chore: 🤖 move all modsec logging here

ministryofjustice · Dec 20, 2023 · 381508e · 381508e
1 parent ab22b9f
commit 381508e
Show file tree

Hide file tree

Showing 2 changed files with 84 additions and 2 deletions.
diff --git a/configmap.tf b/configmap.tf
@@ -12,7 +12,7 @@ resource "kubernetes_config_map" "fluent-bit-config" {
     "fluent-bit.conf" = <<-EOT
     [SERVICE]
         Flush                             1
-        Log_Level                         info
+        Log_Level                         debug
         Daemon                            Off
         Grace                             30
         Parsers_File                      parsers.conf
@@ -54,6 +54,47 @@ resource "kubernetes_config_map" "fluent-bit-config" {
         Storage.type                      filesystem
         Storage.pause_on_chunks_overlimit True
 
+    [INPUT]
+        Name                              tail
+        Alias                             modsec_nginx_ingress_stdout
+        Tag                               cp-ingress-modsec-stdout.*
+        Path                              /var/log/containers/*nginx-ingress-modsec-controller*_ingress-controllers_controller-*.log
+        Parser                            cri-containerd
+        Refresh_Interval                  5
+        Buffer_Max_Size                   5MB
+        Buffer_Chunk_Size                 1M
+        Offset_Key                        pause_position_modsec_stdout
+        DB                                cp-ingress-modsec-stdout.db
+        DB.locking                        true
+        Storage.type                      filesystem
+        Storage.pause_on_chunks_overlimit True
+
+    [FILTER]
+        Name                grep
+        Match               cp-ingress-modsec-stdout.*
+        regex               log (ModSecurity-nginx|modsecurity|OWASP_CRS|owasp-modsecurity-crs)
+
+    [FILTER]
+        Name                kubernetes
+        Alias               modsec_nginx_ingress_stdout
+        Match               cp-ingress-modsec-stdout.*
+        Kube_Tag_Prefix     cp-ingress-modsec-stdout.var.log.containers.
+        Kube_URL            https://kubernetes.default.svc:443
+        Kube_CA_File        /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+        Kube_Token_File     /var/run/secrets/kubernetes.io/serviceaccount/token
+        K8S-Logging.Parser  On
+        K8S-Logging.Exclude On
+        Keep_Log            On
+        Merge_Log           On
+        Merge_Log_Key       log_processed
+        Buffer_Size         1MB
+
+    [FILTER]
+        Name                              lua
+        Match                             cp-ingress-modsec-stdout.*
+        script                            /fluent-bit/scripts/cb_extract_tag_value.lua
+        call                              cb_extract_tag_value
+
     [FILTER]
         Name                              lua
         Match                             cp-ingress-modsec-audit.*
@@ -100,6 +141,14 @@ resource "kubernetes_config_map" "fluent-bit-config" {
         Format       json
         Time_Key     time
         Time_Keep    On
+    # CRI-containerd Parser
+    [PARSER]
+        # https://rubular.com/r/DjPmoX5HnQMesk
+        Name cri-containerd
+        Format regex
+        Regex ^(?<time>[^ ]+) (?<stream>stdout|stderr) (?<logtag>[^ ]*) (?<log>.*)$
+        Time_Key    time
+        Time_Format %Y-%m-%dT%H:%M:%S.%L%z
 
     [PARSER]
         Name         generic-json

diff --git a/templates/values.yaml.tpl b/templates/values.yaml.tpl
@@ -21,6 +21,18 @@ controller:
     - name: logrotate-config
       configMap:
         name: logrotate-config
+    - hostPath:
+        path: /var/log
+        type: ""
+      name: varlog
+    - hostPath:
+        path: /var/lib/docker/containers
+        type: ""
+      name: varlibdockercontainers
+    - hostPath:
+        path: /etc/machine-id
+        type: File
+      name: etcmachineid
 
   extraVolumeMounts:
   ## Additional volumeMounts to the controller main container.
@@ -49,7 +61,9 @@ controller:
         mountPath: /var/log/audit
 
   extraContainers:
-    - name: flb-modsec-audit-logs
+    - name: flb-modsec-logs
+      securityContext:
+        runAsGroup: 0
       image: fluent/fluent-bit:${fluent_bit_version}
       volumeMounts:
       - name: fluent-bit-config
@@ -58,6 +72,14 @@ controller:
         mountPath: /fluent-bit/scripts/
       - name: logs-volume
         mountPath: /var/log/audit/
+      - mountPath: /var/log/
+        name: varlog
+      - mountPath: /var/lib/docker/containers
+        name: varlibdockercontainers
+        readOnly: true
+      - mountPath: /etc/machine-id
+        name: etcmachineid
+        readOnly: true
     - name: logrotate
       securityContext:
         runAsGroup: 82
@@ -74,6 +96,17 @@ controller:
           service cron start
           sleep infinity 
       volumeMounts:
+      - name: logs-volume
+        mountPath: /var/log/audit/
+      - mountPath: /var/log/
+        name: varlog
+      - mountPath: /var/lib/docker/containers
+        name: varlibdockercontainers
+        readOnly: true
+      - mountPath: /etc/machine-id
+        name: etcmachineid
+        readOnly: true
+
       - name: logrotate-config
         mountPath: /home
       - name: logs-volume