debakkerb
commented
3 years ago I have the exact same issue in my environment. I only added the always_violets-policy, so I didn't customise any of the Config Validator constraints. I tested the rules, to see if that made a difference and that worked fine. It's Config Validator that causes issues.
These are the roles assigned to the Service Account attached to the VM that runs Forseti:
forseti_identity_org_roles = [
"roles/appengine.appViewer",
"roles/bigquery.metadataViewer",
"roles/browser",
"roles/cloudasset.viewer",
"roles/cloudsql.viewer",
"roles/compute.networkViewer",
"roles/iam.securityReviewer",
"roles/orgpolicy.policyViewer",
"roles/servicemanagement.quotaViewer",
"roles/serviceusage.serviceUsageConsumer"
]
forseti_identity_project_roles = [
"roles/cloudsql.client",
"roles/logging.logWriter",
"roles/monitoring.metricWriter",
"roles/storage.objectViewer",
"roles/storage.objectCreator"
]This is my terraform configuration for Forseti:
module "forseti" {
source = "terraform-google-modules/forseti/google"
version = "~> 5.2.2"
gsuite_admin_email = "XYZ@XYZ.co.uk"
domain = "XXXYYYZZZ"
project_id = module.forseti_project.project_id
org_id = local.organization_id
composite_root_resources = [
"organizations/${local.organization_id}"
]
server_private = true
client_enabled = false
cloudsql_private = true
server_region = "europe-west2"
cloudsql_region = "europe-west2"
storage_bucket_location = "europe-west2"
bucket_cai_location = "europe-west2"
network = google_compute_network.forseti_network.name
subnetwork = google_compute_subnetwork.forseti_subnetwork.id
server_service_account = google_service_account.forseti_identity.email
cscc_violations_enabled = true
cscc_source_id = local.forseti_source_id
server_type = "n1-standard-4"
admin_disable_polling = true
server_grpc_allow_ranges = []
# Scanners
enabled_apis_enabled = false
blacklist_enabled = false
bigquery_enabled = false
bucket_acl_enabled = false
cloudsql_acl_enabled = false
audit_logging_enabled = false
firewall_rule_enabled = false
forwarding_rule_enabled = false
group_enabled = false
groups_settings_enabled = false
iam_policy_enabled = false
iap_enabled = false
instance_network_interface_enabled = false
ke_scanner_enabled = false
ke_version_scanner_enabled = false
kms_scanner_enabled = false
lien_enabled = false
location_enabled = false
log_sink_enabled = false
resource_enabled = false
role_enabled = false
service_account_key_enabled = false
cloudbilling_disable_polling = true
compute_disable_polling = true
container_disable_polling = true
crm_disable_polling = true
groups_settings_disable_polling = true
iam_disable_polling = true
logging_disable_polling = true
servicemanagement_disable_polling = true
serviceusage_disable_polling = true
sqladmin_disable_polling = true
appengine_disable_polling = true
bigquery_disable_polling = true
storage_disable_polling = true
config_validator_enabled = true
config_validator_violations_should_notify = true
}I've stepped through the run_forseti.sh-script line by line and validated the logs. The error is thrown when running the command scanner_command=forseti scanner run.
onetwopunch
krab-skunk
nkaravias
ralsu091
I've just migrated to use Config Validator using Terraform. I have a few custom Rego files, all of which pass tests locally and are fairly simple. The config-validator service is running just fine on the server (i.e.
sudo systemctl status config-validator). When I run forseti using the command in the crontab I get a 500 error:Received RST_STREAM with error code 2, which, I'm assuming, is why none of my config validator constraints are being executed. I've tried this multiple times with the same error so it's not an ephemeral error. At the time of running it https://status.cloud.google.com/ is all green too so I'm not sure what's going on.Steps to reproduce (from the forseti-server)
Full Error from Cloud Logging