Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: add example for audit logging to file in docker #1496

Merged
merged 8 commits into from
Apr 18, 2023
38 changes: 38 additions & 0 deletions examples/audit/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
# Audit Event Logging Example

**This feature is still under development, and this example is subject to change.**

This example shows how you can run Flipt with Audit Event logging enabled to a file on disk.

This works by setting the two environment variables `FLIPT_AUDIT_SINKS_LOG_ENABLED` and `FLIPT_AUDIT_SINKS_LOG_FILE`:

```bash
FLIPT_AUDIT_SINKS_LOG_ENABLED=true
FLIPT_AUDIT_SINKS_LOG_FILE=/var/opt/flipt/audit.log
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
FLIPT_AUDIT_SINKS_LOG_FILE=/var/opt/flipt/audit.log
FLIPT_AUDIT_SINKS_LOG_FILE=/var/log/flipt/audit.log

```

The auditable events currently are CRUD (except for read) operations on `flags`, `variants`, `segments`, `constraints`, `rules`, `distributions`, and `namespaces`. If you do any of these operations through the API, it should emit an audit event log to the specified location.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
The auditable events currently are CRUD (except for read) operations on `flags`, `variants`, `segments`, `constraints`, `rules`, `distributions`, and `namespaces`. If you do any of these operations through the API, it should emit an audit event log to the specified location.
The auditable events currently are CRUD (except for read) operations on `flags`, `variants`, `segments`, `constraints`, `rules`, `distributions`, and `namespaces`. If you perform any of these operations through the API, it should emit an audit event log to the specified location.


Since docker containers are ephemeral and data within the container is lost when the container exits. In this example we mount a local file on the host to the audit event log location in the container as a volume. You would have to create the file [first](https://github.com/moby/moby/issues/21612#issuecomment-202984678) before starting the container:
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Since docker containers are ephemeral and data within the container is lost when the container exits. In this example we mount a local file on the host to the audit event log location in the container as a volume. You would have to create the file [first](https://github.com/moby/moby/issues/21612#issuecomment-202984678) before starting the container:
Since docker containers are ephemeral and data within the container is lost when the container exits, we mount a local file on the host to the audit event log location in the container as a volume. You would have to create the file [first](https://github.com/moby/moby/issues/21612#issuecomment-202984678) before starting the container:


```bash
mkdir -p /tmp/flipt && touch /tmp/flipt/audit.log
```

and `tail` the logs as you are making API request to the Flipt server when the container is running.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
and `tail` the logs as you are making API request to the Flipt server when the container is running.
and `tail` the logs as you are making API requests to the Flipt server when the container is running.


```bash
tail -f /tmp/flipt/audit.log
```

## Requirements

To run this example application you'll need:

* [Docker](https://docs.docker.com/install/)
* [docker-compose](https://docs.docker.com/compose/install/)

## Running the Example

1. Run `docker-compose up` from this directory
1. Open the Flipt UI (default: [http://localhost:8080](http://localhost:8080))
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could add:

1. Create some sample data: Flags/Segments/etc.
1. In a new terminal, run `tail -f /tmp/flipt/audit.log` to see events written to the log

See my comment below about mounting the file to a volume in the container

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

could we make it audit.log or similar so it ends in the .log ext?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@markphelps Done. made that change.

14 changes: 14 additions & 0 deletions examples/audit/docker-compose.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
version: "3"

services:
flipt:
build: ../../
command: ["./flipt", "--force-migrate"]
volumes:
- /tmp/flipt/audit.log:/var/log/audit.log
ports:
- "8080:8080"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what if we mounted a local file for the audit log as a volume, then the user could also tail that file in another terminal to see it being written to? we could include that in the instructions?

like:

volumes:
      - "/tmp/flipt/audit.log:/var/opt/flipt/audit.log"

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@markphelps I like the idea. I think that would work best 👍

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My bad, this should prob be /var/log/flipt/audit.log instead of /var/opt. I copied and pasted from a previous example 😞 sorry

environment:
- FLIPT_LOG_LEVEL=debug
- FLIPT_AUDIT_SINKS_LOG_ENABLED=true
- FLIPT_AUDIT_SINKS_LOG_FILE=/var/log/audit.log