Decouple Audit logging from the AntreaPolicy feature gate #5340
Labels
area/monitoring/auditing
Issues or PRs related to auditing.
area/network-policy
Issues or PRs related to network policies.
priority/backlog
Higher priority than priority/awaiting-more-evidence.
Originally posted by @tnqn in #5337 (comment)
At the moment, Audit logging is only enabled when the
AntreaPolicy
feature gate is enabled (which is the default):antrea/cmd/antrea-agent/agent.go
Lines 430 to 442 in 5255b20
However, Audit logging can also be enabled for K8s NetworkPolicies (by annotating the Namespace in which the NPs are defined with an Antrea-specific annotation). So it should be possible for someone to leverage Audit logging for K8s NPs even when disabling the
AntreaPolicy
feature.The naming of objects in
pkg/agent/controller/networkpolicy/audit_logging.go
could also be more generic, to avoid tying it to theAntreaPolicy
feature.The text was updated successfully, but these errors were encountered: