From 381508eb6c55469a31cc48bfdddfcc954bb614f4 Mon Sep 17 00:00:00 2001
From: jaskaransarkaria <jaskaran.sarkaria@digital.justice.gov.uk>
Date: Wed, 20 Dec 2023 08:06:34 +0000
Subject: [PATCH 1/2] =?UTF-8?q?chore:=20=F0=9F=A4=96=20move=20all=20modsec?=
 =?UTF-8?q?=20logging=20here?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 configmap.tf              | 51 ++++++++++++++++++++++++++++++++++++++-
 templates/values.yaml.tpl | 35 ++++++++++++++++++++++++++-
 2 files changed, 84 insertions(+), 2 deletions(-)

diff --git a/configmap.tf b/configmap.tf
index 59b5581..3afab11 100644
--- a/configmap.tf
+++ b/configmap.tf
@@ -12,7 +12,7 @@ resource "kubernetes_config_map" "fluent-bit-config" {
     "fluent-bit.conf" = <<-EOT
     [SERVICE]
         Flush                             1
-        Log_Level                         info
+        Log_Level                         debug
         Daemon                            Off
         Grace                             30
         Parsers_File                      parsers.conf
@@ -54,6 +54,47 @@ resource "kubernetes_config_map" "fluent-bit-config" {
         Storage.type                      filesystem
         Storage.pause_on_chunks_overlimit True
 
+    [INPUT]
+        Name                              tail
+        Alias                             modsec_nginx_ingress_stdout
+        Tag                               cp-ingress-modsec-stdout.*
+        Path                              /var/log/containers/*nginx-ingress-modsec-controller*_ingress-controllers_controller-*.log
+        Parser                            cri-containerd
+        Refresh_Interval                  5
+        Buffer_Max_Size                   5MB
+        Buffer_Chunk_Size                 1M
+        Offset_Key                        pause_position_modsec_stdout
+        DB                                cp-ingress-modsec-stdout.db
+        DB.locking                        true
+        Storage.type                      filesystem
+        Storage.pause_on_chunks_overlimit True
+
+    [FILTER]
+        Name                grep
+        Match               cp-ingress-modsec-stdout.*
+        regex               log (ModSecurity-nginx|modsecurity|OWASP_CRS|owasp-modsecurity-crs)
+
+    [FILTER]
+        Name                kubernetes
+        Alias               modsec_nginx_ingress_stdout
+        Match               cp-ingress-modsec-stdout.*
+        Kube_Tag_Prefix     cp-ingress-modsec-stdout.var.log.containers.
+        Kube_URL            https://kubernetes.default.svc:443
+        Kube_CA_File        /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+        Kube_Token_File     /var/run/secrets/kubernetes.io/serviceaccount/token
+        K8S-Logging.Parser  On
+        K8S-Logging.Exclude On
+        Keep_Log            On
+        Merge_Log           On
+        Merge_Log_Key       log_processed
+        Buffer_Size         1MB
+
+    [FILTER]
+        Name                              lua
+        Match                             cp-ingress-modsec-stdout.*
+        script                            /fluent-bit/scripts/cb_extract_tag_value.lua
+        call                              cb_extract_tag_value
+
     [FILTER]
         Name                              lua
         Match                             cp-ingress-modsec-audit.*
@@ -100,6 +141,14 @@ resource "kubernetes_config_map" "fluent-bit-config" {
         Format       json
         Time_Key     time
         Time_Keep    On
+    # CRI-containerd Parser
+    [PARSER]
+        # https://rubular.com/r/DjPmoX5HnQMesk
+        Name cri-containerd
+        Format regex
+        Regex ^(?<time>[^ ]+) (?<stream>stdout|stderr) (?<logtag>[^ ]*) (?<log>.*)$
+        Time_Key    time
+        Time_Format %Y-%m-%dT%H:%M:%S.%L%z
 
     [PARSER]
         Name         generic-json
diff --git a/templates/values.yaml.tpl b/templates/values.yaml.tpl
index 07c7a7e..71fcdb8 100644
--- a/templates/values.yaml.tpl
+++ b/templates/values.yaml.tpl
@@ -21,6 +21,18 @@ controller:
     - name: logrotate-config
       configMap:
         name: logrotate-config
+    - hostPath:
+        path: /var/log
+        type: ""
+      name: varlog
+    - hostPath:
+        path: /var/lib/docker/containers
+        type: ""
+      name: varlibdockercontainers
+    - hostPath:
+        path: /etc/machine-id
+        type: File
+      name: etcmachineid
 
   extraVolumeMounts:
   ## Additional volumeMounts to the controller main container.
@@ -49,7 +61,9 @@ controller:
         mountPath: /var/log/audit
 
   extraContainers:
-    - name: flb-modsec-audit-logs
+    - name: flb-modsec-logs
+      securityContext:
+        runAsGroup: 0
       image: fluent/fluent-bit:${fluent_bit_version}
       volumeMounts:
       - name: fluent-bit-config
@@ -58,6 +72,14 @@ controller:
         mountPath: /fluent-bit/scripts/
       - name: logs-volume
         mountPath: /var/log/audit/
+      - mountPath: /var/log/
+        name: varlog
+      - mountPath: /var/lib/docker/containers
+        name: varlibdockercontainers
+        readOnly: true
+      - mountPath: /etc/machine-id
+        name: etcmachineid
+        readOnly: true
     - name: logrotate
       securityContext:
         runAsGroup: 82
@@ -74,6 +96,17 @@ controller:
           service cron start
           sleep infinity 
       volumeMounts:
+      - name: logs-volume
+        mountPath: /var/log/audit/
+      - mountPath: /var/log/
+        name: varlog
+      - mountPath: /var/lib/docker/containers
+        name: varlibdockercontainers
+        readOnly: true
+      - mountPath: /etc/machine-id
+        name: etcmachineid
+        readOnly: true
+
       - name: logrotate-config
         mountPath: /home
       - name: logs-volume

From a75fafb18db85d0b8aadf0789bc517d64a5afbe6 Mon Sep 17 00:00:00 2001
From: jaskaransarkaria <jaskaran.sarkaria@digital.justice.gov.uk>
Date: Thu, 21 Dec 2023 08:17:09 +0000
Subject: [PATCH 2/2] =?UTF-8?q?fixup!=20chore:=20=F0=9F=A4=96=20move=20all?=
 =?UTF-8?q?=20modsec=20logging=20here?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 configmap.tf              | 23 +----------------------
 templates/values.yaml.tpl |  8 --------
 2 files changed, 1 insertion(+), 30 deletions(-)

diff --git a/configmap.tf b/configmap.tf
index 3afab11..24745b6 100644
--- a/configmap.tf
+++ b/configmap.tf
@@ -12,7 +12,7 @@ resource "kubernetes_config_map" "fluent-bit-config" {
     "fluent-bit.conf" = <<-EOT
     [SERVICE]
         Flush                             1
-        Log_Level                         debug
+        Log_Level                         info
         Daemon                            Off
         Grace                             30
         Parsers_File                      parsers.conf
@@ -24,21 +24,6 @@ resource "kubernetes_config_map" "fluent-bit-config" {
         Storage.max_chunks_up             64
         Storage.backlog.mem_limit         5MB
 
-    [INPUT]
-        Name                              tail
-        Alias                             modsec_nginx_ingress_audit_index
-        Tag                               cp-ingress-modsec-index-audit.*
-        Path                              /var/log/audit/*.log
-        Parser                            modsec-audit-log-index
-        Refresh_Interval                  5
-        Buffer_Max_Size                   5MB
-        Buffer_Chunk_Size                 1M
-        Offset_Key                        pause_position_modsec-audit-index
-        DB                                cp-ingress-modsec-audit-index.db
-        DB.locking                        true
-        Storage.type                      filesystem
-        Storage.pause_on_chunks_overlimit True
-
     [INPUT]
         Name                              tail
         Alias                             modsec_nginx_ingress_audit
@@ -130,12 +115,6 @@ resource "kubernetes_config_map" "fluent-bit-config" {
       EOT
 
     "custom_parsers.conf" = <<-EOT
-    [PARSER]
-        Name modsec-audit-log-index
-        Format regex
-        Regex ^(?<url>[^ ]+) (?<client_ip>[^ ]+) (?<log>.*)$
-        Time_Key    time
-        Time_Format %d/%m/%Y:T%H:%M:%S.%z
     [PARSER]
         Name         initial-json
         Format       json
diff --git a/templates/values.yaml.tpl b/templates/values.yaml.tpl
index 71fcdb8..046b51a 100644
--- a/templates/values.yaml.tpl
+++ b/templates/values.yaml.tpl
@@ -98,14 +98,6 @@ controller:
       volumeMounts:
       - name: logs-volume
         mountPath: /var/log/audit/
-      - mountPath: /var/log/
-        name: varlog
-      - mountPath: /var/lib/docker/containers
-        name: varlibdockercontainers
-        readOnly: true
-      - mountPath: /etc/machine-id
-        name: etcmachineid
-        readOnly: true
 
       - name: logrotate-config
         mountPath: /home