Feat/vault audit otlp

Provisioning/Vault/audit.tf

@@ -1,7 +1,17 @@
-resource "vault_audit" "file" {
+resource "vault_audit" "stdout" {
   type = "file"
 
   options = {
     file_path = "stdout"
   }
-}
+}
+
+resource "vault_audit" "otel" {
+  type  = "socket"
+  path  = "otel_socket"
+
+  options = {
+    address     = "opentelemetry-collector.otlp.svc.cluster.local:54525"
+    socket_type = "tcp"
+  }
+}

USAGE.md

@@ -20,11 +20,9 @@ export VAULT_K8S_NAMESPACE=<your namespace>
 ### 4.1. Minikube
 Run the following commands to enable ingress:
 ```bash
-
 minikube addons enable ingress
-
-kubectl patch deployment -n ingress-nginx ingress-nginx-controller --type='json' -p='[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value":"--enable-ssl-passthrough"}]'
 ```
+
 ### 4.2. Kind
 [Deploy Metallb](https://kind.sigs.k8s.io/docs/user/loadbalancer) to use an IP in the Docker network (below assumes range `172.19.255.200 - 172.19.255.250`) for load balancing purposes:
 
@@ -44,28 +42,31 @@ kubectl patch svc -n ingress-nginx ingress-nginx-controller --type='json' -p='[{
 
 # remove --publish-status-address=localhost, don't set loadbalancer status to localhost (will use IP of ingress)
 kubectl patch deployment -n ingress-nginx ingress-nginx-controller --type='json' -p='[{"op": "remove", "path": "/spec/template/spec/containers/0/args/9"}]'
+```
 
+## 5. Enable SSL passthrough
+```bash
 # enable ssl passthrough
 kubectl patch deployment -n ingress-nginx ingress-nginx-controller --type='json' -p='[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value":"--enable-ssl-passthrough"}]'
 ```
 
-## 5. Deploy Vault
+## 6. Deploy Vault
 Run the following commands to deploy Vault:
 ```bash
 cd Vault-Deployment
 terraform init
 terraform apply
 ```
 
-## 6. Unseal Vault
+## 7. Unseal Vault
 Run the following commands to unseal Vault:
 ```bash
 kubectl exec -n vault vault-0 -- vault operator init -key-shares=1 -key-threshold=1 -format=json > ./cluster-keys.json
 kubectl exec -n vault vault-0 -- vault operator unseal $(cat ./cluster-keys.json | jq -r ".unseal_keys_b64[]")
 kubectl exec -n vault vault-1 -- vault operator unseal $(cat ./cluster-keys.json | jq -r ".unseal_keys_b64[]")
 kubectl exec -n vault vault-2 -- vault operator unseal $(cat ./cluster-keys.json | jq -r ".unseal_keys_b64[]")
 ```
-## 7. Login to Vault
+## 8. Login to Vault
 Run the following commands to login to Vault:
 ```bash
 ./add-to-hosts.sh
@@ -79,7 +80,7 @@ export VAULT_SKIP_VERIFY=true
 vault login $VAULT_TOKEN
 ```
 
-## 8. Create token for Prometheus
+## 9. Create token for Prometheus
 
 The Vault /sys/metrics endpoint is authenticated. Prometheus requires a Vault token with sufficient capabilities to successfully consume metrics from the endpoint.
 
@@ -117,11 +118,11 @@ Now restart the Prometheus pod to pick up the new token.
 kubectl delete pod prometheus-kube-stack-prometheus-kube-prometheus-0
 ```
 
-## 9. Access Playground
+## 10. Access Playground
 
 Go to http://explore.playground.lab/ to get an overview over all applications.
 
-## 10. Provisioning Vault
+## 11. Provisioning Vault
 
 Export the Vault token to the environment variable `TF_VAR_VAULT_TOKEN`:
 ```bash

Vault-Deployment/helm-install.tf

@@ -68,6 +68,7 @@ resource "helm_release" "prometheus-grafana" {
   chart      = "kube-prometheus-stack"
   namespace  = var.namespace
   version    = "44.2.1"
+  wait      = false
 
   values = [
     file("./values/kube-prometheus-stack-values.yaml")
@@ -86,6 +87,45 @@ resource "helm_release" "prometheus-grafana" {
 
 }
 
+resource "helm_release" "loki" {
+  name             = "loki"
+  repository       = "https://grafana.github.io/helm-charts"
+  chart            = "loki"
+  version          = "5.39.0"
+  create_namespace = true
+  namespace        = "loki"
+  wait             = false
+  values = [
+    file("./values/loki.yaml")
+  ]
+}
+
+resource "helm_release" "promtail" {
+  name             = "promtail"
+  repository       = "https://grafana.github.io/helm-charts"
+  chart            = "promtail"
+  version          = "6.15.3"
+  create_namespace = true
+  namespace        = "promtail"
+  wait             = false
+  values = [
+    file("./values/promtail.yaml")
+  ]
+}
+
+resource "helm_release" "opentelemetry-collector" {
+  name             = "opentelemetry-collector"
+  repository       = "https://open-telemetry.github.io/opentelemetry-helm-charts"
+  chart            = "opentelemetry-collector"
+  version          = "0.76.0"
+  create_namespace = true
+  namespace        = "otlp"
+  wait             = false
+  values = [
+    file("./values/otlp.yaml")
+  ]
+}
+
 
 resource "helm_release" "open-ldap" {
   name       = "openldap-stack-ha"

Vault-Deployment/values/kube-prometheus-stack-values.yaml

@@ -867,7 +867,7 @@ grafana:
 
   ## Configure additional grafana datasources (passed through tpl)
   ## ref: http://docs.grafana.org/administration/provisioning/#datasources
-  additionalDataSources: []
+  additionalDataSources:
   # - name: prometheus-sample
   #   access: proxy
   #   basicAuth: true
@@ -881,6 +881,28 @@ grafana:
   #   url: https://{{ printf "%s-prometheus.svc" .Release.Name }}:9090
   #   version: 1
 
+  # https://grafana.com/docs/grafana/latest/datasources/loki
+  - name: Promtail
+    type: loki
+    access: proxy
+    url: http://loki.loki.svc.cluster.local:3100
+    orgId: 1
+    jsonData:
+      maxLines: 1000
+      httpHeaderName1: "X-Scope-OrgID"
+    secureJsonData:
+      httpHeaderValue1: "promtail"
+  - name: Vault Audit Log
+    type: loki
+    access: proxy
+    url: http://loki.loki.svc.cluster.local:3100
+    orgId: 1
+    jsonData:
+      maxLines: 1000
+      httpHeaderName1: "X-Scope-OrgID"
+    secureJsonData:
+      httpHeaderValue1: "vault-audit"
+
   ## Passed to grafana subchart and used by servicemonitor below
   ##
   service:

Vault-Deployment/values/loki.yaml

@@ -0,0 +1,16 @@
+---
+# https://grafana.com/docs/loki/latest/setup/install/helm/install-monolithic
+loki:
+  commonConfig:
+    replication_factor: 1
+  storage:
+    type: 'filesystem'
+  analytics:
+    reporting_enabled: false
+  # https://grafana.com/docs/loki/latest/operations/multi-tenancy
+  # Loki defaults to running in multi-tenant mode. Multi-tenant mode
+  # is set in the configuration with auth_enabled: true.
+  auth_enabled: true
+
+singleBinary:
+  replicas: 1

Vault-Deployment/values/otlp.yaml

@@ -0,0 +1,25 @@
+---
+mode: "deployment"
+replicaCount: 1
+config:
+  receivers:
+    tcplog:
+      listen_address: "0.0.0.0:54525"
+  exporters:
+    loki:
+      endpoint: "http://loki.loki.svc.cluster.local:3100/loki/api/v1/push"
+      headers:
+      # Send everything to the vault-audit tenant_id
+      # https://grafana.com/docs/loki/latest/operations/multi-tenancy
+        "X-Scope-OrgID": vault-audit
+  service:
+    pipelines:
+      logs:
+        receivers: [tcplog]
+        exporters: [loki]
+ports:
+  tcplog:
+    enabled: true
+    containerPort: 54525
+    servicePort: 54525
+    protocol: TCP

Vault-Deployment/values/promtail.yaml

@@ -0,0 +1,6 @@
+config:
+  clients:
+    - url: http://loki.loki.svc.cluster.local:3100/loki/api/v1/push
+      # Send everything to the promtail tenant_id
+      # https://grafana.com/docs/loki/latest/operations/multi-tenancy
+      tenant_id: promtail