From caab886094ebfeef1c1245d7b88b5bcf22416c33 Mon Sep 17 00:00:00 2001 From: Sebastian Lohff Date: Mon, 13 Jul 2026 16:25:48 +0200 Subject: [PATCH 1/2] Remove duplicated VPNaaS Neutron config The VPNaaS endpoints were added in ~2017 and then duplicated in 2023 when additional endpoints were added. The second set of keys in the dict will override the first set, making the first set a noop. Currently they are the same, but in the future they might not, therefore we remove them. --- etc/neutron_audit_map.yaml | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/etc/neutron_audit_map.yaml b/etc/neutron_audit_map.yaml index b2f2a16..e0ce4d5 100644 --- a/etc/neutron_audit_map.yaml +++ b/etc/neutron_audit_map.yaml @@ -165,15 +165,3 @@ resources: ipsec-site-connections: vpnservices: type_uri: network/vpn/vpn-services - singleton: true - children: - endpoint-groups: - ikepolicies: - type_uri: network/vpn/ike-policies - el_type_uri: network/vpn/ike-policy - ipsecpolicies: - type_uri: network/vpn/ipsec-policies - el_type_uri: network/vpn/ipsec-policy - ipsec-site-connections: - vpnservices: - type_uri: network/vpn/vpn-services From 989c82a0a16e6d0474887072d4b16b3ece00c9e5 Mon Sep 17 00:00:00 2001 From: Sebastian Lohff Date: Mon, 13 Jul 2026 16:27:59 +0200 Subject: [PATCH 2/2] Ignore psk for Neutron VPNaaS IPsec Site Conn We don't want to log the psk of an IPsec Site Connection for operations on this object in the scope of Neutron's VPNaaS plugin. --- etc/neutron_audit_map.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/etc/neutron_audit_map.yaml b/etc/neutron_audit_map.yaml index e0ce4d5..665fa54 100644 --- a/etc/neutron_audit_map.yaml +++ b/etc/neutron_audit_map.yaml @@ -163,5 +163,8 @@ resources: type_uri: network/vpn/ipsec-policies el_type_uri: network/vpn/ipsec-policy ipsec-site-connections: + payloads: + exclude: + - psk vpnservices: type_uri: network/vpn/vpn-services