Add Log Label to Audit Logging #4748

qiyueyao · 2023-03-23T17:28:31Z

This feature adds a field "logLabel" to ACNP and ANP CRDs. "logLabel" defaults to empty value, and limits to 32 chars, any space will be replaced by - to avoid mess in the logs.

docs/antrea-network-policy.md

Dyanngg · 2023-03-27T23:01:54Z

docs/antrea-network-policy.md

-The rules are logged in the following format:
+**logSetting** and **enableLogging**: Antrea-native policy ingress or egress rules
+can be audited by enabling its logging field. `logSetting` and `enableLogging`
+cannot be used at the same time. When `logSetting` is provided and `enabled`


Are we deprecating enableLogging in some feature release? It's worth mentioning that 1. since v1.x enableLogging became available 2. We will be deprecating enableLogging for logSetting and hence they should not be set at the same time 3. logSetting.enabled: true == enableLogging: true.

I suppose enableLogging will be deprecated after logSetting is accepted by users. Updated the doc, welcome any more suggestion to make this explanation clearer.

multicluster/build/yamls/antrea-multicluster-leader-global.yml

qiyueyao · 2023-04-20T21:59:57Z

Antrea v2.0 related question: should introduction of logSetting and deprecation of enableLogging be considered in the Antrea v2.0 proposal? Any affect, and when should deprecation field be set?

pkg/apis/controlplane/v1beta2/types.go

docs/antrea-network-policy.md

jianjuns · 2023-04-28T22:15:33Z

docs/antrea-network-policy.md

+`enabled` must be specified, if `enabled` is true and `logLabel` is provided, the
+label will be displayed in the log, otherwise it defaults to empty value.
+
+The [first example](#acnp-with-stand-alone-selectors) policy logs all traffic that


IMO, we should change all "enableLogging" to "logSetting", as the former is to be deprecated. And why we even need so many logging examples? We can just keep one with "ACNP with log setting". Not necessary to talk about all possible values at all. People can understand. @Dyanngg

Replaced other "enableLogging" to "logSettings" but just "enabled: true" without log labels. Only using "logLabel" in this section. Reduced the explanations.

jianjuns · 2023-04-28T23:22:51Z

In commit message, "crd" -> "CRDs".

docs/antrea-network-policy.md

tnqn · 2023-05-11T12:50:18Z

pkg/apis/crd/v1alpha1/types.go

+	// This field can't be used with LogSettings, will be deprecated.
 	// +optional
 	EnableLogging bool `json:"enableLogging"`
+	// LogSettings is used to specify logging behaviors of the rules when matched.
+	// This field can't be used with EnableLogging.
+	// +optional
+	LogSettings *RuleLogSettings `json:"logSetting,omitempty"`


I wonder if we really need to make a new struct and deprecate the old field, considering:

Could we export the value to flow record for visbility as well, which adds one dimension that can be used to aggregate flows? Then the field doesn't need to be specific to log, and doesn't really need logging to be enabled.

Similar API in products like NSX doesn't make the field specific to logging as well.

Perhaps adding a new field of string could fullfil the requirement and be more extensible when we want to leverage the value in other features like flow visibility, and can avoid the extra effort to deprecate the old field:

// Label is user-defined arbitrary string which will be printed in the NetworkPolicy // logs and exported in flow records. Label string `json:"label,omitempty"`

cc @jianjuns @antoninbas @salv-orlando @qiyueyao

Did not think about this. If we believe there is a use case to add the label in the flow records, I would agree with what @tnqn suggested (I guess we can still call it "LogLabel").

+1 to not making it specific to audit logs

Sure that makes sense, didn't consider these use cases. Updating the CRD.

tnqn · 2023-05-15T15:00:06Z

build/charts/antrea/crds/clusternetworkpolicy.yaml

@@ -383,6 +383,9 @@ spec:
                        type: string
                      enableLogging:
                        type: boolean
+                      logLabel:
+                        type: string
+                        pattern: "^.{0,32}$"


If it just limits the length, it could use maxLength: 32

BTW, why did we choose 32 characters?
Maybe we could use 63 (same as K8s labels, which corresponds to the max length of a DNS label)? Are special characters generally supported for this?

32 characters was used according to the issue description, I'm not sure was there a specific reason @edwardbadboy ? If not, I'll change that to 63.

Currently, I updated the restriction to follow K8s valid label values.
63 or less, begin and end with an alphanumeric character, could contain dashes (-), underscores (_), dots (.), and alphanumerics between.

multicluster/build/yamls/antrea-multicluster-leader-global.yml

tnqn · 2023-05-15T15:06:35Z

pkg/agent/controller/networkpolicy/audit_logging.go

@@ -228,14 +231,14 @@ func getNetworkPolicyInfo(pktIn *ofctrl.PacketIn, c *Controller, ob *logInfo) er
 	if err != nil {
 		return fmt.Errorf("received error while unloading conjunction id from reg: %v", err)
 	}
-	ob.npRef, ob.ofPriority, ob.ruleName = c.ofClient.GetPolicyInfoFromConjunction(conjID)
+	ob.npRef, ob.ofPriority, ob.ruleName, ob.logLabel = c.ofClient.GetPolicyInfoFromConjunction(conjID)
+	ob.logLabel = strings.Replace(ob.logLabel, " ", "-", -1)


If it's going to do the conversion, we should make it clear in doc, or we shouldn't even allow space in the label?

Is it still needed?

docs/antrea-network-policy.md

pkg/apis/crd/v1alpha1/types.go

tnqn

LGTM, two minor comments

tnqn · 2023-05-18T06:18:16Z

pkg/agent/controller/networkpolicy/audit_logging.go

@@ -228,14 +231,14 @@ func getNetworkPolicyInfo(pktIn *ofctrl.PacketIn, c *Controller, ob *logInfo) er
 	if err != nil {
 		return fmt.Errorf("received error while unloading conjunction id from reg: %v", err)
 	}
-	ob.npRef, ob.ofPriority, ob.ruleName = c.ofClient.GetPolicyInfoFromConjunction(conjID)
+	ob.npRef, ob.ofPriority, ob.ruleName, ob.logLabel = c.ofClient.GetPolicyInfoFromConjunction(conjID)
+	ob.logLabel = strings.Replace(ob.logLabel, " ", "-", -1)


Is it still needed?

pkg/agent/controller/networkpolicy/cache.go

tnqn

LGTM

tnqn · 2023-05-18T11:28:45Z

/test-all

tnqn · 2023-05-18T13:43:11Z

/skip-conformance which failed because service IP overlapping with the testbed network, tracked by #4981

tnqn · 2023-05-18T13:44:08Z

@jianjuns @Dyanngg do you have other comments?

jianjuns · 2023-05-18T15:20:43Z

@jianjuns @Dyanngg do you have other comments?

Not from me.

tnqn · 2023-05-19T02:33:07Z

@qiyueyao could you rebase the PR? It conflicts with a commit that was just merged.

Antrea native policies support firewall rule logs. Adding a rule label to the log allows convenient post-processing of the logs like grepping the same log labels. This feature adds a field "logLabel" to the CRDs, which will be printed in the logs and exported to flow records. "logLabel" defaults to empty value. Fixes antrea-io#4652 Signed-off-by: Qiyue Yao <yaoq@vmware.com>

Dyanngg · 2023-05-19T03:54:38Z

docs/antrea-network-policy.md

@@ -253,7 +253,6 @@ spec:
        - protocol: TCP
          port: 5978
      name: DropToThirdParty
-      enableLogging: true


I'm not sure why we removed these lines in sample yamls? Was it because we planned to deprecate it? Since it is no longer the case, it might be beneficial to leave some rules with enableLogging: true across sample yamls, so that when users simply copy-paste these they benefit from better debuggability

Discussed offline, removing to avoid users encountering meter limit for other feature, and we have a separate example for enableLogging and logLabel.

qiyueyao · 2023-05-19T04:24:06Z

/test-all

qiyueyao · 2023-05-19T04:24:16Z

/skip-conformance

Antrea native policies support firewall rule logs. Adding a rule label to the log allows convenient post-processing of the logs like grepping the same log labels. This feature adds a field "logLabel" to the CRDs, which will be printed in the logs and exported to flow records. "logLabel" defaults to empty value. Fixes antrea-io#4652 Signed-off-by: Qiyue Yao <yaoq@vmware.com>

qiyueyao force-pushed the log-label branch 3 times, most recently from 8fc5240 to 5b76b48 Compare March 26, 2023 06:36

qiyueyao changed the title ~~[WIP] Add Log Label to Audit Logging~~ Add Log Label to Audit Logging Mar 27, 2023

qiyueyao marked this pull request as ready for review March 27, 2023 21:44

qiyueyao requested review from GraysonWu, tnqn and Dyanngg March 27, 2023 21:45

Dyanngg reviewed Mar 27, 2023

View reviewed changes

qiyueyao force-pushed the log-label branch 3 times, most recently from 6755648 to 4ab1c3c Compare March 31, 2023 00:14

qiyueyao force-pushed the log-label branch from 4ab1c3c to 7cbe8ee Compare April 27, 2023 03:02

jianjuns reviewed Apr 28, 2023

View reviewed changes

qiyueyao force-pushed the log-label branch from 98b6da5 to 9eecdbf Compare May 1, 2023 20:36

jianjuns reviewed May 3, 2023

View reviewed changes

vicky-liu added this to the Antrea v1.12 release milestone May 4, 2023

tnqn added the area/network-policy Issues or PRs related to network policies. label May 9, 2023

tnqn reviewed May 11, 2023

View reviewed changes

tnqn added api-review Categorizes an issue or PR as actively needing an API review. area/network-policy/api Issues or PRs related to the network policy API. action/release-note Indicates a PR that should be included in release notes. labels May 11, 2023

qiyueyao force-pushed the log-label branch from 0fac481 to e6fcbbc Compare May 15, 2023 09:18

tnqn reviewed May 15, 2023

View reviewed changes

jianjuns reviewed May 15, 2023

View reviewed changes

pkg/apis/crd/v1alpha1/types.go Outdated Show resolved Hide resolved

qiyueyao force-pushed the log-label branch 2 times, most recently from 2a21841 to 3278d6c Compare May 17, 2023 13:52

qiyueyao requested review from antoninbas, tnqn, Dyanngg and jianjuns May 18, 2023 05:41

tnqn reviewed May 18, 2023

View reviewed changes

qiyueyao force-pushed the log-label branch 2 times, most recently from e06a11a to f4e19e1 Compare May 18, 2023 09:39

tnqn previously approved these changes May 18, 2023

View reviewed changes

qiyueyao dismissed tnqn’s stale review via 63eccb7 May 19, 2023 02:49

qiyueyao force-pushed the log-label branch from f4e19e1 to 63eccb7 Compare May 19, 2023 02:49

Dyanngg reviewed May 19, 2023

View reviewed changes

tnqn approved these changes May 19, 2023

View reviewed changes

tnqn merged commit 326f307 into antrea-io:main May 19, 2023

qiyueyao deleted the log-label branch May 19, 2023 07:43

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Log Label to Audit Logging #4748

Add Log Label to Audit Logging #4748

qiyueyao commented Mar 23, 2023 •

edited

Loading

Dyanngg Mar 27, 2023

qiyueyao Mar 30, 2023

qiyueyao commented Apr 20, 2023

jianjuns Apr 28, 2023

qiyueyao May 1, 2023

jianjuns commented Apr 28, 2023

tnqn May 11, 2023

jianjuns May 11, 2023

antoninbas May 11, 2023

qiyueyao May 15, 2023

tnqn May 15, 2023

antoninbas May 15, 2023

qiyueyao May 17, 2023

qiyueyao May 18, 2023

tnqn May 15, 2023

tnqn May 18, 2023

tnqn left a comment

tnqn May 18, 2023

tnqn left a comment

tnqn commented May 18, 2023

tnqn commented May 18, 2023

tnqn commented May 18, 2023

jianjuns commented May 18, 2023

tnqn commented May 19, 2023

Dyanngg May 19, 2023

qiyueyao May 19, 2023

qiyueyao commented May 19, 2023

qiyueyao commented May 19, 2023

Add Log Label to Audit Logging #4748

Add Log Label to Audit Logging #4748

Conversation

qiyueyao commented Mar 23, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

qiyueyao commented Apr 20, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jianjuns commented Apr 28, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tnqn left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tnqn left a comment

Choose a reason for hiding this comment

tnqn commented May 18, 2023

tnqn commented May 18, 2023

tnqn commented May 18, 2023

jianjuns commented May 18, 2023

tnqn commented May 19, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

qiyueyao commented May 19, 2023

qiyueyao commented May 19, 2023

qiyueyao commented Mar 23, 2023 •

edited

Loading