Kubeapps: Improve Auditability

[danoo]

I want to know who and when:

• updated repository config
• installed/updated the application

[absoludity]

I'd suggest for this that we have Kubeapps implement the webhook which receives audit events for resources we're interested in and use the built-in support for auditing in Kubernetes:

https://kubernetes.io/docs/tasks/debug-application-cluster/audit/

so that the cluster is configured to send the events. This means that auditing displayed within Kubeapps is not limited to interactions carried out via Kubeapps, but rather any interactions with the API server.

So, for example, if all ResponseComplete audit events for actions on an App resource were sent to the Kubeapps webhook backend, we could then query it when displaying an App. In fact, there are probably projects out there which do just that: define a webhook and record the data in some storage which can be queried - there's probably no need to do the actual work in Kubeapps, just integrate.

[Siegfriedk]

We had the issue to find out who actually deleted an Application.

We tried that with Kubeapps Version 1 (not sure if it would work now on Kubeapps 2) and were only able to that tiller did something.

[andresmgot]

Showing who deleted an application in the dashboard can be more complicated since the resource will no longer exist but we can at least record that in kubeops logs so it can be manually retrieved.

[absoludity]

but we can at least record that in kubeops logs so it can be manually retrieved.

If a user has access to delete via kubeapps, then they have access to delete via helm - which won't be recorded in our logs. That's why I'm keen for us to at least check the cluster audit functionality to see if it's feasible to use that.