如何通过Terraform禁用"kube_audit“和"kube_audit_admin”AKS日志设置

Question

摘要：

使用Terraform，目标是从Azure诊断设置中禁用"kube_audit“和"kube_audit_admin”日志设置。但是，我的解决方案似乎同时启用和禁用这些设置。我正在寻找通过Terraform禁用这些设置的正确方法。

我的解决方案

在Terraform中，我为AKS集群定义了以下诊断设置：

resource "azurerm_monitor_diagnostic_setting" "aks" {
  name                       = var.diag_name
  target_resource_id         = azurerm_kubernetes_cluster.aks.id
  log_analytics_workspace_id = azurerm_log_analytics_workspace.log_workspace.id

  dynamic "log" {
    for_each = local.diag_agw_logs
    content {
      category = log.value

      retention_policy {
        days    = var.cluster_log_metrics_retention_in_days
        enabled = var.cluster_monitor_event_retention
      }
    }
  }

  dynamic "metric" {
    for_each = local.diag_agw_metrics
    content {
      category = metric.value

      retention_policy {
        days    = var.cluster_log_metrics_retention_in_days
        enabled = var.cluster_monitor_event_retention
      }
    }
  }
}

资源JSON看起来如下(这是预期的行为)：

>> az monitor diagnostic-settings list --resource $(az aks list --query '[?contains(@.name, `mycluster`)].id | [0]' | tr -d '"')
[
  {
    "eventHubAuthorizationRuleId": null,
    "eventHubName": null,
    "id": "/subscriptions/xxx/resourcegroups/myresourcegroup/providers/microsoft.containerservice/managedclusters/mycluster/providers/microsoft.insights/diagnosticSettings/mydiagnosticsetting",
    "identity": null,
    "kind": null,
    "location": null,
    "logAnalyticsDestinationType": null,
    "logs": [
      {
        "category": "cluster-autoscaler",
        "categoryGroup": null,
        "enabled": true,
        "retentionPolicy": {
          "days": 7,
          "enabled": true
        }
      },
      {
        "category": "kube-scheduler",
        "categoryGroup": null,
        "enabled": true,
        "retentionPolicy": {
          "days": 7,
          "enabled": true
        }
      },
      {
        "category": "kube-audit",
        "categoryGroup": null,
        "enabled": true,
        "retentionPolicy": {
          "days": 7,
          "enabled": true
        }
      },
      {
        "category": "kube-audit-admin",
        "categoryGroup": null,
        "enabled": true,
        "retentionPolicy": {
          "days": 7,
          "enabled": true
        }
      },
      {
        "category": "kube-controller-manager",
        "categoryGroup": null,
        "enabled": true,
        "retentionPolicy": {
          "days": 7,
          "enabled": true
        }
      },
      {
        "category": "guard",
        "categoryGroup": null,
        "enabled": true,
        "retentionPolicy": {
          "days": 7,
          "enabled": true
        }
      },
      {
        "category": "kube-apiserver",
        "categoryGroup": null,
        "enabled": true,
        "retentionPolicy": {
          "days": 7,
          "enabled": true
        }
      }
    ],
    "marketplacePartnerId": null,
    "metrics": [
      {
        "category": "AllMetrics",
        "enabled": true,
        "retentionPolicy": {
          "days": 7,
          "enabled": true
        },
        "timeGrain": null
      }
    ],
    "name": "mydiagnosticsetting",
    "resourceGroup": "myresourcegroup",
    "serviceBusRuleId": null,
    "storageAccountId": null,
    "systemData": null,
    "tags": null,
    "type": "Microsoft.Insights/diagnosticSettings",
    "workspaceId": "/subscriptions/xxx/resourceGroups/myresourcegroup/providers/Microsoft.OperationalInsights/workspaces/myloganalyticsworkspace"
  }
]

我的目标是禁用"kube_audit“和"kube_audit_admin”日志设置。但是，当我在Terraform中添加日志块以禁用这些审计日志时，在应用我的更改之后，资源JSON看起来是出乎意料的。这是Terraform中的新资源定义(我只添加了两个日志块，没有进行其他更改)：

resource "azurerm_monitor_diagnostic_setting" "aks" {
  name                       = var.diag_name
  target_resource_id         = azurerm_kubernetes_cluster.aks.id
  log_analytics_workspace_id = azurerm_log_analytics_workspace.log_workspace.id

  # Change 1 to disable "kube-audit"
  log {
    category       = "kube-audit"
    enabled        = false
  }

  # Change 2 to disable "kube-audit-admin"
  log {
    category       = "kube-audit-admin"
    enabled        = false
  }

  dynamic "log" {
    for_each = local.diag_agw_logs
    content {
      category = log.value

      retention_policy {
        days    = var.cluster_log_metrics_retention_in_days
        enabled = var.cluster_monitor_event_retention
      }
    }
  }

  dynamic "metric" {
    for_each = local.diag_agw_metrics
    content {
      category = metric.value

      retention_policy {
        days    = var.cluster_log_metrics_retention_in_days
        enabled = var.cluster_monitor_event_retention
      }
    }
  }
}

在应用之后，JSON资源就是这样的：

>> az monitor diagnostic-settings list --resource $(az aks list --query '[?contains(@.name, `mycluster`)].id | [0]' | tr -d '"')
[
  {
    "eventHubAuthorizationRuleId": null,
    "eventHubName": null,
    "id": "/subscriptions/xxx/resourcegroups/myresourcegroup/providers/microsoft.containerservice/managedclusters/mycluster/providers/microsoft.insights/diagnosticSettings/mydiagnosticsetting",
    "identity": null,
    "kind": null,
    "location": null,
    "logAnalyticsDestinationType": null,
    "logs": [
      {
        "category": "cluster-autoscaler",
        "categoryGroup": null,
        "enabled": true,
        "retentionPolicy": {
          "days": 7,
          "enabled": true
        }
      },
      {
        "category": "kube-scheduler",
        "categoryGroup": null,
        "enabled": true,
        "retentionPolicy": {
          "days": 7,
          "enabled": true
        }
      },
      {
        "category": "kube-audit",
        "categoryGroup": null,
        "enabled": true,
        "retentionPolicy": {
          "days": 7,
          "enabled": true
        }
      },
      {
        "category": "kube-audit-admin",
        "categoryGroup": null,
        "enabled": true,
        "retentionPolicy": {
          "days": 7,
          "enabled": true
        }
      },
      {
        "category": "kube-controller-manager",
        "categoryGroup": null,
        "enabled": true,
        "retentionPolicy": {
          "days": 7,
          "enabled": true
        }
      },
      {
        "category": "guard",
        "categoryGroup": null,
        "enabled": true,
        "retentionPolicy": {
          "days": 7,
          "enabled": true
        }
      },
      {
        "category": "kube-audit",
        "categoryGroup": null,
        "enabled": false,
        "retentionPolicy": null
      },
      {
        "category": "kube-audit-admin",
        "categoryGroup": null,
        "enabled": false,
        "retentionPolicy": null
      },
      {
        "category": "kube-apiserver",
        "categoryGroup": null,
        "enabled": true,
        "retentionPolicy": {
          "days": 7,
          "enabled": true
        }
      }
    ],
    "marketplacePartnerId": null,
    "metrics": [
      {
        "category": "AllMetrics",
        "enabled": true,
        "retentionPolicy": {
          "days": 7,
          "enabled": true
        },
        "timeGrain": null
      }
    ],
    "name": "mydiagnosticsetting",
    "resourceGroup": "myresourcegroup",
    "serviceBusRuleId": null,
    "storageAccountId": null,
    "systemData": null,
    "tags": null,
    "type": "Microsoft.Insights/diagnosticSettings",
    "workspaceId": "/subscriptions/xxx/resourceGroups/myresourcegroup/providers/Microsoft.OperationalInsights/workspaces/myloganalyticsworkspace"
  }
]

如您所见，"kube_audit“和"kube_audit_admin”日志设置似乎都是启用和禁用的。通过Terraform禁用这些设置的正确方法是什么？

Answer 1

我自己想出来了，所以我决定把它发到这里，而不是删除这个问题。问题是dynamic "log"资源一直覆盖单个log块。

  dynamic "log" {
    for_each = local.diag_agw_logs. # <--- This was iterating over a list 
                                    #      with all the log settings, no 
                                    #      individual block needed
    content {
      category = log.value

      retention_policy {
        days    = var.cluster_log_metrics_retention_in_days
        enabled = var.cluster_monitor_event_retention
      }
    }
  }

因此，所要做的就是删除已经插入的log块，以恢复资源azurerm_monitor_diagnostic_setting.aks的原始状态。然后修改dynamic块正在迭代的列表，一切都按预期进行。