10BC0 Add handling of mutiple log destinations · nginx/kubernetes-ingress@cb0dfaa · GitHub
[go: up one dir, main page]
Skip to content

Commit cb0dfaa

Browse files
author
Rafal Wegrzycki
committed
Add handling of mutiple log destinations
1 parent 3a13609 commit cb0dfaa

File tree

21 files changed

+466
-57
lines changed

21 files changed

+466
-57
lines changed

‎deployments/common/crds/k8s.nginx.org_policies.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -156,6 +156,18 @@ spec:
156156
type: boolean
157157
logDest:
158158
type: string
159+
securityLogs:
160+
type: array
161+
items:
162+
description: SecurityLog defines the security log of a WAF policy.
163+
type: object
164+
properties:
165+
apLogConf:
166+
type: string
167+
enable:
168+
type: boolean
169+
logDest:
170+
type: string
159171
status:
160172
description: PolicyStatus is the status of the policy resource
161173
type: object

‎deployments/helm-chart/crds/k8s.nginx.org_policies.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -156,6 +156,18 @@ spec:
156156
type: boolean
157157
logDest:
158158
type: string
159+
securityLogs:
160+
type: array
161+
items:
162+
description: SecurityLog defines the security log of a WAF policy.
163+
type: object
164+
properties:
165+
apLogConf:
166+
type: string
167+
enable:
168+
type: boolean
169+
logDest:
170+
type: string
159171
status:
160172
description: PolicyStatus is the status of the policy resource
161173
type: object

‎docs/content/configuration/policy-resource.md‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -355,17 +355,20 @@ For `kubectl get` and similar commands, you can also use the short name `pol` in
355355

356356
The WAF policy configures NGINX Plus to secure client requests using App Protect policies.
357357

358-
For example, the following policy will enable the referenced APPolicy and APLogConf with the configured log destination:
358+
For example, the following policy will enable the referenced APPolicy. You can configure multiple APLogConfs with log destinations:
359359
```yaml
360360
waf:
361361
enable: true
362362
apPolicy: "default/dataguard-alarm"
363-
securityLog:
364-
enable: true
363+
securityLogs:
364+
- enable: true
365365
apLogConf: "default/logconf"
366366
logDest: "syslog:server=syslog-svc.default:514"
367+
- enable: true
368+
apLogConf: "default/logconf"
369+
logDest: "syslog:server=syslog-svc-secondary.default:514"
367370
```
368-
371+
> Note: The field `waf.securityLog` is deprecated and will be removed in future releases.It will be ignored if `waf.securityLogs` is populated.
369372
> Note: The feature is implemented using the NGINX Plus [NGINX App Protect Module](https://docs.nginx.com/nginx-app-protect/configuration/).
370373

371374
{{% table %}}

‎examples/custom-resources/waf/waf.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ spec:
66
waf:
77
enable: true
88
apPolicy: "default/dataguard-alarm"
9-
securityLog:
10-
enable: true
9+
securityLogs:
10+
- enable: true
1111
apLogConf: "default/logconf"
1212
logDest: "syslog:server=syslog-svc.default:514"

‎internal/configs/configurator.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -125,7 +125,8 @@ type Configurator struct {
125125
// NewConfigurator creates a new Configurator.
126126
func NewConfigurator(nginxManager nginx.Manager, staticCfgParams *StaticConfigParams, config *ConfigParams,
127127
templateExecutor *version1.TemplateExecutor, templateExecutorV2 *version2.TemplateExecutor, isPlus bool, isWildcardEnabled bool,
128-
labelUpdater collector.LabelUpdater, isPrometheusEnabled bool, latencyCollector latCollector.LatencyCollector, isLatencyMetricsEnabled bool) *Configurator {
128+
labelUpdater collector.LabelUpdater, isPrometheusEnabled bool, latencyCollector latCollector.LatencyCollector, isLatencyMetricsEnabled bool,
129+
) *Configurator {
129130
metricLabelsIndex := &metricLabelsIndex{
130131
ingressUpstreams: make(map[string][]string),
131132
virtualServerUpstreams: make(map[string][]string),
@@ -1444,7 +1445,6 @@ func (cnf *Configurator) DeleteAppProtectLogConf(resource *unstructured.Unstruct
14441445
func (cnf *Configurator) RefreshAppProtectUserSigs(
14451446
userSigs []*unstructured.Unstructured, delPols []string, ingExes []*IngressEx, mergeableIngresses []*MergeableIngresses, vsExes []*VirtualServerEx,
14461447
) (Warnings, error) {
1447-
14481448
allWarnings, err := cnf.addOrUpdateIngressesAndVirtualServers(ingExes, mergeableIngresses, vsExes)
14491449
if err != nil {
14501450
return allWarnings, err

‎internal/configs/ingress.go‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,8 @@ type MergeableIngresses struct {
7676
}
7777

7878
func generateNginxCfg(ingEx *IngressEx, apResources *AppProtectResources, dosResource *appProtectDosResource, isMinion bool,
79-
baseCfgParams *ConfigParams, isPlus bool, isResolverConfigured bool, staticParams *StaticConfigParams, isWildcardEnabled bool) (version1.IngressNginxConfig, Warnings) {
79+
baseCfgParams *ConfigParams, isPlus bool, isResolverConfigured bool, staticParams *StaticConfigParams, isWildcardEnabled bool,
80+
) (version1.IngressNginxConfig, Warnings) {
8081
hasAppProtect := staticParams.MainAppProtectLoadModule
8182
hasAppProtectDos := staticParams.MainAppProtectDosLoadModule
8283

@@ -290,7 +291,8 @@ func generateNginxCfg(ingEx *IngressEx, apResources *AppProtectResources, dosRes
290291
}
291292

292293
func generateJWTConfig(owner runtime.Object, secretRefs map[string]*secrets.SecretReference, cfgParams *ConfigParams,
293-
redirectLocationName string) (*version1.JWTAuth, *version1.JWTRedirectLocation, Warnings) {
294+
redirectLocationName string,
295+
) (*version1.JWTAuth, *version1.JWTRedirectLocation, Warnings) {
294296
warnings := newWarnings()
295297

296298
secretRef := secretRefs[cfgParams.JWTKey]
@@ -326,7 +328,8 @@ func generateJWTConfig(owner runtime.Object, secretRefs map[string]*secrets.Secr
326328
}
327329

328330
func addSSLConfig(server *version1.Server, owner runtime.Object, host string, ingressTLS []networking.IngressTLS,
329-
secretRefs map[string]*secrets.SecretReference, isWildcardEnabled bool) Warnings {
331+
secretRefs map[string]*secrets.SecretReference, isWildcardEnabled bool,
332+
) Warnings {
330333
warnings := newWarnings()
331334

332335
var tlsEnabled bool
@@ -427,7 +430,8 @@ func upstreamRequiresQueue(name string, ingEx *IngressEx, cfg *ConfigParams) (n
427430
}
428431

429432
func createUpstream(ingEx *IngressEx, name string, backend *networking.IngressBackend, stickyCookie string, cfg *ConfigParams,
430-
isPlus bool, isResolverConfigured bool, isLatencyMetricsEnabled bool) version1.Upstream {
433+
isPlus bool, isResolverConfigured bool, isLatencyMetricsEnabled bool,
434+
) version1.Upstream {
431435
var ups version1.Upstream
432436
labels := version1.UpstreamLabels{
433437
Service: backend.Service.Name,
@@ -534,8 +538,8 @@ func upstreamMapToSlice(upstreams map[string]version1.Upstream) []version1.Upstr
534538

535539
func generateNginxCfgForMergeableIngresses(mergeableIngs *MergeableIngresses, apResources *AppProtectResources,
536540
dosResource *appProtectDosResource, baseCfgParams *ConfigParams, isPlus bool, isResolverConfigured bool,
537-
staticParams *StaticConfigParams, isWildcardEnabled bool) (version1.IngressNginxConfig, Warnings) {
538-
541+
staticParams *StaticConfigParams, isWildcardEnabled bool,
542+
) (version1.IngressNginxConfig, Warnings) {
539543
var masterServer version1.Server
540544
var locations []version1.Location
541545
var upstreams []version1.Upstream

‎internal/configs/version1/templates_test.go‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,6 @@ var (
3939
)
4040

4141
var ingCfg = IngressNginxConfig{
42-
4342
Servers: []Server{
4443
{
4544
Name: "test.example.com",

‎internal/configs/version2/http.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -123,7 +123,7 @@ type WAF struct {
123123
Enable string
124124
ApPolicy string
125125
ApSecurityLogEnable bool
126-
ApLogConf string
126+
ApLogConf []string
127127
}
128128

129129
// Dos defines Dos configuration.

‎internal/configs/version2/nginx-plus.virtualserver.tmpl‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -191,7 +191,9 @@ server {
191191

192192
{{ if .ApSecurityLogEnable }}
193193
app_protect_security_log_enable on;
194-
app_protect_security_log {{ .ApLogConf }};
194+
{{ range $logconf := .ApLogConf }}
195+
app_protect_security_log {{ $logconf }};
196+
{{ end }}
195197
{{ end }}
196198
{{ end }}
197199

@@ -370,7 +372,9 @@ server {
370372

371373
{{ if .ApSecurityLogEnable }}
372374
app_protect_security_log_enable on;
373-
app_protect_security_log {{ .ApLogConf }};
375+
{{ range $logconf := .ApLogConf }}
376+
app_protect_security_log {{ $logconf }};
377+
{{ end }}
374378
{{ end }}
375379
{{ end }}
376380

‎internal/configs/version2/templates_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -150,7 +150,7 @@ var virtualServerCfg = VirtualServerConfig{
150150
WAF: &WAF{
151151
ApPolicy: "/etc/nginx/waf/nac-policies/default-dataguard-alarm",
152152
ApSecurityLogEnable: true,
153-
ApLogConf: "/etc/nginx/waf/nac-logconfs/default-logconf",
153+
ApLogConf: []string{"/etc/nginx/waf/nac-logconfs/default-logconf"},
154154
},
155155
Snippets: []string{"# server snippet"},
156156
InternalRedirectLocations: []InternalRedirectLocation{

0 commit comments

Comments
 (0)
0