Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Avoid logging 'headers' in log messages from the vault injector #634

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

tspearconquest
Copy link
Contributor

Before this PR, log messages look like:

I1109 01:48:45.143453       1 version.go:31] "version info" version="" commit="" buildDate="2023-10-17T20:02:53Z" component="vaultenv"
I1109 01:48:45.143527       1 main.go:181] "azure key vault env injector initializing"
E1109 01:48:45.143582       1 main.go:225] "failed validating config" err="environment variable ENV_INJECTOR_ARGS_SIGNATURE not provided or empty"

After this PR, log messages look like:

"version info" version="" commit="" buildDate="2023-10-16T20:02:48Z" component="webhook"
"active settings" httpPort="8080" httpPortExternal="80" tlsPort="8443" tlsPortExternal="443" mtlsPort="9443" mtlsPortExternal="9443" serveMetrics=false authType="cloudConfig" useAuthService=true dockerInspectionTimeout=20 cloudConfigPath="/etc/kubernetes/azure.json" logLevel="0" authServiceName="" mtlsPortExternal="9443" mtlsPort="9443"
"failed to build kube config" err="invalid configuration: no configuration has been provided, try setting KUBERNETES_MASTER environment variable"

This is particularly pertinent when json format logging is enabled, because these headers are prefixed before the opening { of the json data, which breaks all json log parsing.

Getting json format logging in the vault injector is a separate issue.

@waterfoul
Copy link

Might want to add some sort of indicator to the logs to show it's from the vault injector instead of the application itself. Before I was looking for the I/E prefix to distinguish them

@tspearconquest
Copy link
Contributor Author

Thanks, that's exactly why I pinged you to take a look. I appreciate the heads up. I agree, there should be something to distinguish these from the app, so would you say we should configure an additional field in the logs which indicates the source?

@waterfoul
Copy link

waterfoul commented Nov 9, 2023

That would work perfectly. Just adding source=akv2k8s-injector would be sufficient

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants