Skip to content

Commit d71dab7

Browse files
mregrockmregrock
authored
Move audit log from console to BSC/distconf in V2 (#17307)
1 parent a97c3d0 commit d71dab7

25 files changed

+268
-51
lines changed

‎ydb/core/blobstorage/base/blobstorage_console_events.h

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ namespace NKikimr {
7979

8080
TEvControllerReplaceConfigRequest(std::optional<TString> clusterYaml, std::optional<TString> storageYaml,
8181
std::optional<bool> switchDedicatedStorageSection, bool dedicatedConfigMode, bool allowUnknownFields,
82-
bool bypassMetadataChecks, bool enableConfigV2, bool disableConfigV2) {
82+
bool bypassMetadataChecks, bool enableConfigV2, bool disableConfigV2, TString peerName, TString userToken) {
8383
if (clusterYaml) {
8484
Record.SetClusterYaml(*clusterYaml);
8585
}
@@ -97,6 +97,8 @@ namespace NKikimr {
9797
} else if (disableConfigV2) {
9898
Record.SetSwitchEnableConfigV2(false);
9999
}
100+
Record.SetPeerName(peerName);
101+
Record.SetUserToken(userToken);
100102
}
101103

102104
TString ToString() const override {

‎ydb/core/blobstorage/nodewarden/distconf_audit.cpp

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
#include "distconf_audit.h"
2+
3+
#include <ydb/core/audit/audit_log.h>
4+
#include <ydb/core/util/address_classifier.h>
5+
6+
namespace NKikimr::NStorage {
7+
8+
static const TString COMPONENT_NAME = "distconf";
9+
static const TString EMPTY_VALUE = "{none}";
10+
11+
void AuditLogReplaceConfig(
12+
const TString& peer,
13+
const TString& userSID,
14+
const TString& sanitizedToken,
15+
const TString& oldConfig,
16+
const TString& newConfig,
17+
const TString& reason,
18+
bool success)
19+
{
20+
auto peerName = NKikimr::NAddressClassifier::ExtractAddress(peer);
21+
22+
AUDIT_LOG(
23+
AUDIT_PART("component", COMPONENT_NAME)
24+
AUDIT_PART("remote_address", (!peerName.empty() ? peerName : EMPTY_VALUE))
25+
AUDIT_PART("subject", (!userSID.empty() ? userSID : EMPTY_VALUE))
26+
AUDIT_PART("sanitized_token", (!sanitizedToken.empty() ? sanitizedToken : EMPTY_VALUE))
27+
AUDIT_PART("status", TString(success ? "SUCCESS" : "ERROR"))
28+
AUDIT_PART("reason", reason, !reason.empty())
29+
AUDIT_PART("operation", TString("REPLACE CONFIG"))
30+
AUDIT_PART("old_config", oldConfig)
31+
AUDIT_PART("new_config", newConfig)
32+
);
33+
}
34+
35+
} // namespace NKikimr::NStorage

‎ydb/core/blobstorage/nodewarden/distconf_audit.h

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#pragma once
2+
3+
#include <util/generic/string.h>
4+
5+
namespace NKikimr::NStorage {
6+
7+
void AuditLogReplaceConfig(
8+
const TString& peer,
9+
const TString& userSID,
10+
const TString& sanitizedToken,
11+
const TString& oldConfig,
12+
const TString& newConfig,
13+
const TString& reason,
14+
bool success);
15+
16+
} // namespace NKikimr::NStorage

‎ydb/core/blobstorage/nodewarden/distconf_invoke.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,7 @@ namespace NKikimr::NStorage {
121121

122122
void AdvanceGeneration();
123123
void StartProposition(NKikimrBlobStorage::TStorageConfig *config, bool updateFields = true);
124+
bool CheckConfigUpdate(const NKikimrBlobStorage::TStorageConfig& proposed);
124125

125126
////////////////////////////////////////////////////////////////////////////////////////////////////////////////
126127
// Query termination and result delivery

‎ydb/core/blobstorage/nodewarden/distconf_invoke_common.cpp

Lines changed: 28 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
#include "distconf_audit.h"
12
#include "distconf_invoke.h"
23

34
namespace NKikimr::NStorage {
@@ -186,13 +187,25 @@ namespace NKikimr::NStorage {
186187
UpdateFingerprint(config);
187188
}
188189

189-
if (auto error = ValidateConfigUpdate(*Self->StorageConfig, *config)) {
190-
STLOG(PRI_DEBUG, BS_NODE, NWDC78, "StartProposition config validation failed", (SelfId, SelfId()),
191-
(Error, *error), (Config, config));
192-
return FinishWithError(TResult::ERROR, TStringBuilder()
193-
<< "StartProposition config validation failed: " << *error);
190+
if (!CheckConfigUpdate(*config)) {
191+
return;
194192
}
195193

194+
const auto& replaceConfig = Event->Get()->Record.GetReplaceStorageConfig();
195+
TStringBuilder oldConfig;
196+
oldConfig << Self->MainConfigYaml << (Self->StorageConfigYaml ? *Self->StorageConfigYaml : "");
197+
TStringBuilder newConfig;
198+
newConfig << *NewYaml << (NewStorageYaml ? *NewStorageYaml : "");
199+
NACLib::TUserToken userToken = NACLib::TUserToken{replaceConfig.GetUserToken()};
200+
AuditLogReplaceConfig(
201+
/* peer = */ replaceConfig.GetPeerName(),
202+
/* userSID = */ userToken.GetUserSID(),
203+
/* sanitizedToken = */ userToken.GetSanitizedToken(),
204+
/* oldConfig = */ oldConfig,
205+
/* newConfig = */ newConfig,
206+
/* reason = */ {},
207+
/* success = */ true);
208+
196209
Self->CurrentProposedStorageConfig.emplace(std::move(*config));
197210

198211
auto done = [&](TEvGather *res) -> std::optional<TString> {
@@ -217,6 +230,16 @@ namespace NKikimr::NStorage {
217230
Self->RootState = ERootState::IN_PROGRESS; // forbid any concurrent activity
218231
}
219232

233+
bool TInvokeRequestHandlerActor::CheckConfigUpdate(const NKikimrBlobStorage::TStorageConfig& proposed) {
234+
if (auto error = ValidateConfigUpdate(*Self->StorageConfig, proposed)) {
235+
STLOG(PRI_DEBUG, BS_NODE, NWDC78, "Config update validation failed", (SelfId, SelfId()),
236+
(Error, *error), (ProposedConfig, proposed));
237+
FinishWithError(TResult::ERROR, TStringBuilder() << "Config update validation failed: " << *error);
238+
return false;
239+
}
240+
return true;
241+
}
242+
220243
////////////////////////////////////////////////////////////////////////////////////////////////////////////////
221244
// Query termination and result delivery
222245

‎ydb/core/blobstorage/nodewarden/distconf_invoke_storage_config.cpp

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -339,6 +339,8 @@ namespace NKikimr::NStorage {
339339
record.SetOperation(NKikimrBlobStorage::TEvControllerDistconfRequest::DisableDistconf);
340340
if (ProposedStorageConfig.HasExpectedStorageYamlVersion()) {
341341
record.SetExpectedStorageConfigVersion(ProposedStorageConfig.GetExpectedStorageYamlVersion());
342+
record.SetPeerName(replaceStorageConfig.GetPeerName());
343+
record.SetUserToken(replaceStorageConfig.GetUserToken());
342344
}
343345
break;
344346

‎ydb/core/blobstorage/nodewarden/ya.make

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ SRCS(
55
group_stat_aggregator.h
66
distconf.cpp
77
distconf.h
8+
distconf_audit.h
9+
distconf_audit.cpp
810
distconf_binding.cpp
911
distconf_console.cpp
1012
distconf_dynamic.cpp

‎ydb/core/cms/console/console__replace_yaml_config.cpp

Lines changed: 44 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ class TConfigsManager::TTxReplaceYamlConfigBase
3030
, AllowUnknownFields(ev->Get()->Record.GetRequest().allow_unknown_fields())
3131
, DryRun(ev->Get()->Record.GetRequest().dry_run())
3232
, IngressDatabase(ev->Get()->Record.HasIngressDatabase() ? TMaybe<TString>{ev->Get()->Record.GetIngressDatabase()} : TMaybe<TString>{})
33+
, SkipAuditLog(ev->Get()->Record.GetSkipAuditLog() ? true : false)
3334
{
3435
}
3536

@@ -90,6 +91,7 @@ class TConfigsManager::TTxReplaceYamlConfigBase
9091
TSimpleSharedPtr<NYamlConfig::TBasicUnknownFieldsCollector> UnknownFieldsCollector = nullptr;
9192
TMaybe<TString> IngressDatabase;
9293
bool WarnDatabaseBypass = false;
94+
bool SkipAuditLog = false;
9395
};
9496

9597
class TConfigsManager::TTxReplaceMainYamlConfig
@@ -177,14 +179,16 @@ class TConfigsManager::TTxReplaceMainYamlConfig
177179
ctx.Send(Response.Release());
178180

179181
if (!Error && Modify && !DryRun) {
180-
AuditLogReplaceConfigTransaction(
181-
/* peer = */ Peer,
182-
/* userSID = */ UserToken.GetUserSID(),
183-
/* sanitizedToken = */ UserToken.GetSanitizedToken(),
184-
/* oldConfig = */ Self->MainYamlConfig,
185-
/* newConfig = */ Config,
186-
/* reason = */ {},
187-
/* success = */ true);
182+
if (!SkipAuditLog) {
183+
AuditLogReplaceConfigTransaction(
184+
/* peer = */ Peer,
185+
/* userSID = */ UserToken.GetUserSID(),
186+
/* sanitizedToken = */ UserToken.GetSanitizedToken(),
187+
/* oldConfig = */ Self->MainYamlConfig,
188+
/* newConfig = */ Config,
189+
/* reason = */ {},
190+
/* success = */ true);
191+
}
188192

189193
Self->YamlVersion = Version + 1;
190194
Self->MainYamlConfig = UpdatedMainConfig;
@@ -195,14 +199,16 @@ class TConfigsManager::TTxReplaceMainYamlConfig
195199
auto resp = MakeHolder<TConfigsProvider::TEvPrivate::TEvUpdateYamlConfig>(Self->MainYamlConfig, Self->DatabaseYamlConfigs);
196200
ctx.Send(Self->ConfigsProvider, resp.Release());
197201
} else if (Error && !DryRun) {
198-
AuditLogReplaceConfigTransaction(
199-
/* peer = */ Peer,
200-
/* userSID = */ UserToken.GetUserSID(),
201-
/* sanitizedToken = */ UserToken.GetSanitizedToken(),
202-
/* oldConfig = */ Self->MainYamlConfig,
203-
/* newConfig = */ Config,
204-
/* reason = */ ErrorReason,
205-
/* success = */ false);
202+
if (!SkipAuditLog) {
203+
AuditLogReplaceConfigTransaction(
204+
/* peer = */ Peer,
205+
/* userSID = */ UserToken.GetUserSID(),
206+
/* sanitizedToken = */ UserToken.GetSanitizedToken(),
207+
/* oldConfig = */ Self->MainYamlConfig,
208+
/* newConfig = */ Config,
209+
/* reason = */ ErrorReason,
210+
/* success = */ false);
211+
}
206212
}
207213

208214
Self->TxProcessor->TxCompleted(this, ctx);
@@ -360,15 +366,17 @@ class TConfigsManager::TTxReplaceDatabaseYamlConfig
360366
}
361367

362368
if (!Error && Modify && !DryRun) {
363-
AuditLogReplaceDatabaseConfigTransaction(
364-
/* peer = */ Peer,
365-
/* userSID = */ UserToken.GetUserSID(),
366-
/* sanitizedToken = */ UserToken.GetSanitizedToken(),
367-
/* database = */ TargetDatabase,
368-
/* oldConfig = */ oldConfig,
369-
/* newConfig = */ Config,
370-
/* reason = */ {},
371-
/* success = */ true);
369+
if (!SkipAuditLog) {
370+
AuditLogReplaceDatabaseConfigTransaction(
371+
/* peer = */ Peer,
372+
/* userSID = */ UserToken.GetUserSID(),
373+
/* sanitizedToken = */ UserToken.GetSanitizedToken(),
374+
/* database = */ TargetDatabase,
375+
/* oldConfig = */ oldConfig,
376+
/* newConfig = */ Config,
377+
/* reason = */ {},
378+
/* success = */ true);
379+
}
372380

373381
Self->DatabaseYamlConfigs[TargetDatabase] = TDatabaseYamlConfig {
374382
.Config = UpdatedDatabaseConfig,
@@ -383,15 +391,17 @@ class TConfigsManager::TTxReplaceDatabaseYamlConfig
383391

384392
ctx.Send(Self->ConfigsProvider, resp.Release());
385393
} else if (Error && !DryRun) {
386-
AuditLogReplaceDatabaseConfigTransaction(
387-
/* peer = */ Peer,
388-
/* userSID = */ UserToken.GetUserSID(),
389-
/* sanitizedToken = */ UserToken.GetSanitizedToken(),
390-
/* database = */ TargetDatabase,
391-
/* oldConfig = */ oldConfig,
392-
/* newConfig = */ Config,
393-
/* reason = */ ErrorReason,
394-
/* success = */ false);
394+
if (!SkipAuditLog) {
395+
AuditLogReplaceDatabaseConfigTransaction(
396+
/* peer = */ Peer,
397+
/* userSID = */ UserToken.GetUserSID(),
398+
/* sanitizedToken = */ UserToken.GetSanitizedToken(),
399+
/* database = */ TargetDatabase,
400+
/* oldConfig = */ oldConfig,
401+
/* newConfig = */ Config,
402+
/* reason = */ ErrorReason,
403+
/* success = */ false);
404+
}
395405
}
396406

397407
Self->TxProcessor->TxCompleted(this, ctx);

‎ydb/core/cms/console/console_handshake.cpp

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ class TConfigsManager::TConsoleCommitActor : public TActorBootstrapped<TConsoleC
3030
void Bootstrap(const TActorId& consoleId) {
3131
auto request = std::make_unique<TEvConsole::TEvSetYamlConfigRequest>();
3232
request->Record.SetBypassAuth(true);
33+
request->Record.SetSkipAuditLog(true);
3334
request->Record.MutableRequest()->set_config(MainYamlConfig);
3435
request->Record.MutableRequest()->set_allow_unknown_fields(true);
3536
Send(consoleId, request.release());

‎ydb/core/grpc_services/rpc_config.cpp

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -201,6 +201,8 @@ class TReplaceStorageConfigRequest : public TBSConfigRequestGrpc<TReplaceStorage
201201
cmd->SetSwitchDedicatedStorageSection(*shim.SwitchDedicatedStorageSection);
202202
}
203203
cmd->SetDedicatedStorageSectionConfigMode(shim.DedicatedConfigMode);
204+
cmd->SetUserToken(Request_->GetSerializedToken());
205+
cmd->SetPeerName(Request_->GetPeerName());
204206
}
205207

206208
void FillDistconfResult(NKikimrBlobStorage::TEvNodeConfigInvokeOnRootResult& /*record*/,
@@ -236,7 +238,9 @@ class TReplaceStorageConfigRequest : public TBSConfigRequestGrpc<TReplaceStorage
236238
request->allow_unknown_fields() || request->bypass_checks(),
237239
request->bypass_checks(),
238240
/*enableConfigV2=*/ ff.GetSwitchToConfigV2(),
239-
/*disableConfigV2=*/ ff.GetSwitchToConfigV1());
241+
/*disableConfigV2=*/ ff.GetSwitchToConfigV1(),
242+
Request_->GetPeerName(),
243+
Request_->GetSerializedToken());
240244
}
241245

242246
private:

0 commit comments

Comments
 (0)