api: add stdout audit logger for RBAC audit logging. #26453
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| # DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py. | ||
|
|
||
| load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package") | ||
|
|
||
| licenses(["notice"]) # Apache 2 | ||
|
|
||
| api_proto_package( | ||
| deps = ["@com_github_cncf_udpa//udpa/annotations:pkg"], | ||
| ) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| syntax = "proto3"; | ||
|
|
||
| package envoy.extensions.rbac.audit_loggers.stream.v3; | ||
|
|
||
| import "udpa/annotations/status.proto"; | ||
|
|
||
| option java_package = "io.envoyproxy.envoy.extensions.rbac.audit_loggers.stream.v3"; | ||
| option java_outer_classname = "StreamProto"; | ||
| option java_multiple_files = true; | ||
| option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/rbac/audit_loggers/stream/v3;streamv3"; | ||
| option (udpa.annotations.file_status).package_version_status = ACTIVE; | ||
|
|
||
| // [#protodoc-title: Standard Streams RBAC Audit Loggers] | ||
| // [#not-implemented-hide:] | ||
|
|
||
| // Custom configuration for the RBAC audit logger that writes log entries | ||
| // directly to the operating system's standard output. | ||
| // The logger outputs in JSON format and is currently not configurable. | ||
| message StdoutAuditLog { | ||
|
There was a problem hiding this comment. I think the directory/file names and the proto name should match. If we're calling this There was a problem hiding this comment. Oh, wait, just realized that these names are what is used for the stdout access logger you mentioned above. In that case, this is fine as-is. |
||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
stdout is only one type of log sink, that may not be usable by everyone. Please add something similar to the request access log configuration https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/accesslog/v3/accesslog.proto#config-accesslog-v3-accesslog which allows different implementations of log sinks (i.e. gRPC).
You can exclude the
filterfield, since there are no defined filtering semantics for RBAC log yet (although I can see someone only logging denied requests).There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the review! I realized I forgot to include enough context in the PR description, this logger type is specifically for the API created in #26001 (#26415 as an amendment). The
AuditConditionthere specifies when to log the request and the logger configuration itself is already aTypedExtensionConfig. We don't need an access log like configuration in this case, right?