-
Notifications
You must be signed in to change notification settings - Fork 221
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
chore: add example for audit logging to file in docker #1496
Changes from 6 commits
6d50f12
cd27c32
9a4f4bc
b21d71d
37b59c2
e072069
6b7d117
dbed701
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change | ||||
---|---|---|---|---|---|---|
@@ -0,0 +1,38 @@ | ||||||
# Audit Event Logging Example | ||||||
|
||||||
**This feature is still under development, and this example is subject to change.** | ||||||
|
||||||
This example shows how you can run Flipt with Audit Event logging enabled to a file on disk. | ||||||
|
||||||
This works by setting the two environment variables `FLIPT_AUDIT_SINKS_LOG_ENABLED` and `FLIPT_AUDIT_SINKS_LOG_FILE`: | ||||||
|
||||||
```bash | ||||||
FLIPT_AUDIT_SINKS_LOG_ENABLED=true | ||||||
FLIPT_AUDIT_SINKS_LOG_FILE=/var/opt/flipt/audit.log | ||||||
``` | ||||||
|
||||||
The auditable events currently are CRUD (except for read) operations on `flags`, `variants`, `segments`, `constraints`, `rules`, `distributions`, and `namespaces`. If you do any of these operations through the API, it should emit an audit event log to the specified location. | ||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Suggested change
|
||||||
|
||||||
Since docker containers are ephemeral and data within the container is lost when the container exits. In this example we mount a local file on the host to the audit event log location in the container as a volume. You would have to create the file [first](https://github.com/moby/moby/issues/21612#issuecomment-202984678) before starting the container: | ||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Suggested change
|
||||||
|
||||||
```bash | ||||||
mkdir -p /tmp/flipt && touch /tmp/flipt/audit.log | ||||||
``` | ||||||
|
||||||
and `tail` the logs as you are making API request to the Flipt server when the container is running. | ||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Suggested change
|
||||||
|
||||||
```bash | ||||||
tail -f /tmp/flipt/audit.log | ||||||
``` | ||||||
|
||||||
## Requirements | ||||||
|
||||||
To run this example application you'll need: | ||||||
|
||||||
* [Docker](https://docs.docker.com/install/) | ||||||
* [docker-compose](https://docs.docker.com/compose/install/) | ||||||
|
||||||
## Running the Example | ||||||
|
||||||
1. Run `docker-compose up` from this directory | ||||||
1. Open the Flipt UI (default: [http://localhost:8080](http://localhost:8080)) | ||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. We could add:
See my comment below about mounting the file to a volume in the container There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. could we make it There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. @markphelps Done. made that change. |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,14 @@ | ||
version: "3" | ||
|
||
services: | ||
flipt: | ||
build: ../../ | ||
command: ["./flipt", "--force-migrate"] | ||
volumes: | ||
- /tmp/flipt/audit.log:/var/log/audit.log | ||
ports: | ||
- "8080:8080" | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. what if we mounted a local file for the audit log as a volume, then the user could also tail that file in another terminal to see it being written to? we could include that in the instructions? like: volumes:
- "/tmp/flipt/audit.log:/var/opt/flipt/audit.log" There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. @markphelps I like the idea. I think that would work best 👍 There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. My bad, this should prob be |
||
environment: | ||
- FLIPT_LOG_LEVEL=debug | ||
- FLIPT_AUDIT_SINKS_LOG_ENABLED=true | ||
- FLIPT_AUDIT_SINKS_LOG_FILE=/var/log/audit.log |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.