_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/labels{/name}","releases_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/releases{/id}","deployments_url":"https://api.github.com/repos/rfay/vault-consul-on-kube/deployments","created_at":"2016-12-07T20:31:12Z","updated_at":"2016-12-07T20:31:13Z","pushed_at":"2016-12-16T21:14:13Z","git_url":"git://github.com/rfay/vault-consul-on-kube.git","ssh_url":"git@github.com:rfay/vault-consul-on-kube.git","clone_url":"https://github.com/rfay/vault-consul-on-kube.git","svn_url":"https://github.com/rfay/vault-consul-on-kube","homepage":"","size":58,"stargazers_count":0,"watchers_count":0,"language":"Shell","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"drud:master","ref":"master","sha":"fa729a6056fa901dddf54873cf9c510030dc6e30","user":{"login":"drud","id":8115114,"avatar_url":"https://avatars.githubusercontent.com/u/8115114?v=3","gravatar_id":"","url":"https://api.github.com/users/drud","html_url":"https://github.com/drud","followers_url":"https://api.github.com/users/drud/followers","following_url":"https://api.github.com/users/drud/following{/other_user}","gists_url":"https://api.github.com/users/drud/gists{/gist_id}","starred_url":"https://api.github.com/users/drud/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/drud/subscriptions","organizations_url":"https://api.github.com/users/drud/orgs","repos_url":"https://api.github.com/users/drud/repos","events_url":"https://api.github.com/users/drud/events{/privacy}","received_events_url":"https://api.github.com/users/drud/received_events","type":"Organization","site_admin":false},"repo":{"id":74514166,"name":"vault-consul-on-kube","full_name":"drud/vault-consul-on-kube","owner":{"login":"drud","id":8115114,"avatar_url":"https://avatars.githubusercontent.com/u/8115114?v=3","gravatar_id":"","url":"https://api.github.com/users/drud","html_url":"https://github.com/drud","followers_url":"https://api.github.com/users/drud/followers","following_url":"https://api.github.com/users/drud/following{/other_user}","gists_url":"https://api.github.com/users/drud/gists{/gist_id}","starred_url":"https://api.github.com/users/drud/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/drud/subscriptions","organizations_url":"https://api.github.com/users/drud/orgs","repos_url":"https://api.github.com/users/drud/repos","events_url":"https://api.github.com/users/drud/events{/privacy}","received_events_url":"https://api.github.com/users/drud/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/drud/vault-consul-on-kube","description":"HashiCorp's Vault + Consul on Kubernetes","fork":false,"url":"https://api.github.com/repos/drud/vault-consul-on-kube","forks_url":"https://api.github.com/repos/drud/vault-consul-on-kube/forks","keys_url":"https://api.github.com/repos/drud/vault-consul-on-kube/keys{/key_id}","collaborators_url":"https://api.github.com/repos/drud/vault-consul-on-kube/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/drud/vault-consul-on-kube/teams","hooks_url":"https://api.github.com/repos/drud/vault-consul-on-kube/hooks","issue_events_url":"https://api.github.com/repos/drud/vault-consul-on-kube/issues/events{/number}","events_url":"https://api.github.com/repos/drud/vault-consul-on-kube/events","assignees_url":"https://api.github.com/repos/drud/vault-consul-on-kube/assignees{/user}","branches_url":"https://api.github.com/repos/drud/vault-consul-on-kube/branches{/branch}","tags_url":"https://api.github.com/repos/drud/vault-consul-on-kube/tags","blobs_url":"https://api.github.com/repos/drud/vault-consul-on-kube/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/drud/vault-consul-on-kube/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/drud/vault-consul-on-kube/git/refs{/sha}","trees_url":"https://api.github.com/repos/drud/vault-consul-on-kube/git/trees{/sha}","statuses_url":"https://api.github.com/repos/drud/vault-consul-on-kube/statuses/{sha}","languages_url":"https://api.github.com/repos/drud/vault-consul-on-kube/languages","stargazers_url":"https://api.github.com/repos/drud/vault-consul-on-kube/stargazers","contributors_url":"https://api.github.com/repos/drud/vault-consul-on-kube/contributors","subscribers_url":"https://api.github.com/repos/drud/vault-consul-on-kube/subscribers","subscription_url":"https://api.github.com/repos/drud/vault-consul-on-kube/subscription","commits_url":"https://api.github.com/repos/drud/vault-consul-on-kube/commits{/sha}","git_commits_url":"https://api.github.com/repos/drud/vault-consul-on-kube/git/commits{/sha}","comments_url":"https://api.github.com/repos/drud/vault-consul-on-kube/comments{/number}","issue_comment_url":"https://api.github.com/repos/drud/vault-consul-on-kube/issues/comments{/number}","contents_url":"https://api.github.com/repos/drud/vault-consul-on-kube/contents/{+path}","compare_url":"https://api.github.com/repos/drud/vault-consul-on-kube/compare/{base}...{head}","merges_url":"https://api.github.com/repos/drud/vault-consul-on-kube/merges","archive_url":"https://api.github.com/repos/drud/vault-consul-on-kube/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/drud/vault-consul-on-kube/downloads","issues_url":"https://api.github.com/repos/drud/vault-consul-on-kube/issues{/number}","pulls_url":"https://api.github.com/repos/drud/vault-consul-on-kube/pulls{/number}","milestones_url":"https://api.github.com/repos/drud/vault-consul-on-kube/milestones{/number}","notifications_url":"https://api.github.com/repos/drud/vault-consul-on-kube/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/drud/vault-consul-on-kube/labels{/name}","releases_url":"https://api.github.com/repos/drud/vault-consul-on-kube/releases{/id}","deployments_url":"https://api.github.com/repos/drud/vault-consul-on-kube/deployments","created_at":"2016-11-22T21:18:21Z","updated_at":"2016-12-09T18:52:32Z","pushed_at":"2016-12-21T23:40:24Z","git_url":"git://github.com/drud/vault-consul-on-kube.git","ssh_url":"git@github.com:drud/vault-consul-on-kube.git","clone_url":"https://github.com/drud/vault-consul-on-kube.git","svn_url":"https://github.com/drud/vault-consul-on-kube","homepage":"","size":46,"stargazers_count":1,"watchers_count":1,"language":"Shell","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":2,"mirror_url":null,"open_issues_count":2,"forks":2,"open_issues":2,"watchers":1,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/drud/vault-consul-on-kube/pulls/5"},"html":{"href":"https://github.com/drud/vault-consul-on-kube/pull/5"},"issue":{"href":"https://api.github.com/repos/drud/vault-consul-on-kube/issues/5"},"comments":{"href":"https://api.github.com/repos/drud/vault-consul-on-kube/issues/5/comments"},"review_comments":{"href":"https://api.github.com/repos/drud/vault-consul-on-kube/pulls/5/comments"},"review_comment":{"href":"https://api.github.com/repos/drud/vault-consul-on-kube/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/drud/vault-consul-on-kube/pulls/5/commits"},"statuses":{"href":"https://api.github.com/repos/drud/vault-consul-on-kube/statuses/2c5f783a53a23a17ec572d105db551cc4867aab7"}},"merged":true,"mergeable":null,"mergeable_state":"unknown","merged_by":{"login":"beeradb","id":294617,"avatar_url":"https://avatars.githubusercontent.com/u/294617?v=3","gravatar_id":"","url":"https://api.github.com/users/beeradb","html_url":"https://github.com/beeradb","followers_url":"https://api.github.com/users/beeradb/followers","following_url":"https://api.github.com/users/beeradb/following{/other_user}","gists_url":"https://api.github.com/users/beeradb/gists{/gist_id}","starred_url":"https://api.github.com/users/beeradb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/beeradb/subscriptions","organizations_url":"https://api.github.com/users/beeradb/orgs","repos_url":"https://api.github.com/users/beeradb/repos","events_url":"https://api.github.com/users/beeradb/events{/privacy}","received_events_url":"https://api.github.com/users/beeradb/received_events","type":"User","site_admin":false},"comments":2,"review_comments":0,"commits":2,"additions":148,"deletions":0,"changed_files":7}}
{"actor":{"display_login":"beeradb"}}