Introduce the audit logs to dir

docs/pupernetes_daemon.md

@@ -9,7 +9,7 @@ Use this command to clean setup and run a Kubernetes local environment
 ### Options
 
 ```
-  -c, --clean string                 clean options before setup: binaries,etcd,iptables,kubectl,kubelet,manifests,mounts,network,secrets,systemd,all,none (default "etcd,kubelet,mounts,iptables")
+  -c, --clean string                 clean options before setup: binaries,etcd,iptables,kubectl,kubelet,logs,manifests,mounts,network,secrets,systemd,all,none (default "etcd,kubelet,logs,mounts,iptables")
       --cni-version string           container network interface (cni) version (default "0.7.0")
       --download-timeout string      timeout for each downloaded archive (default "30m0s")
       --etcd-version string          etcd version (default "3.1.11")

docs/pupernetes_daemon_clean.md

@@ -34,7 +34,7 @@ pupernetes daemon clean /opt/state/ -c etcd,network,secrets
 ### Options inherited from parent commands
 
 ```
-  -c, --clean string                 clean options before setup: binaries,etcd,iptables,kubectl,kubelet,manifests,mounts,network,secrets,systemd,all,none (default "etcd,kubelet,mounts,iptables")
+  -c, --clean string                 clean options before setup: binaries,etcd,iptables,kubectl,kubelet,logs,manifests,mounts,network,secrets,systemd,all,none (default "etcd,kubelet,logs,mounts,iptables")
       --cni-version string           container network interface (cni) version (default "0.7.0")
       --download-timeout string      timeout for each downloaded archive (default "30m0s")
       --etcd-version string          etcd version (default "3.1.11")

docs/pupernetes_daemon_run.md

@@ -56,7 +56,7 @@ pupernetes daemon run /opt/state/ --dns-check --dns-queries quay.io.,coredns.kub
 ### Options inherited from parent commands
 
 ```
-  -c, --clean string                 clean options before setup: binaries,etcd,iptables,kubectl,kubelet,manifests,mounts,network,secrets,systemd,all,none (default "etcd,kubelet,mounts,iptables")
+  -c, --clean string                 clean options before setup: binaries,etcd,iptables,kubectl,kubelet,logs,manifests,mounts,network,secrets,systemd,all,none (default "etcd,kubelet,logs,mounts,iptables")
       --cni-version string           container network interface (cni) version (default "0.7.0")
       --download-timeout string      timeout for each downloaded archive (default "30m0s")
       --etcd-version string          etcd version (default "3.1.11")

docs/pupernetes_daemon_setup.md

@@ -25,7 +25,7 @@ pupernetes daemon setup state/
 ### Options inherited from parent commands
 
 ```
-  -c, --clean string                 clean options before setup: binaries,etcd,iptables,kubectl,kubelet,manifests,mounts,network,secrets,systemd,all,none (default "etcd,kubelet,mounts,iptables")
+  -c, --clean string                 clean options before setup: binaries,etcd,iptables,kubectl,kubelet,logs,manifests,mounts,network,secrets,systemd,all,none (default "etcd,kubelet,logs,mounts,iptables")
       --cni-version string           container network interface (cni) version (default "0.7.0")
       --download-timeout string      timeout for each downloaded archive (default "30m0s")
       --etcd-version string          etcd version (default "3.1.11")

pkg/config/config.go

@@ -44,7 +44,7 @@ func init() {
 	ViperConfig.SetDefault("kubectl-link", "")
 	ViperConfig.SetDefault("vault-root-token", "")
 
-	ViperConfig.SetDefault("clean", "etcd,kubelet,mounts,iptables")
+	ViperConfig.SetDefault("clean", "etcd,kubelet,logs,mounts,iptables")
 	ViperConfig.SetDefault("drain", "all")
 	ViperConfig.SetDefault("run-timeout", time.Hour*7)
 	ViperConfig.SetDefault("gc", time.Second*60)

pkg/options/clean.go

@@ -28,6 +28,7 @@ type Clean struct {
 	Kubectl   bool `json:"kubectl,omitempty"`
 	Mounts    bool `json:"mounts,omitempty"`
 	Iptables  bool `json:"iptables,omitempty"`
+	Logs      bool `json:"logs,omitempty"`
 }
 
 // NewCleanOptions instantiate a new Clean from the cleanString

pkg/options/clean_test.go

@@ -34,6 +34,7 @@ func TestNewCleanOptions(t *testing.T) {
 				true,
 				true,
 				true,
+				true,
 			},
 			"all",
 		},
@@ -54,6 +55,7 @@ func TestNewCleanOptions(t *testing.T) {
 				false,
 				false,
 				false,
+				false,
 			},
 			"",
 		},
@@ -74,6 +76,7 @@ func TestNewCleanOptions(t *testing.T) {
 				false,
 				false,
 				false,
+				false,
 			},
 			"",
 		},
@@ -94,6 +97,7 @@ func TestNewCleanOptions(t *testing.T) {
 				true,
 				true,
 				true,
+				true,
 			},
 			"all",
 		},
@@ -114,6 +118,7 @@ func TestNewCleanOptions(t *testing.T) {
 				false,
 				false,
 				false,
+				false,
 			},
 			"etcd",
 		},
@@ -134,6 +139,7 @@ func TestNewCleanOptions(t *testing.T) {
 				true,
 				true,
 				true,
+				true,
 			},
 			"all",
 		},
@@ -154,6 +160,7 @@ func TestNewCleanOptions(t *testing.T) {
 				false,
 				false,
 				false,
+				false,
 			},
 			"binaries,etcd",
 		},
@@ -174,6 +181,7 @@ func TestNewCleanOptions(t *testing.T) {
 				false,
 				false,
 				false,
+				false,
 			},
 			"binaries,etcd,secrets",
 		},
@@ -194,8 +202,9 @@ func TestNewCleanOptions(t *testing.T) {
 				true,
 				true,
 				true,
+				true,
 			},
-			"etcd,iptables,kubectl,kubelet,manifests,mounts,network,secrets,systemd",
+			"etcd,iptables,kubectl,kubelet,logs,manifests,mounts,network,secrets,systemd",
 		},
 		{
 			"-binaries,binaries",
@@ -214,8 +223,9 @@ func TestNewCleanOptions(t *testing.T) {
 				true,
 				true,
 				true,
+				true,
 			},
-			"etcd,iptables,kubectl,kubelet,manifests,mounts,network,secrets,systemd",
+			"etcd,iptables,kubectl,kubelet,logs,manifests,mounts,network,secrets,systemd",
 		},
 		{
 			"none,etcd",
@@ -234,6 +244,7 @@ func TestNewCleanOptions(t *testing.T) {
 				false,
 				false,
 				false,
+				false,
 			},
 			"",
 		},

pkg/setup/clean.go

@@ -118,6 +118,9 @@ func (e *Environment) Clean() error {
 	if e.cleanOptions.Network {
 		toRemove = append(toRemove, e.networkABSPath)
 	}
+	if e.cleanOptions.Logs {
+		toRemove = append(toRemove, e.logsABSPath)
+	}
 	if e.cleanOptions.Systemd {
 		glog.V(3).Infof("Shutting down systemd units")
 		conn, err := dbus.NewSystemdConnection()

pkg/setup/setup.go

@@ -37,6 +37,7 @@ const (
 	defaultEtcdDataDirName        = "etcd-data"
 	defaultSecretDirName          = "secrets"
 	defaultNetworkDirName         = "net.d"
+	defaultLogsDirName            = "logs"
 
 	defaultKubectlClusterName = "p8s"
 	defaultKubectlUserName    = "p8s"
@@ -57,6 +58,7 @@ type Environment struct {
 	manifestConfigABSPath    string
 	secretsABSPath           string
 	networkABSPath           string
+	logsABSPath              string
 
 	kubeletRootDir string
 
@@ -153,6 +155,7 @@ func NewConfigSetup(givenRootPath string) (*Environment, error) {
 		kubeletRootDir:           config.ViperConfig.GetString("kubelet-root-dir"),
 		secretsABSPath:           path.Join(rootABSPath, defaultSecretDirName),
 		networkABSPath:           path.Join(rootABSPath, defaultNetworkDirName),
+		logsABSPath:              path.Join(rootABSPath, defaultLogsDirName),
 		templateVersion:          getMajorMinorVersion(config.ViperConfig.GetString("hyperkube-version")),
 
 		kubeConfigUserPath:     config.ViperConfig.GetString("kubeconfig-path"),
@@ -281,6 +284,7 @@ func (e *Environment) setupDirectories() error {
 		e.networkABSPath,
 		e.kubeletRootDir,
 		KubeletCRILogPath,
+		e.logsABSPath,
 	} {
 		glog.V(4).Infof("Creating directory: %s", dir)
 		err := os.MkdirAll(dir, os.ModePerm)

pkg/setup/templates/1.10.go

@@ -84,7 +84,7 @@ ExecStart={{.RootABSPath}}/bin/hyperkube apiserver \
 	--default-watch-cache-size=0 \
 	--watch-cache-sizes="" \
 	--deserialization-cache-size=0 \
-	--audit-log-path=- \
+	--audit-log-path={{.RootABSPath}}/logs/audit.log \
 	--audit-policy-file={{.RootABSPath}}/manifest-config/audit.yaml \
 	--etcd-compaction-interval=0 \
 	--event-ttl=10m \
@@ -172,7 +172,7 @@ rules:
 - level: Metadata
   resources:
   - group: ""
-    resources: ["pods/log", "pods/exec"]
+    resources: ["*"]
 `),
 		},
 		{

pkg/setup/templates/1.11.go

@@ -83,7 +83,7 @@ ExecStart={{.RootABSPath}}/bin/hyperkube apiserver \
 	--default-watch-cache-size=0 \
 	--watch-cache-sizes="" \
 	--deserialization-cache-size=0 \
-	--audit-log-path=- \
+	--audit-log-path={{.RootABSPath}}/logs/audit.log \
 	--audit-policy-file={{.RootABSPath}}/manifest-config/audit.yaml \
 	--etcd-compaction-interval=0 \
 	--event-ttl=10m \
@@ -171,7 +171,7 @@ rules:
 - level: Metadata
   resources:
   - group: ""
-    resources: ["pods/log", "pods/exec"]
+    resources: ["*"]
 `),
 		},
 		{

pkg/setup/templates/1.5.go

@@ -149,19 +149,6 @@ current-context: p8s
 users:
   - name: p8s
     username: p8s
-`),
-		},
-		{
-			Name:        "audit.yaml",
-			Destination: ManifestConfig,
-			Content: []byte(`---
-apiVersion: audit.k8s.io/v1beta1
-kind: Policy
-rules:
-- level: Metadata
-  resources:
-  - group: ""
-    resources: ["pods/log", "pods/exec"]
 `),
 		},
 		{

pkg/setup/templates/1.6.go

@@ -152,19 +152,6 @@ current-context: p8s
 users:
   - name: p8s
     username: p8s
-`),
-		},
-		{
-			Name:        "audit.yaml",
-			Destination: ManifestConfig,
-			Content: []byte(`---
-apiVersion: audit.k8s.io/v1beta1
-kind: Policy
-rules:
-- level: Metadata
-  resources:
-  - group: ""
-    resources: ["pods/log", "pods/exec"]
 `),
 		},
 		{

pkg/setup/templates/1.7.go

@@ -150,19 +150,6 @@ current-context: p8s
 users:
   - name: p8s
     username: p8s
-`),
-		},
-		{
-			Name:        "audit.yaml",
-			Destination: ManifestConfig,
-			Content: []byte(`---
-apiVersion: audit.k8s.io/v1beta1
-kind: Policy
-rules:
-- level: Metadata
-  resources:
-  - group: ""
-    resources: ["pods/log", "pods/exec"]
 `),
 		},
 		{

pkg/setup/templates/1.8.go

@@ -78,7 +78,7 @@ ExecStart={{.RootABSPath}}/bin/hyperkube apiserver \
 	--default-watch-cache-size=0 \
 	--watch-cache-sizes="" \
 	--deserialization-cache-size=0 \
-	--audit-log-path=- \
+	--audit-log-path={{.RootABSPath}}/logs/audit.log \
 	--audit-policy-file={{.RootABSPath}}/manifest-config/audit.yaml \
 	--event-ttl=10m \
 
@@ -165,7 +165,7 @@ rules:
 - level: Metadata
   resources:
   - group: ""
-    resources: ["pods/log", "pods/exec"]
+    resources: ["*"]
 `),
 		},
 		{

pkg/setup/templates/1.9.go

@@ -77,7 +77,7 @@ ExecStart={{.RootABSPath}}/bin/hyperkube apiserver \
 	--default-watch-cache-size=0 \
 	--watch-cache-sizes="" \
 	--deserialization-cache-size=0 \
-	--audit-log-path=- \
+	--audit-log-path={{.RootABSPath}}/logs/audit.log \
 	--audit-policy-file={{.RootABSPath}}/manifest-config/audit.yaml \
 	--event-ttl=10m \
 
@@ -164,7 +164,7 @@ rules:
 - level: Metadata
   resources:
   - group: ""
-    resources: ["pods/log", "pods/exec"]
+    resources: ["*"]
 `),
 		},
 		{