Feature/x requirements log permission (#5238) (#5258)

changluyi · web-flow · commit 5645113beab8 · 2025-05-20T15:56:47.000+08:00
* change log file default mode 0640

Signed-off-by: clyi &lt;clyi@alauda.io&gt;
diff --git a/cmd/controller/controller.go b/cmd/controller/controller.go
@@ -8,6 +8,7 @@ import (
 	"net/http/pprof"
 	"os"
 	"slices"
+	"strconv"
 	"time"
 
 	v1 "k8s.io/api/authorization/v1"
@@ -46,6 +47,12 @@ func CmdMain() {
 		util.LogFatalAndExit(err, "failed to parse config")
 	}
 
+	perm, err := strconv.ParseUint(config.LogPerm, 8, 32)
+	if err != nil {
+		util.LogFatalAndExit(err, "failed to parse log-perm")
+	}
+	util.InitLogFilePerm("kube-ovn-controller", os.FileMode(perm))
+
 	if err := checkPermission(config); err != nil {
 		util.LogFatalAndExit(err, "failed to check permission")
 	}
diff --git a/cmd/daemon/cniserver.go b/cmd/daemon/cniserver.go
@@ -8,6 +8,7 @@ import (
 	"os"
 	"path/filepath"
 	"slices"
+	"strconv"
 	"strings"
 	"time"
 
@@ -28,7 +29,6 @@ import (
 
 func main() {
 	defer klog.Flush()
-
 	config := daemon.ParseFlags()
 	klog.Info(versions.String())
 
@@ -38,7 +38,11 @@ func main() {
 		}
 		return
 	}
-
+	perm, err := strconv.ParseUint(config.LogPerm, 8, 32)
+	if err != nil {
+		util.LogFatalAndExit(err, "failed to parse log-perm")
+	}
+	util.InitLogFilePerm("kube-ovn-cni", os.FileMode(perm))
 	printCaps()
 
 	ovs.UpdateOVSVsctlLimiter(config.OVSVsctlConcurrency)
diff --git a/cmd/ovn_ic_controller/ovn_ic_controller.go b/cmd/ovn_ic_controller/ovn_ic_controller.go
@@ -1,6 +1,9 @@
 package ovn_ic_controller
 
 import (
+	"os"
+	"strconv"
+
 	"k8s.io/klog/v2"
 	"kernel.org/pub/linux/libs/security/libcap/cap"
 	"sigs.k8s.io/controller-runtime/pkg/manager/signals"
@@ -23,6 +26,12 @@ func CmdMain() {
 		util.LogFatalAndExit(err, "failed to parse config")
 	}
 
+	perm, err := strconv.ParseUint(config.LogPerm, 8, 32)
+	if err != nil {
+		util.LogFatalAndExit(err, "failed to parse log-perm")
+	}
+	util.InitLogFilePerm("kube-ovn-ic-controller", os.FileMode(perm))
+
 	stopCh := signals.SetupSignalHandler().Done()
 	ctl := ovn_ic_controller.NewController(config)
 	ctl.Run(stopCh)
diff --git a/cmd/ovn_monitor/ovn_monitor.go b/cmd/ovn_monitor/ovn_monitor.go
@@ -3,6 +3,8 @@ package ovn_monitor
 import (
 	"net"
 	"net/http"
+	"os"
+	"strconv"
 	"time"
 
 	"k8s.io/klog/v2"
@@ -19,7 +21,6 @@ import (
 
 func CmdMain() {
 	defer klog.Flush()
-
 	klog.Info(versions.String())
 
 	currentCaps := cap.GetProc()
@@ -30,6 +31,12 @@ func CmdMain() {
 		util.LogFatalAndExit(err, "failed to parse config")
 	}
 
+	perm, err := strconv.ParseUint(config.LogPerm, 8, 32)
+	if err != nil {
+		util.LogFatalAndExit(err, "failed to parse log-perm")
+	}
+	util.InitLogFilePerm("kube-ovn-monitor", os.FileMode(perm))
+
 	ctrl.SetLogger(klog.NewKlogr())
 	ctx := signals.SetupSignalHandler()
 
diff --git a/cmd/pinger/pinger.go b/cmd/pinger/pinger.go
@@ -2,6 +2,8 @@ package pinger
 
 import (
 	_ "net/http/pprof" // #nosec
+	"os"
+	"strconv"
 
 	"k8s.io/klog/v2"
 	"kernel.org/pub/linux/libs/security/libcap/cap"
@@ -16,7 +18,6 @@ import (
 
 func CmdMain() {
 	defer klog.Flush()
-
 	klog.Info(versions.String())
 
 	currentCaps := cap.GetProc()
@@ -27,6 +28,12 @@ func CmdMain() {
 		util.LogFatalAndExit(err, "failed to parse config")
 	}
 
+	perm, err := strconv.ParseUint(config.LogPerm, 8, 32)
+	if err != nil {
+		util.LogFatalAndExit(err, "failed to parse log-perm")
+	}
+	util.InitLogFilePerm("kube-ovn-pinger", os.FileMode(perm))
+
 	ctrl.SetLogger(klog.NewKlogr())
 	ctx := signals.SetupSignalHandler()
 	if config.Mode == "server" {
diff --git a/cmd/speaker/speaker.go b/cmd/speaker/speaker.go
@@ -1,6 +1,9 @@
 package speaker
 
 import (
+	"os"
+	"strconv"
+
 	"k8s.io/klog/v2"
 	"kernel.org/pub/linux/libs/security/libcap/cap"
 	ctrl "sigs.k8s.io/controller-runtime"
@@ -14,7 +17,6 @@ import (
 
 func CmdMain() {
 	defer klog.Flush()
-
 	klog.Info(versions.String())
 
 	currentCaps := cap.GetProc()
@@ -25,6 +27,12 @@ func CmdMain() {
 		util.LogFatalAndExit(err, "failed to parse config")
 	}
 
+	perm, err := strconv.ParseUint(config.LogPerm, 8, 32)
+	if err != nil {
+		util.LogFatalAndExit(err, "failed to parse log-perm")
+	}
+	util.InitLogFilePerm("kube-ovn-speaker", os.FileMode(perm))
+
 	ctrl.SetLogger(klog.NewKlogr())
 	ctx := signals.SetupSignalHandler()
 	go func() {
diff --git a/pkg/controller/config.go b/pkg/controller/config.go
@@ -115,6 +115,9 @@ type Configuration struct {
 
 	// used to set vpc-egress-gateway image
 	Image string
+
+	// used to set log file permission
+	LogPerm string
 }
 
 // ParseFlags parses cmd args then init kubeclient and conf
@@ -196,6 +199,8 @@ func ParseFlags() (*Configuration, error) {
 		argBfdDetectMult = pflag.Int("detect-mult", 3, "The negotiated transmit interval, multiplied by this value, provides the Detection Time for the receiving system in Asynchronous mode.")
 
 		argImage = pflag.String("image", "", "The image for vpc-egress-gateway")
+
+		argLogPerm = pflag.String("log-perm", "640", "The permission for the log file")
 	)
 
 	klogFlags := flag.NewFlagSet("klog", flag.ExitOnError)
@@ -282,6 +287,7 @@ func ParseFlags() (*Configuration, error) {
 		BfdDetectMult:                  *argBfdDetectMult,
 		EnableANP:                      *argEnableANP,
 		Image:                          *argImage,
+		LogPerm:                        *argLogPerm,
 	}
 
 	if config.NetworkType == util.NetworkTypeVlan && config.DefaultHostInterface == "" {
diff --git a/pkg/daemon/config.go b/pkg/daemon/config.go
@@ -75,6 +75,7 @@ type Configuration struct {
 	EnableTProxy              bool
 	OVSVsctlConcurrency       int32
 	SetVxlanTxOff             bool
+	LogPerm                   string
 }
 
 // ParseFlags will parse cmd args then init kubeClient and configuration
@@ -120,6 +121,7 @@ func ParseFlags() *Configuration {
 		argOVSVsctlConcurrency       = pflag.Int32("ovs-vsctl-concurrency", 100, "concurrency limit of ovs-vsctl")
 		argEnableOVNIPSec            = pflag.Bool("enable-ovn-ipsec", false, "Whether to enable ovn ipsec")
 		argSetVxlanTxOff             = pflag.Bool("set-vxlan-tx-off", false, "Whether to set vxlan_sys_4789 tx off")
+		argLogPerm                   = pflag.String("log-perm", "640", "The permission for the log file")
 	)
 
 	// mute info log for ipset lib
@@ -181,6 +183,7 @@ func ParseFlags() *Configuration {
 		EnableTProxy:              *argEnableTProxy,
 		OVSVsctlConcurrency:       *argOVSVsctlConcurrency,
 		SetVxlanTxOff:             *argSetVxlanTxOff,
+		LogPerm:                   *argLogPerm,
 	}
 	return config
 }
diff --git a/pkg/ovn_ic_controller/config.go b/pkg/ovn_ic_controller/config.go
@@ -32,6 +32,7 @@ type Configuration struct {
 	NodeSwitch     string
 	ClusterRouter  string
 	NodeSwitchCIDR string
+	LogPerm        string
 }
 
 func ParseFlags() (*Configuration, error) {
@@ -48,6 +49,7 @@ func ParseFlags() (*Configuration, error) {
 		argClusterRouter  = pflag.String("cluster-router", util.DefaultVpc, "The router name for cluster router")
 		argNodeSwitch     = pflag.String("node-switch", "join", "The name of node gateway switch which help node to access pod network")
 		argNodeSwitchCIDR = pflag.String("node-switch-cidr", "100.64.0.0/16", "The cidr for node switch")
+		argLogPerm        = pflag.String("log-perm", "640", "The permission for the log file")
 	)
 
 	klogFlags := flag.NewFlagSet("klog", flag.ContinueOnError)
@@ -88,6 +90,7 @@ func ParseFlags() (*Configuration, error) {
 		ClusterRouter:  *argClusterRouter,
 		NodeSwitch:     *argNodeSwitch,
 		NodeSwitchCIDR: *argNodeSwitchCIDR,
+		LogPerm:        *argLogPerm,
 	}
 
 	if err := config.initKubeClient(); err != nil {
diff --git a/pkg/ovnmonitor/config.go b/pkg/ovnmonitor/config.go
@@ -45,6 +45,7 @@ type Configuration struct {
 	EnableMetrics                   bool
 	SecureServing                   bool
 	MetricsPort                     int32
+	LogPerm                         string
 }
 
 // ParseFlags get parameters information.
@@ -88,6 +89,8 @@ func ParseFlags() (*Configuration, error) {
 		argServiceVswitchdFilePidPath = pflag.String("service.vswitchd.file.pid.path", "/var/run/openvswitch/ovs-vswitchd.pid", "OVS vswitchd daemon process id file.")
 		argServiceNorthdFileLogPath   = pflag.String("service.ovn.northd.file.log.path", "/var/log/ovn/ovn-northd.log", "OVN northd daemon log file.")
 		argServiceNorthdFilePidPath   = pflag.String("service.ovn.northd.file.pid.path", "/var/run/ovn/ovn-northd.pid", "OVN northd daemon process id file.")
+
+		argLogPerm = pflag.String("log-perm", "640", "The permission for the log file")
 	)
 
 	klogFlags := flag.NewFlagSet("klog", flag.ExitOnError)
@@ -144,6 +147,7 @@ func ParseFlags() (*Configuration, error) {
 		EnableMetrics:                   *argEnableMetrics,
 		SecureServing:                   *argSecureServing,
 		MetricsPort:                     *argMetricsPort,
+		LogPerm:                         *argLogPerm,
 	}
 
 	klog.Infof("ovn monitor config is %+v", config)
diff --git a/pkg/pinger/config.go b/pkg/pinger/config.go
@@ -54,6 +54,7 @@ type Configuration struct {
 	TCPConnCheckPort                int32
 	UDPConnCheckPort                int32
 	TargetIPPorts                   string
+	LogPerm                         string
 }
 
 func ParseFlags() (*Configuration, error) {
@@ -91,6 +92,7 @@ func ParseFlags() (*Configuration, error) {
 		argServiceVswitchdFilePidPath      = pflag.String("service.vswitchd.file.pid.path", "/var/run/openvswitch/ovs-vswitchd.pid", "OVS vswitchd daemon process id file.")
 		argServiceOvnControllerFileLogPath = pflag.String("service.ovncontroller.file.log.path", "/var/log/ovn/ovn-controller.log", "OVN controller daemon log file.")
 		argServiceOvnControllerFilePidPath = pflag.String("service.ovncontroller.file.pid.path", "/var/run/ovn/ovn-controller.pid", "OVN controller daemon process id file.")
+		argLogPerm                         = pflag.String("log-perm", "640", "The permission for the log file")
 	)
 	klogFlags := flag.NewFlagSet("klog", flag.ExitOnError)
 	klog.InitFlags(klogFlags)
@@ -148,6 +150,7 @@ func ParseFlags() (*Configuration, error) {
 		ServiceVswitchdFilePidPath:      *argServiceVswitchdFilePidPath,
 		ServiceOvnControllerFileLogPath: *argServiceOvnControllerFileLogPath,
 		ServiceOvnControllerFilePidPath: *argServiceOvnControllerFilePidPath,
+		LogPerm:                         *argLogPerm,
 	}
 	if err := config.initKubeClient(); err != nil {
 		return nil, err
diff --git a/pkg/speaker/config.go b/pkg/speaker/config.go
@@ -66,6 +66,7 @@ type Configuration struct {
 	KubeOvnClient  clientset.Interface
 
 	PprofPort int32
+	LogPerm   string
 }
 
 func ParseFlags() (*Configuration, error) {
@@ -92,6 +93,7 @@ func ParseFlags() (*Configuration, error) {
 		argExtendedNexthop             = pflag.BoolP("extended-nexthop", "", false, "Announce IPv4/IPv6 prefixes to every neighbor, no matter their AFI")
 		argNatGwMode                   = pflag.BoolP("nat-gw-mode", "", false, "Make the BGP speaker announce EIPs from inside a NAT gateway, Pod IP/Service/Subnet announcements will be disabled")
 		argEnableMetrics               = pflag.BoolP("enable-metrics", "", true, "Whether to support metrics query")
+		argLogPerm                     = pflag.String("log-perm", "640", "The permission for the log file")
 	)
 	klogFlags := flag.NewFlagSet("klog", flag.ExitOnError)
 	klog.InitFlags(klogFlags)
@@ -158,6 +160,7 @@ func ParseFlags() (*Configuration, error) {
 		ExtendedNexthop:             *argExtendedNexthop,
 		NatGwMode:                   *argNatGwMode,
 		EnableMetrics:               *argEnableMetrics,
+		LogPerm:                     *argLogPerm,
 	}
 
 	if *argNeighborAddress != "" {
diff --git a/pkg/util/log.go b/pkg/util/log.go
@@ -0,0 +1,21 @@
+package util
+
+import (
+	"log"
+	"os"
+)
+
+func InitLogFilePerm(moduleName string, perm os.FileMode) {
+	logPath := "/var/log/kube-ovn/" + moduleName + ".log"
+	if _, err := os.Stat(logPath); os.IsNotExist(err) {
+		f, err := os.OpenFile(logPath, os.O_CREATE|os.O_WRONLY|os.O_APPEND, perm)
+		if err != nil {
+			log.Fatalf("failed to create log file: %v", err)
+		}
+		f.Close()
+	} else {
+		if err := os.Chmod(logPath, perm); err != nil {
+			log.Fatalf("failed to chmod log file: %v", err)
+		}
+	}
+}

Original file line number	Diff line number	Diff line change
`@@ -75,6 +75,7 @@ type Configuration struct {`
`75`	`75`	`EnableTProxy bool`
`76`	`76`	`OVSVsctlConcurrency int32`
`77`	`77`	`SetVxlanTxOff bool`
	`78`	`+ LogPerm string`
`78`	`79`	`}`
`79`	`80`
`80`	`81`	`// ParseFlags will parse cmd args then init kubeClient and configuration`
`@@ -120,6 +121,7 @@ func ParseFlags() *Configuration {`
`120`	`121`	`argOVSVsctlConcurrency = pflag.Int32("ovs-vsctl-concurrency", 100, "concurrency limit of ovs-vsctl")`
`121`	`122`	`argEnableOVNIPSec = pflag.Bool("enable-ovn-ipsec", false, "Whether to enable ovn ipsec")`
`122`	`123`	`argSetVxlanTxOff = pflag.Bool("set-vxlan-tx-off", false, "Whether to set vxlan_sys_4789 tx off")`
	`124`	`+ argLogPerm = pflag.String("log-perm", "640", "The permission for the log file")`
`123`	`125`	`)`
`124`	`126`
`125`	`127`	`// mute info log for ipset lib`
`@@ -181,6 +183,7 @@ func ParseFlags() *Configuration {`
`181`	`183`	`EnableTProxy: *argEnableTProxy,`
`182`	`184`	`OVSVsctlConcurrency: *argOVSVsctlConcurrency,`
`183`	`185`	`SetVxlanTxOff: *argSetVxlanTxOff,`
	`186`	`+ LogPerm: *argLogPerm,`
`184`	`187`	`}`
`185`	`188`	`return config`
`186`	`189`	`}`
Original file line number	Diff line number	Diff line change
`@@ -32,6 +32,7 @@ type Configuration struct {`
`32`	`32`	`NodeSwitch string`
`33`	`33`	`ClusterRouter string`
`34`	`34`	`NodeSwitchCIDR string`
	`35`	`+ LogPerm string`
`35`	`36`	`}`
`36`	`37`
`37`	`38`	`func ParseFlags() (*Configuration, error) {`
`@@ -48,6 +49,7 @@ func ParseFlags() (*Configuration, error) {`
`48`	`49`	`argClusterRouter = pflag.String("cluster-router", util.DefaultVpc, "The router name for cluster router")`
`49`	`50`	`argNodeSwitch = pflag.String("node-switch", "join", "The name of node gateway switch which help node to access pod network")`
`50`	`51`	`argNodeSwitchCIDR = pflag.String("node-switch-cidr", "100.64.0.0/16", "The cidr for node switch")`
	`52`	`+ argLogPerm = pflag.String("log-perm", "640", "The permission for the log file")`
`51`	`53`	`)`
`52`	`54`
`53`	`55`	`klogFlags := flag.NewFlagSet("klog", flag.ContinueOnError)`
`@@ -88,6 +90,7 @@ func ParseFlags() (*Configuration, error) {`
`88`	`90`	`ClusterRouter: *argClusterRouter,`
`89`	`91`	`NodeSwitch: *argNodeSwitch,`
`90`	`92`	`NodeSwitchCIDR: *argNodeSwitchCIDR,`
	`93`	`+ LogPerm: *argLogPerm,`
`91`	`94`	`}`
`92`	`95`
`93`	`96`	`if err := config.initKubeClient(); err != nil {`