feat: send audit logs to ALS collector - #336
Open
alienvspredator wants to merge 1 commit into
Open
Conversation
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
push-tags-from-workflow
Bot
added
dependencies
alienvspredator
force-pushed
the
feature/send-audit-logs-to-als-collector
branch
4 times, most recently
from
July 27, 2026 17:20
3b17591 to
0689826
Compare
alienvspredator
force-pushed
the
feature/send-audit-logs-to-als-collector
branch
3 times, most recently
from
July 28, 2026 07:38
b3b11ce to
bba344d
Compare
refactor: deduplicate tenant id extraction feat(config): add Valkey and rate-detection config Add the Valkey block and nested RateDetection config that drive cross-pod unauthenticated-burst detection: connection SourceRefs, key prefix, secret ref, and the threshold/window/cooldown plus async dispatch (queue size, workers, dispatch timeout) tunables. Also fix the JWT IssuerClaimKeys default to use double-quoted YAML flow syntax so the tag parses correctly. Signed-off-by: Danylo Shevchenko <danilshevchenko123456@gmail.com> feat(metric): add audit-pipeline instruments Add a Metrics type bundling the OTEL instruments for the audit pipeline: unauthenticated/unauthorized counters (keyed by auth type and decision), dropped-job and rate-store-error counters, and the async queue depth gauge. All methods are nil-safe so call sites need not guard. Signed-off-by: Danylo Shevchenko <danilshevchenko123456@gmail.com> feat(ratestore): add Valkey-backed burst rate store Add the RateStore interface for cross-pod detection of unauthenticated request bursts, plus a no-op implementation used when detection is disabled. The Valkey implementation counts observations and latches the burst event exactly once per (window, identity) via a single server-side Lua script, so no distributed lock is needed and pod clock skew does not affect window boundaries. Includes unit tests and a testcontainers-based integration test. Signed-off-by: Danylo Shevchenko <danilshevchenko123456@gmail.com> feat(auditqueue): add bounded async audit dispatch queue Add a bounded worker pool that runs audit work (Valkey observe + audit send) off the Check() hot path. Submit never blocks: when the pool is saturated jobs are dropped and counted. Each job runs under a dispatch timeout so a hung backend cannot permanently occupy a worker, and Close drains buffered jobs on shutdown. Signed-off-by: Danylo Shevchenko <danilshevchenko123456@gmail.com> feat(audit): add audit Logger interface and no-op Add the audit.Logger interface (SendEvent for plog.Logs) that the extauthz server depends on, plus a NoopLogger used by default when audit delivery is not configured. Signed-off-by: Danylo Shevchenko <danilshevchenko123456@gmail.com> feat(extauthz): emit audit events for non-ALLOWED decisions Wire the audit pipeline into Check(): on a non-ALLOWED decision the server records a metric and submits an async job. Unauthorized (denied / tenant-blocked) requests emit a per-request audit event immediately; unauthenticated requests are rate-detected via the RateStore and emit a single burst event once the fleet-wide threshold is crossed. The burst key prefers the issuer and falls back to a hashed per-tenant bucket. Add the audit logger, rate store, audit queue, metrics and countUnknown dependencies as functional ServerOptions, defaulting to the no-op logger and rate store. Start/Close manage the queue and rate-store lifecycles. Signed-off-by: Danylo Shevchenko <danilshevchenko123456@gmail.com> feat(business): wire audit pipeline and Valkey rate store Assemble the audit pipeline when audit delivery is configured (non-empty endpoint) or rate detection is enabled: build the audit logger, metrics and async queue, and, when rate detection is on, a Valkey-backed rate store. Otherwise extauthz runs with no-op audit and starts no workers. Extract tlsConfigFromSecretRef so the Valkey client and gRPC transport credentials share one definition of how an mTLS SecretRef maps to TLS. Signed-off-by: Danylo Shevchenko <danilshevchenko123456@gmail.com> feat(chart): expose audit sink and rate detection config Surface the audit sink and Valkey rate-detection settings in the Helm chart values and configmap template, add a helm unit test covering the rendered configmap, and document both blocks in examples/config.yaml. Signed-off-by: Danylo Shevchenko <danilshevchenko123456@gmail.com>
alienvspredator
force-pushed
the
feature/send-audit-logs-to-als-collector
branch
from
July 28, 2026 13:43
bba344d to
ec1232a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Send audit logs to ALS collector