Goals

• Support namespace selectors for infrastructure logs as well as namespace.
• Control selection of non-namespaced infrastructure logs.
• Allow excluded namespaces and wildcard matches.
• Use a consistent API for namespace selection.

Motivation

• Allow control of audit logs by namespace.
• Allow collection from all namespaces excluding selected namespaces.
• Allow collection by namespace following a pattern (e.g. openshift*)

Acceptance Criteria

Tests to demonstrate:

• Selecting all infrastructure logs.
• Selecting only namespaced infrastructure logs.
• Selecting only non-namespaced (node) infrastructure logs.
• Excluding/including selected namespace patterns with or without node logs.

Documentation Considerations

Required in CLF doc.

Design

Special values for the namespaces list:

• "-" means all non-namespaced logs.
• "*" means all namespaced logs.
• "x*y" glob-style pattern matching.
• "name" leading "" means exclude namespaces matching this pattern.

Note there is no notation to "exclude non-namespaced logs", they are included if no namespaces are listed, excluded if any namespaces are listed (including "*") and the non-namespaced marker "-" is missing.missing.

Namespaces is now allowed in the   input.infrastructure section, examples:

inputs:
  - name: infra_all
    infrastructure: # Empty section selects everything

  - name: infra_namespaced_only
    infrastructure:
      namespaces: ["*"]

  - name: infra_selected_namespaces
    infrastructure:
      namespaces: ["foo", "bar"]

  - name: infra_node_only
    infrastructure:
      namespaces: ["-"]

  - name: infra_node_and_selected_namespaces
    infrastructure:
      namespaces: ["-", "foo", "bar"] 

Some application include/exclude and wildcard examples:

inputs:
  - name: starts_with_foo
    application:
      namespaces: ["foo*"]

 - name: does_not_start_with_foo
   application:
      namespaces: ["-foo*"]

       

Namespaces are matched against the list in order, for example [ "foo*", "-bar", ""]

• Includes any namespace starting with "foo", e.g. "foobar", "foo-x-bar"
• Excludes any namespace ending in "bar", e.g. "x-bar", "x-foo-bar"
• Includes  any other namespace that does not end in "bar"