feat(inbound): Log traffic with the 'audit' policy

linkerd/app/inbound/src/policy/defaults.rs

@@ -36,6 +36,15 @@ pub fn cluster_unauthenticated(
     )
 }
 
+pub fn audit(timeout: Duration) -> ServerPolicy {
+    mk(
+        "audit",
+        all_nets(),
+        Authentication::Unauthenticated,
+        timeout,
+    )
+}
+
 pub fn all_mtls_unauthenticated(timeout: Duration) -> ServerPolicy {
     mk(
         "all-tls-unauthenticated",

linkerd/app/inbound/src/policy/http.rs

@@ -202,7 +202,25 @@ impl<T, N> HttpPolicyService<T, N> {
             .iter()
             .find(|a| super::is_authorized(a, self.connection.client, &self.connection.tls))
         {
-            Some(authz) => authz,
+            Some(authz) => {
+                if authz.meta.is_audit() {
+                    tracing::info!(
+                        server.group = %labels.server.0.group(),
+                        server.kind = %labels.server.0.kind(),
+                        server.name = %labels.server.0.name(),
+                        route.group = %labels.route.group(),
+                        route.kind = %labels.route.kind(),
+                        route.name = %labels.route.name(),
+                        client.tls = ?self.connection.tls,
+                        client.ip = %self.connection.client.ip(),
+                        authz.group = %authz.meta.group(),
+                        authz.kind = %authz.meta.kind(),
+                        authz.name = %authz.meta.name(),
+                        "Request allowed",
+                    );
+                }
+                authz
+            }
             None => {
                 tracing::info!(
                     server.group = %labels.server.0.group(),

linkerd/app/inbound/src/policy/tcp.rs

@@ -194,6 +194,19 @@ fn check_authorized(
     {
         for authz in &**authzs {
             if super::is_authorized(authz, client_addr, tls) {
+                if authz.meta.is_audit() {
+                    tracing::info!(
+                        server.group = %server.meta.group(),
+                        server.kind = %server.meta.kind(),
+                        server.name = %server.meta.name(),
+                        client.tls = ?tls,
+                        client.ip = %client_addr.ip(),
+                        authz.group = %authz.meta.group(),
+                        authz.kind = %authz.meta.kind(),
+                        authz.name = %authz.meta.name(),
+                        "Request allowed",
+                    );
+                }
                 return Ok(ServerPermit::new(dst, server, authz));
             }
         }

linkerd/app/src/env.rs

@@ -1025,6 +1025,8 @@ fn parse_default_policy(
         )
         .into()),
 
+        "audit" => Ok(inbound::policy::defaults::audit(detect_timeout).into()),
+
         name => Err(ParseError::InvalidPortPolicy(name.to_string())),
     }
 }

linkerd/proxy/server-policy/src/meta.rs

@@ -39,6 +39,10 @@ impl Meta {
             Self::Resource { group, .. } => group,
         }
     }
+
+    pub fn is_audit(&self) -> bool {
+        self.kind() == "default" && self.name() == "audit"
+    }
 }
 
 impl std::cmp::PartialEq for Meta {