Skip to content

Commit

Permalink
updating docs
Browse files Browse the repository at this point in the history
Signed-off-by: Jaydip Gabani <gabanijaydip@gmail.com>
  • Loading branch information
JaydipGabani committed Dec 10, 2024
1 parent 6f82df9 commit 07c07ac
Show file tree
Hide file tree
Showing 5 changed files with 118 additions and 79 deletions.
10 changes: 5 additions & 5 deletions website/docs/audit.md
Original file line number Diff line number Diff line change
Expand Up @@ -133,14 +133,14 @@ In addition to violations, these other audit events may be useful (all uniquely
All of these events (including `violation_audited`) are marked
with the same `audit_id` for a given audit run.

### Pubsub channel
### Export violations

This feature uses publish and subscribe (pubsub) model that allows Gatekeeper to export audit violations over a broker that can be consumed by a subscriber independently. Therefore, pubsub violations are not subject to reporting limits. Please refer to [this](pubsub.md) guide to configure audit to push violations over a channel.
This feature allows plugging in different backends that allows Gatekeeper to export audit violations. Therefore, violations are not subject to reporting limits. Please refer to [this](export.md) guide to configure audit to push violations via this feature.

Limitations/drawbacks of getting violations using pubsub channel:
Limitations/drawbacks of exporting violations:

- There is an inherent risk of messages getting dropped. You might not receive all the published violations.
- Additional dependency on pubsub broker.
- There is a risk of messages getting dropped. You might not receive all the exported violations. This depends on the type of backend you are using for delivery. For example, using a network as backend to export violation has the risk of messages getting dropped.
- Additional dependency depending on what is plugged in. For example, using pubsub tools to export violations.

## Running Audit
For more details on how to deploy audit and
Expand Down
100 changes: 100 additions & 0 deletions website/docs/export-driver-walkthrough.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,100 @@
---
id: export-driver
title: Export Interface/Driver walkthrough
---

This guide provides an overview of the driver interface, including details of its structure and functionality. Additionally, it offers instructions on adding a new driver and utilizing different backends to export violations.

## Driver interface

```go
type Driver interface {
// Publish publishes single message with specific subject using a connection
Publish(ctx context.Context, connectionName string, data interface{}, subject string) error

// CloseConnection closes a connection
CloseConnection(connectionName string) error

// UpdateConnection updates an existing connection
UpdateConnection(ctx context.Context, connectionName string, config interface{}) error

// CreateConnection creates new connection
CreateConnection(ctx context.Context, connectionName string, config interface{}) error
}
```

As an example, the Dapr driver implements these methods to publish message and manage connection to do so. Please refer to [dapr.go](https://github.com/open-policy-agent/gatekeeper/blob/master/pkg/export/dapr/dapr.go) to understand the logic that goes in each of these methods.

### How to add new driver to export violations to foo backend

A driver must maintain a map of open connections associated with backend `foo`.

```go
type Connection struct {
// properties needed for individual connection
}

type Foo struct {
openConnections map[string]Connection
}

const (
Name = "foo"
)

var Connections = &Foo{
openConnections: make(map[string]Connection),
}

```

A driver must implement the `Driver` interface.

```go
func (r *Foo) Publish(ctx context.Context, connectionName string, data interface{}, subject string) error {
...
}

func (r *Foo) loseConnection(connectionName string) error {
...
}

func (r *Foo) UpdateConnection(ctx context.Context, connectionName string, config interface{}) error {
...
}

func (r *Foo) CreateConnection(ctx context.Context, connectionName string, config interface{}) error {
...
}
```

This newly added driver's `Connections` exported variable must be added to the map of `SupportedDrivers` in [system.go](https://github.com/open-policy-agent/gatekeeper/blob/master/pkg/export/provider/system.go). For example,

```go
var SupportedDrivers = map[string]driver.Driver{
dapr.Name: dapr.Connections,
foo.Name: foo.Connections,
}
```

And thats it! Exporter system will take the newly added driver into account and whenever a configMap to establish connection to export message is created.

### How to establish connections to different backend

To enable audit to use this driver to publish messages, a connection configMap with appropriate `config` and `driver` is needed. For example,

```yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: audit
namespace: gatekeeper-system
data:
driver: "foo"
config: |
{
<config needed for foo connection>
}
```
> The `data.driver` field must exist and must match one of the keys of the `SupportedDrivers` map that was defined earlier to use the corresponding driver. The `data.config` field in the configuration can vary depending on the driver being used. For dapr driver, `data.config` must be `{"component": "pubsub"}`.
22 changes: 11 additions & 11 deletions website/docs/pubsub.md → website/docs/export.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
id: pubsub
title: Consuming violations using Pubsub
id: export
title: Exporting violations
---

`Feature State`: Gatekeeper version v3.13+ (alpha)
Expand All @@ -9,19 +9,19 @@ title: Consuming violations using Pubsub
## Description

This feature pushes audit violations to a pubsub service. Users can subscribe to pubsub service to consume violations.
This feature exports audit violations to a backend from where users can consume violations.

> To gain insights into different methods of obtaining audit violations and the respective trade-offs for each approach, please refer to [Reading Audit Results](audit.md#reading-audit-results).
## Enabling Gatekeeper to export audit violations

Install prerequisites such as a pubsub tool, a message broker etc.

### Setting up audit with pubsub enabled
### Setting up audit to export violations

In the audit deployment, set the `--enable-pub-sub` flag to `true` to publish audit violations. Additionally, use `--audit-connection` (defaults to `audit-connection`) and `--audit-channel`(defaults to `audit-channel`) flags to allow audit to publish violations using desired connection onto desired channel. `--audit-connection` must be set to the name of the connection config, and `--audit-channel` must be set to name of the channel where violations should get published.

A ConfigMap that contains `provider` and `config` fields in `data` is required to establish connection for sending violations over the channel. Following is an example ConfigMap to establish a connection that uses Dapr to publish messages:
A ConfigMap that contains `driver` and `config` fields in `data` is required to establish connection for sending violations over the channel. Following is an example ConfigMap to establish a connection that uses Dapr to publish messages:

```yaml
apiVersion: v1
Expand All @@ -30,20 +30,20 @@ metadata:
name: audit-connection
namespace: gatekeeper-system
data:
provider: "dapr"
driver: "dapr"
config: |
{
"component": "pubsub"
}
```
- `provider` field determines which tool/driver should be used to establish a connection. Valid values are: `dapr`
- `driver` field determines which tool/driver should be used to establish a connection. Valid values are: `dapr`
- `config` field is a json object that configures how the connection is made. E.g. which queue messages should be sent to.

#### Available Pubsub drivers
#### Available drivers
Dapr: https://dapr.io/

### Quick start with publishing violations using Dapr and Redis
### Quick start with exporting violations using Dapr and Redis

#### Prerequisites

Expand Down Expand Up @@ -130,7 +130,7 @@ Dapr: https://dapr.io/
> [!IMPORTANT]
> Please make sure `fake-subscriber` image is built and available in your cluster. Dockerfile to build image for `fake-subscriber` is under [gatekeeper/test/fake-subscriber](https://github.com/open-policy-agent/gatekeeper/tree/master/test/pubsub/fake-subscriber).

#### Configure Gatekeeper with Pubsub enabled
#### Configure Gatekeeper with Export enabled

1. Create Gatekeeper namespace, and create Dapr pubsub component and Redis secret in Gatekeeper's namespace (`gatekeeper-system` by default). Please make sure to update `gatekeeper-system` namespace for the next steps if your cluster's Gatekeeper namespace is different.

Expand Down Expand Up @@ -180,7 +180,7 @@ Dapr: https://dapr.io/
name: audit-connection
namespace: gatekeeper-system
data:
provider: "dapr"
driver: "dapr"
config: |
{
"component": "pubsub"
Expand Down
61 changes: 0 additions & 61 deletions website/docs/pubsub-driver-walkthrough.md

This file was deleted.

4 changes: 2 additions & 2 deletions website/sidebars.js
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ module.exports = {
'expansion',
'gator',
'workload-resources',
'pubsub',
'export',
'validating-admission-policy',
'enforcement-points'
],
Expand Down Expand Up @@ -66,7 +66,7 @@ module.exports = {
'developers',
'help',
'security',
'pubsub-driver'
'export-driver'
],
}
]
Expand Down

0 comments on commit 07c07ac

Please sign in to comment.