* lib/config: Add static config for AccessGraph EKS audit logs
Extend the static config for Access Graph discovery to be able to
specify the EKS cluster for which apiserver audit logs should be fetched
and sent to Access Graph.
* discovery: Add AWS EKS audit log fetching for Access Graph
Add a watcher to start fetchers for all access graph EKS clusters that
are configured to have Kubernetes apiserver audit logs fetched and send
them to access graph. It receives the set of clusters to fetch audit
logs for from the AWS resource syncer as it discovers EKS clusters.
Those clusters are reconciled against the current set of log fetchers,
with no-longer-needed fetchers stopped and new fetchers started as
needed.
This commit requires go.mod be updated with:
go get github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@latest
It is left out of this commit for now as it makes rebasing/merging
master easier.
* Add github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs to go.mod
Run:
go get github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@latest
make go-mod-tidy-all
# Manually move the go.mod line back to the first section!?!?
This commit is kept separate for easier merging/rebasing.
* discovery: Refactor eks audit log fetching for testing
Refactor the eksAuditLog{Watcher,Fetcher} and the aws_sync.Fetcher
cloudwatchlogs to be more testable:
* factor away eksAuditLogFetcher from eksAuditLogWatcher. The watcher
just needs a factory function to create a fetcher, and all the watcher
needs from that fetcher is a `Run()` method. Lift the cancel func out
of the watcher and store it directly in the watcher, as only the
watcher uses it.
* factor away aws_sync.Fetcher from eksAuditLogFetcher. All it needs
from the sync fetcher it calls is one method to fetch cloudwatch logs.
Make that an interface and use just that. This allows a fake source of
cloudwatch logs to be provided for testing. While here, use protobuf
getters rather than accessing fields directly.
* Use protobuf getters in aws_sync.Fetcher cloudwatchlogs instead of
accessing fields directly. In future, we could pass in an interface
with those getters to make the code more testable.
* discovery: Add eks audit log tests
Add tests for `eksAuditLogWatcher` and `eksAuditLogFetcher`. Copy the
grpc stream testing util from the access graph repo into teleport as it
is useful for the bidirectional streaming methods uses by access graph,
and makes it easier to test on the client side.
* Move lib/srv/mock to lib/srv/mock_test.go
* remove testify from lib/srv/db/redis
* remove lib/auth/test package
* Move lib/utils/testhelpers.go to lib/utils/testutils
* duplicate auto upgrades server mock
* remove testing from fake podman server
* remove lib/fixtures/plugin.go
* remove test assertions from lib/fixtures
* remove depguard exceptions that no longer apply
* fix: comments
Dan Upton