access-log: false ignored for auth-url

[stevewolter]

NGINX Ingress controller version: head, 0.13.0

What happened:

When I set these annotations, access logs are written for the endpoint:

nginx.ingress.kubernetes.io/enable-access-log: "false"
nginx.ingress.kubernetes.io/auth-url: "http://foo/bar"

What you expected to happen:

No access logs should be written.

Anything else we need to know:

I suspect that the access logs are written by the second location entry that's created for the auth-url.

[aledbf]

No access logs should be written.

This works as expected. The annotations are applied to the path of the ingress, not other annotations (like auth-url)

[stevewolter]

This kind of defeats the purpose of enable-access-log: false for security-sensitive URLs (e.g. when you have to pass authentication information in query strings when the involved software doesn't support Authorization headers). I haven't found a way to inject "access_log: off" into the auth-url handler - should there be one?

[day0ops]

@aledbf so whats the way forward for this ?

[aledbf]

@nixgadget fix the issue in the template checking if the log is disabled inside the auth location

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

[k8s-ci-robot]

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.