Audit Sink Configuration#

Flipt's audit subsystem routes mutation events (flag created, token deleted, etc.) to one or more sinks. Everything — which sinks are active, how events are buffered, and which event types are emitted — is controlled by the audit block in Flipt's configuration file, modelled by AuditConfig.

Configuration Model#

internal/config/audit.go defines the full config schema:

All three sinks default to enabled: false 1. Kafka defaults to protobuf encoding 2.

Enabled() check — AuditConfig.Enabled() returns true if any of the three sinks has its Enabled flag set. This is the single gate used throughout initialization.

Validation#

AuditConfig.validate() runs at startup and enforces:

• Webhook (when enabled): exactly one of url or templates must be provided — not both, not neither 3.
• Kafka (when enabled): topic and at least one bootstrap_servers entry are required 4.
• Buffer capacity: must be between 2 and 10 5.
• Buffer flush_period: must be between 2 minutes and 5 minutes 6.

The log sink has no additional validation beyond the Enabled flag.

Initialization in grpc.go#

Audit sinks are wired up in internal/cmd/grpc.go during gRPC server construction:

1. Event checker setup 7

A NoOpChecker is the default (rejects all events). If cfg.Audit.Enabled() is true, audit.NewChecker(cfg.Audit.Events) is called instead, expanding the configured noun:verb patterns into a concrete allow-set.

2. Sink construction 8

Each sink type is instantiated only if its Enabled flag is set:

• Log sink — log.NewSink is called with optional WithPath and WithEncoding options. If no encoding is specified, the global cfg.Log.Encoding is inherited 9.
• Webhook sink — If URL is non-empty, a basic webhook sink is created; if Templates is non-empty, a template sink is used instead 10. The max backoff defaults to 15 s if not configured 11.
• Kafka sink — kafka.NewSink is called with the full KafkaSinkConfig.

3. Middleware and exporter wiring 12

If the sinks slice is non-empty:

• AuditEventUnaryInterceptor is added to the gRPC interceptor chain, carrying the checker.
• A SinkSpanExporter is created and registered with the OTel tracing provider via a batch span processor, using buffer.flush_period and buffer.capacity from config 13.
• A shutdown hook is registered to drain and close the exporter 14.

Event Filtering: EventPairChecker#

internal/server/audit/checker.go implements the filtering interface:

• Checker — built from cfg.Audit.Events, expands wildcard patterns at construction time. Valid nouns: constraint, distribution, flag, namespace, rollout, rule, segment, token, variant (or * for all). Valid verbs: created, deleted, updated (or * for all). Duplicate pairs and unrecognised tokens are rejected with an error 15.
• NoOpChecker — always returns false; used when audit is disabled 16.

The AuditEventUnaryInterceptor defers event emission until after the handler returns, then calls eventPairChecker.Check("noun:verb") for each collected event. Only matching events are added to the OTel span 17, where the SinkSpanExporter later picks them up and dispatches them to every registered sink 18.

Key Source Files#