Use admission webhooks as an alternative to audit logs

[rohfle]

Currently auditing webhooks are difficult to use as they require configuration before kubernetes is started. There are plans to allow configuration of webhooks at runtime (maybe v1.12).

Audit logs require ssh access to the master and require manual collection.

And so, we are looking for other ways of collecting request information.

One possible way would be using Admission webhooks
https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#prerequisites

An admission controller is a piece of code that intercepts requests to the Kubernetes API server prior to persistence of the object, but after the request is authenticated and authorized.

Admission webhooks are HTTP callbacks that receive admission requests and do something with them.

An admission webhook that

1. Records the request
2. Responds immediately with OK
3. Sends the request to apisnoop

could be something worth exploring

[hh]

The Nginx on our apisnoop test rig has been updated to proxy /audit to test-server.go.

The following should work on any kubernetes cluster that supports dynamic admission controller webhooks:

cat <<EOF | kubectl apply --validate=false -f -
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
metadata:
  name: apisnoop
webhooks:
- clientConfig:
    url: https://apisnoop.ii.coop/audit
  failurePolicy: Ignore
  name: apisnoop.ii.coop
  namespaceSelector: {}
  rules:
  - apiGroups:
    - '*'
    apiVersions:
    - '*'
    operations:
    - '*'
    resources:
    - '*'
EOF

Tomorrow we can see how much this differs from audit-logs to make it easier to contribute logs.

[hh]

• why do we have to use '--validate=false'
• ensure we can create / enforce / GUID style urls for new captures
• discuss where to store this data long term... a gce bucket?

[hh]

Will table this for a while until the dust settles regarding dynamic audit logging: kubernetes/community#2188

This approach also doesn't yet support user-agent.

[hh]

We can probably implement this now, pulling into current cycle for prioritisation.

[hh]

Just realized this use of AdmissionWebhooks to create an audit trail is the conversation that prompted the creation of DynamicAuditSinks / webhooks.