[Audit log forwarding] - update audit-tls secret to IM deployments for audit forwarding support (#1061)

rashmi43 · rwhundley · web-flow · commit 0a55ef1b596d · 2025-08-21T12:27:49.000-04:00
Originating issue: [IBMPrivateCloud/roadmap#67190](https://github.ibm.com/IBMPrivateCloud/roadmap/issues/67190) --------- Signed-off-by: rashmi_kh <rashmi.khanna@in.ibm.com> Signed-off-by: Rob Hundley <rwhundle@us.ibm.com> Co-authored-by: Rob Hundley <rwhundle@us.ibm.com>
diff --git a/api/operator/v1alpha1/authentication_types.go b/api/operator/v1alpha1/authentication_types.go
@@ -139,6 +139,8 @@ type ConfigSpec struct {
 	ICPPort                     int32          `json:"icpPort"`
 	FIPSEnabled                 bool           `json:"fipsEnabled"`
 	ROKSEnabled                 bool           `json:"roksEnabled"`
+	AuditUrl                    *string        `json:"auditUrl,omitempty"`
+	AuditSecret                 *string        `json:"auditSecret,omitempty"`
 	IBMCloudSaas                bool           `json:"ibmCloudSaas,omitempty"`
 	OnPremMultipleDeploy        bool           `json:"onPremMultipleDeploy,omitempty"`
 	SaasClientRedirectUrl       string         `json:"saasClientRedirectUrl,omitempty"`
diff --git a/api/operator/v1alpha1/zz_generated.deepcopy.go b/api/operator/v1alpha1/zz_generated.deepcopy.go
diff --git a/bundle/manifests/ibm-iam-operator.clusterserviceversion.yaml b/bundle/manifests/ibm-iam-operator.clusterserviceversion.yaml
@@ -79,6 +79,8 @@ metadata:
               "openshiftPort": 443,
               "preferredLogin": "",
               "providerIssuerURL": "",
+              "auditUrl": "",
+              "auditSecret": "",
               "roksEnabled": true,
               "roksURL": "https://roks.domain.name:443",
               "roksUserPrefix": "changeme",
diff --git a/bundle/manifests/operator.ibm.com_authentications.yaml b/bundle/manifests/operator.ibm.com_authentications.yaml
@@ -228,6 +228,10 @@ spec:
                     type: string
                   providerIssuerURL:
                     type: string
+                  auditUrl:
+                    type: string
+                  auditSecret:
+                    type: string
                   roksEnabled:
                     type: boolean
                   roksURL:
diff --git a/config/crd/bases/operator.ibm.com_authentications.yaml b/config/crd/bases/operator.ibm.com_authentications.yaml
@@ -219,7 +219,11 @@ spec:
                   preferredLogin:
                     type: string
                   defaultLogin:
-                    type: string 
+                    type: string
+                  auditUrl:
+                    type: string
+                  auditSecret:
+                    type: string
                   providerIssuerURL:
                     type: string
                   roksEnabled:
diff --git a/config/samples/bases/operator_v1alpha1_authentication.yaml b/config/samples/bases/operator_v1alpha1_authentication.yaml
@@ -61,6 +61,8 @@ spec:
     preferredLogin: ''
     defaultLogin: ''
     bootstrapUserId: kubeadmin
+    auditUrl: ''
+    auditSecret: ''
     providerIssuerURL: ''
     claimsSupported: name,family_name,display_name,given_name,preferred_username
     claimsMap: name="givenName" family_name="givenName" given_name="givenName" preferred_username="displayName"
diff --git a/internal/controller/bootstrap/authentication_bootstrap_controller.go b/internal/controller/bootstrap/authentication_bootstrap_controller.go
@@ -28,6 +28,7 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	k8sErrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/utils/ptr"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/builder"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -36,8 +37,9 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 )
 
-// BootStrapReconciler handles modifications to the Authentication CR before it is reconciled by the
-// main Authentication controller
+// BootStrapReconciler handles modifications to the Authentication CR before it
+// is reconciled by the main Authentication controller; this is meant to handle
+// edge cases that are encountered during upgrades.
 type BootstrapReconciler struct {
 	client.Client
 }
@@ -105,10 +107,13 @@ func (r *BootstrapReconciler) makeAuthenticationCorrections(ctx context.Context,
 // writeConfigurationsToAuthenticationCR copies values from the
 // platform-auth-idp ConfigMap to the Authentication CR.
 func (r *BootstrapReconciler) writeConfigurationsToAuthenticationCR(ctx context.Context, authCR *operatorv1alpha1.Authentication) (err error) {
+	log := logf.FromContext(ctx, "ConfigMap.Name", "platform-auth-idp").V(1)
 	platformAuthIDPCM := &corev1.ConfigMap{}
 	if err = r.Get(ctx, types.NamespacedName{Name: "platform-auth-idp", Namespace: authCR.Namespace}, platformAuthIDPCM); k8sErrors.IsNotFound(err) {
+		log.Info("ConfigMap not found")
 		return nil
 	} else if err != nil {
+		log.Error(err, "Failed to get ConfigMap")
 		return fmt.Errorf("failed to get ConfigMap: %w", err)
 	}
 	keys := map[string]any{
@@ -129,23 +134,50 @@ func (r *BootstrapReconciler) writeConfigurationsToAuthenticationCR(ctx context.
 		"IBM_CLOUD_SAAS":           &authCR.Spec.Config.IBMCloudSaas,
 		"SAAS_CLIENT_REDIRECT_URL": &authCR.Spec.Config.SaasClientRedirectUrl,
 		"ATTR_MAPPING_FROM_CONFIG": &authCR.Spec.Config.AttrMappingFromConfig,
+		"AUDIT_URL":                &authCR.Spec.Config.AuditUrl,
+		"AUDIT_SECRET":             &authCR.Spec.Config.AuditSecret,
 	}
 
 	for key, crField := range keys {
+		keyLog := log.WithValues("key", key)
 		cmValue, ok := platformAuthIDPCM.Data[key]
 		if !ok {
+			keyLog.Info("Key not found; continuing")
 			continue
 		}
+		keyLog.Info("Key found", "value", cmValue)
 		switch crValue := crField.(type) {
+
 		case *string:
-			if *crValue != cmValue {
+			keyLog.Info("Value type is string")
+			if crValue != nil && *crValue != cmValue {
+				keyLog.Info("Value of property on CR does not match value for key in ConfigMap")
 				*crValue = cmValue
+			} else if crValue != nil {
+				keyLog.Info("Values match")
+			}
+		case **string:
+			keyLog.Info("Value type is optional string")
+			if *crValue == nil {
+				keyLog.Info("Property is not set on CR")
+				*crValue = ptr.To(cmValue)
+			} else if **crValue != cmValue {
+				keyLog.Info("Value of property on CR does not match value for key in ConfigMap")
+				*crValue = ptr.To(cmValue)
+			} else {
+				keyLog.Info("Values match")
 			}
 		case *bool:
+			keyLog.Info("Value type is bool")
 			cmValueBool, _ := strconv.ParseBool(cmValue)
-			if *crValue != cmValueBool {
+			if crValue != nil && *crValue != cmValueBool {
+				keyLog.Info("Value of property on CR does not match value for key in ConfigMap")
 				*crValue = cmValueBool
+			} else if crValue != nil {
+				keyLog.Info("Values match")
 			}
+		default:
+			keyLog.Info("Value type is unknown; skipping")
 		}
 	}
 
diff --git a/internal/controller/operator/authentication_controller.go b/internal/controller/operator/authentication_controller.go
@@ -443,6 +443,7 @@ func (r *AuthenticationReconciler) SetupWithManager(mgr ctrl.Manager) error {
 			}
 		}), builder.WithPredicates(predicate.Or(globalCMPred, productCMPred)),
 	)
+
 	bootstrappedPred := predicate.NewPredicateFuncs(func(o client.Object) bool {
 		return o.GetLabels()[ctrlcommon.ManagerVersionLabel] == version.Version
 	})
diff --git a/internal/controller/operator/configmap.go b/internal/controller/operator/configmap.go
@@ -296,6 +296,8 @@ func updatePlatformAuthIDP(_ common.SecondaryReconciler, _ context.Context, obse
 			"IBM_CLOUD_SAAS",
 			"SAAS_CLIENT_REDIRECT_URL",
 			"ATTR_MAPPING_FROM_CONFIG",
+			"AUDIT_URL",
+			"AUDIT_SECRET",
 		),
 		updatesValuesWhen(observedKeyValueSetTo[*corev1.ConfigMap]("OS_TOKEN_LENGTH", "45"),
 			"OS_TOKEN_LENGTH"),
@@ -437,6 +439,11 @@ func (r *AuthenticationReconciler) generateAuthIdpConfigMap(clusterInfo *corev1.
 			}
 		}
 
+		// Found AUDIT variables
+		if authCR.Spec.Config.AuditUrl != nil || authCR.Spec.Config.AuditSecret != nil {
+			reqLogger.Info("Found audit variables", "AuditUrl", authCR.Spec.Config.AuditUrl, "AuditSecret", authCR.Spec.Config.AuditSecret)
+		}
+
 		// Set the path for SAML connections
 		var masterPath string
 		if masterPath, err = r.getMasterPath(ctx, ctrl.Request{NamespacedName: common.GetObjectKey(s.GetPrimary())}); err != nil {
diff --git a/internal/controller/operator/configmap_test.go b/internal/controller/operator/configmap_test.go
@@ -585,6 +585,8 @@ var _ = Describe("ConfigMap handling", func() {
 					"IDENTITY_MGMT_URL":                  "https://platform-identity-management:4500",
 					"MASTER_HOST":                        ibmcloudClusterInfo.Data["cluster_address"],
 					"MASTER_PATH":                        "/idauth",
+					"AUDIT_URL":                          "",
+					"AUDIT_SECRET":                       "",
 					"NODE_ENV":                           "production",
 					"ENABLE_JIT_EXTRA_ATTR":              "false",
 					"AUDIT_ENABLED_IDPROVIDER":           "false",
@@ -682,6 +684,13 @@ var _ = Describe("ConfigMap handling", func() {
 						"DB_SSL_MODE",
 					},
 				},
+				{
+					"AUDIT_URL",
+					[]string{
+						"AUDIT_URL",
+						"AUDIT_SECRET",
+					},
+				},
 				{
 					"SCIM_LDAP_ATTRIBUTES_MAPPING",
 					[]string{
diff --git a/internal/controller/operator/containers.go b/internal/controller/operator/containers.go
@@ -632,7 +632,7 @@ func buildIdentityProviderContainer(instance *operatorv1alpha1.Authentication, i
 		"LDAP_SEARCH_CACHE_SIZE", "LDAP_SEARCH_CACHE_TIMEOUT", "LDAP_CTX_POOL_INITSIZE", "LDAP_CTX_POOL_MAXSIZE",
 		"LDAP_CTX_POOL_TIMEOUT", "LDAP_CTX_POOL_WAITTIME", "LDAP_CTX_POOL_PREFERREDSIZE", "LDAP_SEARCH_CACHE_ENABLED",
 		"LDAP_SEARCH_CACHE_SIZELIMIT", "LDAP_SEARCH_EXCLUDE_WILDCARD_CHARS", "LDAP_SEARCH_SIZE_LIMIT",
-		"LDAP_SEARCH_TIME_LIMIT", "LDAP_SEARCH_CN_ATTR_ONLY", "LDAP_SEARCH_ID_ATTR_ONLY",
+		"LDAP_SEARCH_TIME_LIMIT", "LDAP_SEARCH_CN_ATTR_ONLY", "LDAP_SEARCH_ID_ATTR_ONLY", "AUDIT_URL",
 		"DB_CONNECT_TIMEOUT", "DB_IDLE_TIMEOUT", "DB_CONNECT_MAX_RETRIES", "DB_POOL_MIN_SIZE", "DB_POOL_MAX_SIZE", "DB_SSL_MODE", "SEQL_LOGGING"}
 	idpEnvVars := buildIdpEnvVars(idpEnvVarList)
 
@@ -700,29 +700,8 @@ func buildIdentityProviderContainer(instance *operatorv1alpha1.Authentication, i
 				Drop: []corev1.Capability{"ALL"},
 			},
 		},
-		Resources: *resources,
-		VolumeMounts: []corev1.VolumeMount{
-			{
-				Name:      "auth-key",
-				MountPath: "/opt/ibm/identity-provider/server/boot/auth-key",
-			},
-			{
-				Name:      "identity-provider-cert",
-				MountPath: "/opt/ibm/identity-provider/certs",
-			},
-			{
-				Name:      "saml-cert",
-				MountPath: "/certs/saml-certs",
-			},
-			{
-				Name:      "pgsql-certs",
-				MountPath: "/certs/pgsql",
-			},
-			{
-				Name:      "pgsql-client-cred",
-				MountPath: "/pgsql/clientinfo",
-			},
-		},
+		Resources:    *resources,
+		VolumeMounts: buildIdentityProviderVolumeMounts(instance.Spec.Config.AuditSecret),
 		ReadinessProbe: &corev1.Probe{
 			ProbeHandler: corev1.ProbeHandler{
 				Exec: &corev1.ExecAction{
@@ -994,7 +973,7 @@ func buildIdentityManagerContainer(instance *operatorv1alpha1.Authentication, id
 		"ROKS_ENABLED", "ROKS_USER_PREFIX", "IDENTITY_AUTH_DIRECTORY_URL", "OIDC_ISSUER_URL", "BOOTSTRAP_USERID", "CLUSTER_NAME", "HTTP_ONLY", "LDAP_SEARCH_SIZE_LIMIT", "LDAP_SEARCH_TIME_LIMIT",
 		"LDAP_SEARCH_CN_ATTR_ONLY", "LDAP_SEARCH_ID_ATTR_ONLY", "LDAP_SEARCH_EXCLUDE_WILDCARD_CHARS", "IGNORE_LDAP_FILTERS_VALIDATION", "AUTH_SVC_LDAP_CONFIG_TIMEOUT",
 		"SCIM_LDAP_SEARCH_SIZE_LIMIT", "SCIM_LDAP_SEARCH_TIME_LIMIT", "SCIM_ASYNC_PARALLEL_LIMIT", "SCIM_GET_DISPLAY_FOR_GROUP_USERS", "ATTR_MAPPING_FROM_CONFIG", "SCIM_AUTH_CACHE_MAX_SIZE", "SCIM_AUTH_CACHE_TTL_VALUE",
-		"DB_CONNECT_TIMEOUT", "DB_IDLE_TIMEOUT", "DB_CONNECT_MAX_RETRIES", "DB_POOL_MIN_SIZE", "DB_POOL_MAX_SIZE", "DB_SSL_MODE", "SEQL_LOGGING"}
+		"DB_CONNECT_TIMEOUT", "DB_IDLE_TIMEOUT", "DB_CONNECT_MAX_RETRIES", "DB_POOL_MIN_SIZE", "DB_POOL_MAX_SIZE", "DB_SSL_MODE", "SEQL_LOGGING", "AUDIT_URL"}
 
 	idpEnvVars := buildIdpEnvVars(idpEnvVarList)
 
@@ -1068,29 +1047,8 @@ func buildIdentityManagerContainer(instance *operatorv1alpha1.Authentication, id
 				Drop: []corev1.Capability{"ALL"},
 			},
 		},
-		Resources: *resources,
-		VolumeMounts: []corev1.VolumeMount{
-			{
-				Name:      "cluster-ca",
-				MountPath: "/opt/ibm/identity-mgmt/certs",
-			},
-			{
-				Name:      "platform-identity-management",
-				MountPath: "/opt/ibm/identity-mgmt/server/certs",
-			},
-			{
-				Name:      "scim-ldap-attributes-mapping",
-				MountPath: "/opt/ibm/identity-mgmt/config/scim-config",
-			},
-			{
-				Name:      "pgsql-certs",
-				MountPath: "/certs/pgsql",
-			},
-			{
-				Name:      "pgsql-client-cred",
-				MountPath: "/pgsql/clientinfo",
-			},
-		},
+		Resources:    *resources,
+		VolumeMounts: buildIdentityManagerVolumeMounts(instance.Spec.Config.AuditSecret),
 		ReadinessProbe: &corev1.Probe{
 			ProbeHandler: corev1.ProbeHandler{
 				Exec: &corev1.ExecAction{
@@ -1184,3 +1142,70 @@ func buildInitContainerEnvVars(envVarList []string, configmapName string) []core
 	}
 	return envVars
 }
+
+func buildIdentityManagerVolumeMounts(auditSecretName *string) []corev1.VolumeMount {
+	volumeMounts := []corev1.VolumeMount{
+		{
+			Name:      "cluster-ca",
+			MountPath: "/opt/ibm/identity-mgmt/certs",
+		},
+		{
+			Name:      "platform-identity-management",
+			MountPath: "/opt/ibm/identity-mgmt/server/certs",
+		},
+		{
+			Name:      "scim-ldap-attributes-mapping",
+			MountPath: "/opt/ibm/identity-mgmt/config/scim-config",
+		},
+		{
+			Name:      "pgsql-certs",
+			MountPath: "/certs/pgsql",
+		},
+		{
+			Name:      "pgsql-client-cred",
+			MountPath: "/pgsql/clientinfo",
+		},
+	}
+	if auditSecretName != nil && *auditSecretName != "" {
+		newVolMount := corev1.VolumeMount{
+			Name:      IMAuditTLSVolume,
+			MountPath: "/certs/audit-tls",
+		}
+		volumeMounts = append(volumeMounts, newVolMount)
+	}
+
+	return volumeMounts
+}
+
+func buildIdentityProviderVolumeMounts(auditSecretName *string) []corev1.VolumeMount {
+	volumeMounts := []corev1.VolumeMount{
+		{
+			Name:      "auth-key",
+			MountPath: "/opt/ibm/identity-provider/server/boot/auth-key",
+		},
+		{
+			Name:      "identity-provider-cert",
+			MountPath: "/opt/ibm/identity-provider/certs",
+		},
+		{
+			Name:      "saml-cert",
+			MountPath: "/certs/saml-certs",
+		},
+		{
+			Name:      "pgsql-certs",
+			MountPath: "/certs/pgsql",
+		},
+		{
+			Name:      "pgsql-client-cred",
+			MountPath: "/pgsql/clientinfo",
+		},
+	}
+	if auditSecretName != nil && *auditSecretName != "" {
+		newVolMount := corev1.VolumeMount{
+			Name:      IMAuditTLSVolume,
+			MountPath: "/certs/audit-tls",
+		}
+		volumeMounts = append(volumeMounts, newVolMount)
+	}
+	return volumeMounts
+}
diff --git a/internal/controller/operator/deployment.go b/internal/controller/operator/deployment.go

Original file line number	Diff line number	Diff line change
`@@ -443,6 +443,7 @@ func (r *AuthenticationReconciler) SetupWithManager(mgr ctrl.Manager) error {`
`443`	`443`	`}`
`444`	`444`	`}), builder.WithPredicates(predicate.Or(globalCMPred, productCMPred)),`
`445`	`445`	`)`
	`446`	`+`
`446`	`447`	`bootstrappedPred := predicate.NewPredicateFuncs(func(o client.Object) bool {`
`447`	`448`	`return o.GetLabels()[ctrlcommon.ManagerVersionLabel] == version.Version`
`448`	`449`	`})`