-
Notifications
You must be signed in to change notification settings - Fork 53
feat: log and store redacted machine config diffs #1305
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: log and store redacted machine config diffs #1305
Conversation
) | ||
|
||
// MachineConfigDiff is the diff between two redacted machine configurations. | ||
type MachineConfigDiff = typed.Resource[MachineConfigDiffSpec, MachineConfigDiffExtension] |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Didn't name this as RedactedClusterMachineConfigDiff
to avoid over-verbosity.
{ | ||
rt: infra.InfraMachineType, | ||
listOptions: clusterQuery, | ||
}, | ||
{ | ||
rt: infra.InfraMachineStatusType, | ||
listOptions: clusterQuery, | ||
}, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Added these two into bundles as well, good to have.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR introduces a new MachineConfigDiff
resource to capture, store, and audit diffs of redacted machine configs, and adds logic to periodically clean up old diffs.
- Controller changes to compute diffs on each config change, save them, and clean up by age/count
- Runtime updates to register caches and controllers for the new diff type
- Audit, support bundles, frontend, and client code extended to recognize and handle the new diff resource
Reviewed Changes
Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.
Show a summary per file
File | Description |
---|---|
internal/backend/runtime/omni/state_access.go | Added MachineConfigDiffType to access filters |
internal/backend/runtime/omni/omni.go | Registered cache/controllers for MachineConfigDiff |
internal/backend/runtime/omni/controllers/omni/redacted_cluster_machine_config.go | Implemented diff computation, saving, and cleanup logic |
internal/backend/runtime/omni/controllers/omni/redacted_cluster_machine_config_test.go | Extended tests for diff creation and retention |
internal/backend/runtime/omni/audit/hooks/hooks.go | Added audit hook for diff creation |
internal/backend/runtime/omni/audit/data.go | Extended audit Data struct with MachineConfigDiff |
internal/backend/grpc/support.go | Included diffs in support bundle collection |
frontend/src/api/resources.ts | Defined MachineConfigDiffType constant |
frontend/src/api/omni/specs/omni.pb.ts | Added MachineConfigDiffSpec type |
client/pkg/omni/resources/omni/omni.go | Registered MachineConfigDiff resource |
client/pkg/omni/resources/omni/machine_config_diff.go | Implemented client type for MachineConfigDiff |
client/api/omni/specs/omni.proto | Added MachineConfigDiffSpec message |
client/api/omni/specs/omni.pb.go | Generated code for MachineConfigDiffSpec |
client/api/omni/specs/omni_vtproto.pb.go | Added VT clone/marshal implementations for diffs |
internal/backend/runtime/omni/controllers/omni/redacted_cluster_machine_config.go
Show resolved
Hide resolved
internal/backend/runtime/omni/controllers/omni/redacted_cluster_machine_config.go
Show resolved
Hide resolved
clusterValidationOptions(st.Default(), config.Config.EtcdBackup, config.Config.Services.EmbeddedDiscoveryService), | ||
clusterValidationOptions(cachedState, config.Config.EtcdBackup, config.Config.Services.EmbeddedDiscoveryService), | ||
relationLabelsValidationOptions(), | ||
accessPolicyValidationOptions(), | ||
authorizationValidationOptions(st.Default()), | ||
authorizationValidationOptions(cachedState), | ||
roleValidationOptions(), | ||
machineSetNodeValidationOptions(st.Default()), | ||
machineSetValidationOptions(st.Default(), storeFactory), | ||
machineClassValidationOptions(st.Default()), | ||
machineSetNodeValidationOptions(cachedState), | ||
machineSetValidationOptions(cachedState, storeFactory), | ||
machineClassValidationOptions(cachedState), | ||
identityValidationOptions(config.Config.Auth.SAML), | ||
exposedServiceValidationOptions(), | ||
configPatchValidationOptions(st.Default()), | ||
configPatchValidationOptions(cachedState), |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Some refactor here to use the cached state in more places.
infra.InfraMachineType, | ||
infra.InfraMachineStatusType, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
These two types also got cluster labels with my recent changes, so I add them here as well.
84df002
to
d6a87f0
Compare
9a435f3
to
39f0cee
Compare
internal/backend/runtime/omni/controllers/omni/redacted_cluster_machine_config.go
Show resolved
Hide resolved
60d4eb1
to
85e1296
Compare
internal/backend/runtime/omni/controllers/omni/redacted_cluster_machine_config.go
Outdated
Show resolved
Hide resolved
internal/backend/runtime/omni/controllers/omni/redacted_cluster_machine_config.go
Outdated
Show resolved
Hide resolved
Change the RedactedClusterMachineConfig controller to also compute diffs between each config change and store them in a new resource. Additionally, log this diff and include its creation in the audit logs. Clean up old diffs with both size (count) and time-based retention. Include these diffs in the support bundles. The resource ID follows the following pattern: `<machine-id>-<timestamp>`, e.g., `34bafa44-e994-4911-9c1a-609cccefee93-2025-07-04T19:05:40.181Z`. Signed-off-by: Utku Ozdemir <[email protected]>
85e1296
to
f1b47f0
Compare
/m |
Change the RedactedClusterMachineConfig controller to also compute diffs between each config change and store them in a new resource.
Additionally, log this diff and include its creation in the audit logs.
Clean up old diffs with both size (count) and time-based retention. Include these diffs in the support bundles.
The resource ID follows the following pattern:
<machine-id>-<timestamp>
, e.g.,34bafa44-e994-4911-9c1a-609cccefee93-2025-07-04T19:05:40.181Z
.Closes #1119.
Sample Diff Resource