如何用Terraform通过Cluster Logging Forwarder将ARO审计日志发送至Azure日志分析工作区

确实没有官方或社区现成的Terraform模块直接实现该需求，但可以通过手动编写Terraform代码配置相关资源来达成目标，具体步骤如下：

前提条件 #

• 已部署Azure Red Hat OpenShift（ARO）集群，且安装了Cluster Logging Operator
• 已创建Azure日志分析工作区
• 拥有ARO集群资源配置权限及Azure IAM权限

Terraform配置步骤 #

1. 配置Azure服务主体权限 #

给ARO集群对应的服务主体（或托管标识）分配日志分析工作区的访问权限，确保日志能正常推送：

# 获取ARO集群服务主体信息
data "azurerm_service_principal" "aro_sp" {
  display_name = "aro-cluster-service-principal" # 替换为你的ARO服务主体名称
}

# 分配Log Analytics Contributor权限
resource "azurerm_role_assignment" "aro_log_analytics_contributor" {
  scope                = azurerm_log_analytics_workspace.target.id
  role_definition_name = "Log Analytics Contributor"
  principal_id         = data.azurerm_service_principal.aro_sp.id
}

# 分配Monitoring Metrics Publisher权限
resource "azurerm_role_assignment" "aro_monitoring_publisher" {
  scope                = azurerm_log_analytics_workspace.target.id
  role_definition_name = "Monitoring Metrics Publisher"
  principal_id         = data.azurerm_service_principal.aro_sp.id
}

2. 创建Azure服务密钥的Kubernetes Secret #

将Azure服务主体的密钥存储到ARO集群的openshift-logging命名空间下，供日志转发器使用：

resource "kubernetes_secret" "azure_monitor_secret" {
  metadata = {
    name      = "azure-monitor-secret"
    namespace = "openshift-logging"
  }
  data = {
    clientSecret = azurerm_service_principal_password.aro_sp_password.value # 替换为你的服务主体密钥
  }
}

3. 配置Cluster Log Forwarder CR #

通过Terraform的kubernetes_manifest资源创建ClusterLogForwarder自定义资源，指定审计日志的转发规则：

resource "kubernetes_manifest" "cluster_log_forwarder" {
  manifest = {
    apiVersion = "logging.openshift.io/v1"
    kind       = "ClusterLogForwarder"
    metadata = {
      name      = "instance"
      namespace = "openshift-logging"
    }
    spec = {
      inputs = [
        {
          name  = "audit"
          audit = {}
        }
      ]
      outputs = [
        {
          name = "azure-log-analytics"
          azureMonitor = {
            workspaceId = azurerm_log_analytics_workspace.target.workspace_id
            tenantId    = data.azurerm_client_config.current.tenant_id
            clientId    = data.azurerm_service_principal.aro_sp.client_id
            clientSecret = {
              name = "azure-monitor-secret"
              key  = "clientSecret"
            }
          }
        }
      ]
      pipelines = [
        {
          name       = "audit-to-azure"
          inputRefs  = ["audit"]
          outputRefs = ["azure-log-analytics"]
        }
      ]
    }
  }
}

验证配置 #

• 应用Terraform配置后，检查转发器资源状态：oc get clusterlogforwarder -n openshift-logging
• 查看日志收集器Pod运行状态及日志：oc logs -n openshift-logging -l component=collector
• 在Azure日志分析工作区中，通过查询AzureDiagnostics表确认审计日志是否正常流入

内容的提问来源于stack exchange，提问作者eliew