Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add pod logs #350

Merged
merged 6 commits into from
Oct 25, 2022
Merged

Add pod logs #350

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
8a84467
Add explicit entry for pods/log to the read only role
mproffitt Oct 21, 2022
8485c2b
missing commas in struct init
mproffitt Oct 21, 2022
96fafd8
Extend nancy for 2 months
mproffitt Oct 21, 2022
ed8b5bc
add cves to nancy
mproffitt Oct 21, 2022
ef1ff33
add missed cve to nancy
mproffitt Oct 21, 2022
9b52125
Update changelog to include description of effort
mproffitt Oct 21, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 14 additions & 6 deletions .nancy-ignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,19 @@
# Nancy found vulns for consul api 1.12.0 -> no new version
CVE-2022-29153 until=2022-09-30
CVE-2022-24687 until=2022-09-30
CVE-2022-29153 until=2022-11-30
CVE-2022-24687 until=2022-11-30
CVE-2021-41803 until=2022-11-30
# kataras/iris/[email protected] -> no new version
CVE-2021-23772 until=2022-09-30
CVE-2021-23772 until=2022-11-30
# github.com/valyala/fasthttp
CVE-2022-21221 until=2022-06-30
CVE-2022-21221 until=2022-11-30
# github.com/microcosm-cc/bluemonday
CVE-2021-42576 until=2022-06-30
CVE-2021-42576 until=2022-11-30
# nats server
CVE-2022-42708 until=2022-11-30
CVE-2022-42709 until=2022-11-30
# x/text
CVE-2022-32149 until=2022-11-30
# github.com/urfave/negroni
sonatype-2021-1485 until=2022-09-30
sonatype-2021-1485 until=2022-11-30
sonatype-2022-5436 until=2022-11-30

4 changes: 3 additions & 1 deletion CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

## [Unreleased]

- Extend readonly ClusterRole to include pods/log so customers can debug failures on the management clusters.

## [0.30.2] - 2022-08-11

### Changed
Expand All @@ -29,7 +31,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

### Added

- Add write-silences for flux automation account in every org-namespace
- Add write-silences for flux automation account in every org-namespace

## [0.28.1] - 2022-05-18

Expand Down
9 changes: 9 additions & 0 deletions service/internal/bootstrap/resources.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,6 +98,15 @@ func (b *Bootstrap) createReadAllClusterRole(ctx context.Context) error {
}
policyRules = append(policyRules, policyRule)
}
// ServerPreferredResources explicitely ignores any resource containing a '/'
// but we require this for enabling pods/logs for customer access to
// kubernetes pod logging. This is appended as a specific rule instead.
policyRule := rbacv1.PolicyRule{
APIGroups: []string{""},
Resources: []string{"pods/log"},
Verbs: []string{"get", "list"},
}
policyRules = append(policyRules, policyRule)
}
}

Expand Down