Skip to content

Commit 819f2e8

Browse files
alphadev4alphadev4
authored
Merge pull request #1816 from alphadev4/Azure/Aks-Diagnostic-Logs
Azure/Aks-Diagnostic-Logs
2 parents ff9b814 + 4a1f213 commit 819f2e8

File tree

4 files changed

+205
-0
lines changed

4 files changed

+205
-0
lines changed

‎exports.js

+1
Original file line numberDiff line numberDiff line change
@@ -939,6 +939,7 @@ module.exports = {
939939
'aksClusterHasTags' : require(__dirname + '/plugins/azure/kubernetesservice/aksClusterHasTags.js'),
940940
'aksEncryptionAtRestWithCMK' : require(__dirname + '/plugins/azure/kubernetesservice/aksEncryptionAtRestWithCMK'),
941941
'aksPrivateCluster' : require(__dirname + '/plugins/azure/kubernetesservice/aksPrivateCluster.js'),
942+
'aksDiagnosticLogsEnabled' : require(__dirname + '/plugins/azure/kubernetesservice/aksDiagnosticLogsEnabled.js'),
942943

943944
'acrAdminUser' : require(__dirname + '/plugins/azure/containerregistry/acrAdminUser.js'),
944945
'acrHasTags' : require(__dirname + '/plugins/azure/containerregistry/acrHasTags.js'),

‎helpers/azure/api.js

+5
Original file line numberDiff line numberDiff line change
@@ -1055,6 +1055,11 @@ var tertiarycalls = {
10551055
properties: ['id'],
10561056
url: 'https://management.azure.com/{id}/providers/microsoft.insights/diagnosticSettings?api-version=2021-05-01-preview'
10571057
},
1058+
listByAksClusters: {
1059+
reliesOnPath: 'managedClusters.list',
1060+
properties: ['id'],
1061+
url: 'https://management.azure.com/{id}/providers/microsoft.insights/diagnosticSettings?api-version=2021-05-01-preview'
1062+
},
10581063
listByAppConfigurations: {
10591064
reliesOnPath: 'appConfigurations.list',
10601065
properties: ['id'],

‎plugins/azure/kubernetesservice/aksDiagnosticLogsEnabled.js

+64
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
var async = require('async');
2+
var helpers = require('../../../helpers/azure');
3+
4+
module.exports = {
5+
title: 'AKS Cluster Diagnostic Logs',
6+
category: 'Kubernetes Service',
7+
domain: 'Containers',
8+
description: 'Ensures that Azure Kubernetes clusters have diagnostic logs enabled.',
9+
more_info: 'Enabling diagnostic logging for AKS clusters helps with performance monitoring, troubleshooting, and security optimization.',
10+
recommended_action: 'Enable diagnostic logging for all AKS clusters.',
11+
link: 'https://learn.microsoft.com/en-us/azure/aks/monitor-aks#logs',
12+
apis: ['managedClusters:list','diagnosticSettings:listByAksClusters'],
13+
14+
run: function(cache, settings, callback) {
15+
var results = [];
16+
var source = {};
17+
var locations = helpers.locations(settings.govcloud);
18+
19+
async.each(locations.managedClusters, function(location, rcb) {
20+
var managedClusters = helpers.addSource(cache, source,
21+
['managedClusters', 'list', location]);
22+
23+
if (!managedClusters) return rcb();
24+
25+
if (managedClusters.err || !managedClusters.data) {
26+
helpers.addResult(results, 3,
27+
'Unable to query for Kubernetes clusters: ' + helpers.addError(managedClusters), location);
28+
return rcb();
29+
}
30+
31+
if (!managedClusters.data.length) {
32+
helpers.addResult(results, 0, 'No existing Kubernetes clusters found', location);
33+
return rcb();
34+
}
35+
36+
for (let cluster of managedClusters.data) {
37+
if (!cluster.id) continue;
38+
39+
var diagnosticSettings = helpers.addSource(cache, source,
40+
['diagnosticSettings', 'listByAksClusters', location, cluster.id]);
41+
42+
if (!diagnosticSettings || diagnosticSettings.err || !diagnosticSettings.data) {
43+
helpers.addResult(results, 3, `Unable to query for Kubernetes cluster diagnostic settings: ${helpers.addError(diagnosticSettings)}`,
44+
location, cluster.id);
45+
continue;
46+
}
47+
48+
var found = diagnosticSettings.data.find(ds => ds.logs && ds.logs.length);
49+
50+
if (found) {
51+
helpers.addResult(results, 0, 'AKS cluster has diagnostic logs enabled', location, cluster.id);
52+
} else {
53+
helpers.addResult(results, 2, 'AKS cluster does not have diagnostic logs enabled', location, cluster.id);
54+
}
55+
56+
}
57+
58+
rcb();
59+
}, function() {
60+
// Global checking goes here
61+
callback(null, results, source);
62+
});
63+
}
64+
};

‎plugins/azure/kubernetesservice/aksDiagnosticLogsEnabled.spec.js

+135
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
var expect = require('chai').expect;
2+
var aksDiagnosticLogsEnabled = require('./aksDiagnosticLogsEnabled');
3+
4+
const clusters = [
5+
{
6+
"id": "/subscriptions/123-test/resourcegroups/ABSBAKS2/providers/Microsoft.ContainerService/managedClusters/absbaks2",
7+
},
8+
];
9+
10+
11+
const diagnosticSettings = [
12+
{
13+
id: '/subscriptions/234/myrg/providers/Microsoft.ContainerService/managedClusters/absbaks2/providers/microsoft.insights/diagnosticSettings/test-setting',
14+
type: 'Microsoft.Insights/diagnosticSettings',
15+
name: 'server-setting',
16+
location: 'eastus',
17+
kind: null,
18+
tags: null,
19+
eventHubName: null,
20+
metrics: [],
21+
logs: [
22+
{
23+
"category": null,
24+
"categoryGroup": "allLogs",
25+
"enabled": true,
26+
"retentionPolicy": {
27+
"enabled": false,
28+
"days": 0
29+
}
30+
},
31+
{
32+
"category": null,
33+
"categoryGroup": "audit",
34+
"enabled": false,
35+
"retentionPolicy": {
36+
"enabled": false,
37+
"days": 0
38+
}
39+
}
40+
],
41+
logAnalyticsDestinationType: null
42+
}
43+
];
44+
45+
const createCache = (clusters, ds) => {
46+
const id = clusters && clusters.length ? clusters[0].id : null;
47+
return {
48+
managedClusters: {
49+
list: {
50+
'eastus': {
51+
data: clusters
52+
}
53+
}
54+
},
55+
diagnosticSettings: {
56+
listByAksClusters: {
57+
'eastus': {
58+
[id]: {
59+
data: ds
60+
}
61+
}
62+
}
63+
64+
},
65+
};
66+
};
67+
68+
const createErrorCache = () => {
69+
return {
70+
managedClusters: {
71+
list: {
72+
'eastus': {}
73+
}
74+
}
75+
};
76+
};
77+
78+
describe('aksDiagnosticLogsEnabled', function() {
79+
describe('run', function() {
80+
it('should give passing result if no clusters', function(done) {
81+
const cache = createCache([]);
82+
aksDiagnosticLogsEnabled.run(cache, {}, (err, results) => {
83+
expect(results.length).to.equal(1);
84+
expect(results[0].status).to.equal(0);
85+
expect(results[0].message).to.include('No existing Kubernetes clusters');
86+
expect(results[0].region).to.equal('eastus');
87+
done();
88+
});
89+
});
90+
91+
it('should give unknown result if unable to query for kubernetes clusters', function(done) {
92+
const cache = createErrorCache();
93+
aksDiagnosticLogsEnabled.run(cache, {}, (err, results) => {
94+
expect(results.length).to.equal(1);
95+
expect(results[0].status).to.equal(3);
96+
expect(results[0].message).to.include('Unable to query for Kubernetes clusters: ');
97+
expect(results[0].region).to.equal('eastus');
98+
done();
99+
});
100+
});
101+
102+
it('should give unknown result if unable to query for diagnostic settings', function(done) {
103+
const cache = createCache([clusters[0]], null);
104+
aksDiagnosticLogsEnabled.run(cache, {}, (err, results) => {
105+
expect(results.length).to.equal(1);
106+
expect(results[0].status).to.equal(3);
107+
expect(results[0].message).to.include('Unable to query for Kubernetes cluster diagnostic settings');
108+
expect(results[0].region).to.equal('eastus');
109+
done();
110+
});
111+
});
112+
113+
it('should give passing result if diagnostic logs enabled', function(done) {
114+
const cache = createCache([clusters[0]], [diagnosticSettings[0]]);
115+
aksDiagnosticLogsEnabled.run(cache, {}, (err, results) => {
116+
expect(results.length).to.equal(1);
117+
expect(results[0].status).to.equal(0);
118+
expect(results[0].message).to.include('AKS cluster has diagnostic logs enabled');
119+
expect(results[0].region).to.equal('eastus');
120+
done();
121+
});
122+
});
123+
124+
it('should give failing result if diagnostic logs not enabled', function(done) {
125+
const cache = createCache([clusters[0]], [[]]);
126+
aksDiagnosticLogsEnabled.run(cache, {}, (err, results) => {
127+
expect(results.length).to.equal(1);
128+
expect(results[0].status).to.equal(2);
129+
expect(results[0].message).to.include('AKS cluster does not have diagnostic logs enabled');
130+
expect(results[0].region).to.equal('eastus');
131+
done();
132+
});
133+
});
134+
});
135+
});

0 commit comments

Comments
 (0)