mirrors/etcd
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

etcdserver/v2auth: support structured logging

Browse Source 
Signed-off-by: Gyuho Lee <gyuhox@gmail.com>
This commit is contained in:
Gyuho Lee
2018-05-02 10:51:13 -07:00
parent 859172e84f
commit 98fcd67e9f
3 changed files with 154 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

138
etcdserver/v2auth/auth.go
View File

@ -32,6 +32,7 @@ import (
"github.com/coreos/etcd/pkg/types"
"github.com/coreos/pkg/capnslog"
"go.uber.org/zap"
"golang.org/x/crypto/bcrypt"
)
@ -98,6 +99,7 @@ type PasswordStore interface {
}
type store struct {
lg *zap.Logger
server doer
timeout time.Duration
ensuredOnce bool
@ -145,8 +147,9 @@ func authErr(hs int, s string, v ...interface{}) Error {
return Error{Status: hs, Errmsg: fmt.Sprintf("auth: "+s, v...)}
}
func NewStore(server doer, timeout time.Duration) Store {
func NewStore(lg *zap.Logger, server doer, timeout time.Duration) Store {
s := &store{
lg: lg,
server: server,
timeout: timeout,
PasswordStore: passwordStore{},
@ -208,7 +211,11 @@ func (s *store) CreateUser(user User) (User, error) {
}
u, err := s.createUserInternal(user)
if err == nil {
plog.Noticef("created user %s", user.User)
if s.lg != nil {
s.lg.Info("created a user", zap.String("user-name", user.User))
} else {
plog.Noticef("created user %s", user.User)
}
}
return u, err
}
@ -247,7 +254,11 @@ func (s *store) DeleteUser(name string) error {
}
return err
}
plog.Noticef("deleted user %s", name)
if s.lg != nil {
s.lg.Info("deleted a user", zap.String("user-name", name))
} else {
plog.Noticef("deleted user %s", name)
}
return nil
}
@ -262,7 +273,7 @@ func (s *store) UpdateUser(user User) (User, error) {
return old, err
}
newUser, err := old.merge(user, s.PasswordStore)
newUser, err := old.merge(s.lg, user, s.PasswordStore)
if err != nil {
return old, err
}
@ -271,7 +282,11 @@ func (s *store) UpdateUser(user User) (User, error) {
}
_, err = s.updateResource("/users/"+user.User, newUser)
if err == nil {
plog.Noticef("updated user %s", user.User)
if s.lg != nil {
s.lg.Info("updated a user", zap.String("user-name", user.User))
} else {
plog.Noticef("updated user %s", user.User)
}
}
return newUser, err
}
@ -310,7 +325,11 @@ func (s *store) CreateRole(role Role) error {
}
}
if err == nil {
plog.Noticef("created new role %s", role.Role)
if s.lg != nil {
s.lg.Info("created a new role", zap.String("role-name", role.Role))
} else {
plog.Noticef("created new role %s", role.Role)
}
}
return err
}
@ -328,7 +347,11 @@ func (s *store) DeleteRole(name string) error {
}
}
if err == nil {
plog.Noticef("deleted role %s", name)
if s.lg != nil {
s.lg.Info("delete a new role", zap.String("role-name", name))
} else {
plog.Noticef("deleted role %s", name)
}
}
return err
}
@ -346,7 +369,7 @@ func (s *store) UpdateRole(role Role) (Role, error) {
}
return old, err
}
newRole, err := old.merge(role)
newRole, err := old.merge(s.lg, role)
if err != nil {
return old, err
}
@ -355,7 +378,11 @@ func (s *store) UpdateRole(role Role) (Role, error) {
}
_, err = s.updateResource("/roles/"+role.Role, newRole)
if err == nil {
plog.Noticef("updated role %s", role.Role)
if s.lg != nil {
s.lg.Info("updated a new role", zap.String("role-name", role.Role))
} else {
plog.Noticef("updated role %s", role.Role)
}
}
return newRole, err
}
@ -373,19 +400,42 @@ func (s *store) EnableAuth() error {
return authErr(http.StatusConflict, "No root user available, please create one")
}
if _, err := s.getRole(GuestRoleName, true); err != nil {
plog.Printf("no guest role access found, creating default")
if s.lg != nil {
s.lg.Info(
"no guest role access found; creating default",
zap.String("role-name", GuestRoleName),
)
} else {
plog.Printf("no guest role access found, creating default")
}
if err := s.CreateRole(guestRole); err != nil {
plog.Errorf("error creating guest role. aborting auth enable.")
if s.lg != nil {
s.lg.Warn(
"failed to create a guest role; aborting auth enable",
zap.String("role-name", GuestRoleName),
zap.Error(err),
)
} else {
plog.Errorf("error creating guest role. aborting auth enable.")
}
return err
}
}
if err := s.enableAuth(); err != nil {
plog.Errorf("error enabling auth (%v)", err)
if s.lg != nil {
s.lg.Warn("failed to enable auth", zap.Error(err))
} else {
plog.Errorf("error enabling auth (%v)", err)
}
return err
}
plog.Noticef("auth: enabled auth")
if s.lg != nil {
s.lg.Info("enabled auth")
} else {
plog.Noticef("auth: enabled auth")
}
return nil
}
@ -396,9 +446,17 @@ func (s *store) DisableAuth() error {
err := s.disableAuth()
if err == nil {
plog.Noticef("auth: disabled auth")
if s.lg != nil {
s.lg.Info("disabled auth")
} else {
plog.Noticef("auth: disabled auth")
}
} else {
plog.Errorf("error disabling auth (%v)", err)
if s.lg != nil {
s.lg.Warn("failed to disable auth", zap.Error(err))
} else {
plog.Errorf("error disabling auth (%v)", err)
}
}
return err
}
@ -407,7 +465,7 @@ func (s *store) DisableAuth() error {
// is called and returns a new User with these modifications applied. Think of
// all Users as immutable sets of data. Merge allows you to perform the set
// operations (desired grants and revokes) atomically
func (ou User) merge(nu User, s PasswordStore) (User, error) {
func (ou User) merge(lg *zap.Logger, nu User, s PasswordStore) (User, error) {
var out User
if ou.User != nu.User {
return out, authErr(http.StatusConflict, "Merging user data with conflicting usernames: %s %s", ou.User, nu.User)
@ -425,14 +483,30 @@ func (ou User) merge(nu User, s PasswordStore) (User, error) {
currentRoles := types.NewUnsafeSet(ou.Roles...)
for _, g := range nu.Grant {
if currentRoles.Contains(g) {
plog.Noticef("granting duplicate role %s for user %s", g, nu.User)
if lg != nil {
lg.Warn(
"attempted to grant a duplicate role for a user",
zap.String("user-name", nu.User),
zap.String("role-name", g),
)
} else {
plog.Noticef("granting duplicate role %s for user %s", g, nu.User)
}
return User{}, authErr(http.StatusConflict, fmt.Sprintf("Granting duplicate role %s for user %s", g, nu.User))
}
currentRoles.Add(g)
}
for _, r := range nu.Revoke {
if !currentRoles.Contains(r) {
plog.Noticef("revoking ungranted role %s for user %s", r, nu.User)
if lg != nil {
lg.Warn(
"attempted to revoke a ungranted role for a user",
zap.String("user-name", nu.User),
zap.String("role-name", r),
)
} else {
plog.Noticef("revoking ungranted role %s for user %s", r, nu.User)
}
return User{}, authErr(http.StatusConflict, fmt.Sprintf("Revoking ungranted role %s for user %s", r, nu.User))
}
currentRoles.Remove(r)
@ -444,7 +518,7 @@ func (ou User) merge(nu User, s PasswordStore) (User, error) {
// merge for a role works the same as User above -- atomic Role application to
// each of the substructures.
func (r Role) merge(n Role) (Role, error) {
func (r Role) merge(lg *zap.Logger, n Role) (Role, error) {
var out Role
var err error
if r.Role != n.Role {
@ -455,7 +529,7 @@ func (r Role) merge(n Role) (Role, error) {
if err != nil {
return out, err
}
out.Permissions, err = out.Permissions.Revoke(n.Revoke)
out.Permissions, err = out.Permissions.Revoke(lg, n.Revoke)
return out, err
}
@ -487,13 +561,13 @@ func (p Permissions) Grant(n *Permissions) (Permissions, error) {
// Revoke removes a set of permissions to the permission object on which it is called,
// returning a new permission object.
func (p Permissions) Revoke(n *Permissions) (Permissions, error) {
func (p Permissions) Revoke(lg *zap.Logger, n *Permissions) (Permissions, error) {
var out Permissions
var err error
if n == nil {
return p, nil
}
out.KV, err = p.KV.Revoke(n.KV)
out.KV, err = p.KV.Revoke(lg, n.KV)
return out, err
}
@ -524,12 +598,19 @@ func (rw RWPermission) Grant(n RWPermission) (RWPermission, error) {
// Revoke removes a set of permissions to the permission object on which it is called,
// returning a new permission object.
func (rw RWPermission) Revoke(n RWPermission) (RWPermission, error) {
func (rw RWPermission) Revoke(lg *zap.Logger, n RWPermission) (RWPermission, error) {
var out RWPermission
currentRead := types.NewUnsafeSet(rw.Read...)
for _, r := range n.Read {
if !currentRead.Contains(r) {
plog.Noticef("revoking ungranted read permission %s", r)
if lg != nil {
lg.Info(
"revoking ungranted read permission",
zap.String("read-permission", r),
)
} else {
plog.Noticef("revoking ungranted read permission %s", r)
}
continue
}
currentRead.Remove(r)
@ -537,7 +618,14 @@ func (rw RWPermission) Revoke(n RWPermission) (RWPermission, error) {
currentWrite := types.NewUnsafeSet(rw.Write...)
for _, w := range n.Write {
if !currentWrite.Contains(w) {
plog.Noticef("revoking ungranted write permission %s", w)
if lg != nil {
lg.Info(
"revoking ungranted write permission",
zap.String("write-permission", w),
)
} else {
plog.Noticef("revoking ungranted write permission %s", w)
}
continue
}
currentWrite.Remove(w)