Skip to content

Commit 9eeebc9

Browse files
hafehafe
authored
Make access_log in http context configurable (#5648)
1 parent 5a50bd9 commit 9eeebc9

File tree

9 files changed

+139
-35
lines changed

9 files changed

+139
-35
lines changed

‎docs/content/configuration/global-configuration/configmap-resource.md

+2
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,8 @@ For more information, view the [VirtualServer and VirtualServerRoute resources](
113113
|ConfigMap Key | Description | Default | Example |
114114
| ---| ---| ---| --- |
115115
|*error-log-level* | Sets the global [error log level](https://nginx.org/en/docs/ngx_core_module.html#error_log) for NGINX. | *notice* | |
116+
|*access-log* | Sets the directive [access log](https://nginx.org/en/docs/http/ngx_http_log_module.html#access_log). A syslog destination is the only valid value. The value will be set to its default in-case user tries to configure it with location other than a syslog.
117+
| ``/dev/stdout main`` | ``syslog:server=localhost:514`` |
116118
|*access-log-off* | Disables the [access log](https://nginx.org/en/docs/http/ngx_http_log_module.html#access_log). | *False* | |
117119
|*default-server-access-log-off* | Disables the [access log](https://nginx.org/en/docs/http/ngx_http_log_module.html#access_log) for the default server. If access log is disabled globally (*access-log-off: "True"*), then the default server access log is always disabled. | *False* | |
118120
|*log-format* | Sets the custom [log format](https://nginx.org/en/docs/http/ngx_http_log_module.html#log_format) for HTTP and HTTPS traffic. For convenience, it is possible to define the log format across multiple lines (each line separated by *\n*). In that case, the Ingress Controller will replace every *\n* character with a space character. All *'* characters must be escaped. | See the [template file](https://github.com/nginxinc/kubernetes-ingress/blob/v{{< nic-version >}}/internal/configs/version1/nginx.tmpl) for the access log. | [Custom Log Format](https://github.com/nginxinc/kubernetes-ingress/tree/v{{< nic-version >}}/examples/shared-examples/custom-log-format). |

‎internal/configs/config_params.go

+2-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ type ConfigParams struct {
2424
Keepalive int
2525
LBMethod string
2626
LocationSnippets []string
27-
MainAccessLogOff bool
27+
MainAccessLog string
2828
MainErrorLogLevel string
2929
MainHTTPSnippets []string
3030
MainKeepaliveRequests int64
@@ -188,6 +188,7 @@ func NewDefaultConfigParams(isPlus bool) *ConfigParams {
188188
ProxySendTimeout: "60s",
189189
ClientMaxBodySize: "1m",
190190
SSLRedirect: true,
191+
MainAccessLog: "/dev/stdout main",
191192
MainServerNamesHashBucketSize: "256",
192193
MainServerNamesHashMaxSize: "1024",
193194
MainMapHashBucketSize: "256",

‎internal/configs/configmaps.go

+12-2
Original file line numberDiff line numberDiff line change
@@ -207,11 +207,21 @@ func ParseConfigMap(cfgm *v1.ConfigMap, nginxPlus bool, hasAppProtect bool, hasA
207207
cfgParams.MainErrorLogLevel = errorLogLevel
208208
}
209209

210+
if accessLog, exists := cfgm.Data["access-log"]; exists {
211+
if !strings.HasPrefix(accessLog, "syslog:") {
212+
glog.Warningf("Configmap %s/%s: Invalid value for key access-log: %q", cfgm.GetNamespace(), cfgm.GetName(), accessLog)
213+
} else {
214+
cfgParams.MainAccessLog = accessLog
215+
}
216+
}
217+
210218
if accessLogOff, exists, err := GetMapKeyAsBool(cfgm.Data, "access-log-off", cfgm); exists {
211219
if err != nil {
212220
glog.Error(err)
213221
} else {
214-
cfgParams.MainAccessLogOff = accessLogOff
222+
if accessLogOff {
223+
cfgParams.MainAccessLog = "off"
224+
}
215225
}
216226
}
217227

@@ -514,7 +524,7 @@ func ParseConfigMap(cfgm *v1.ConfigMap, nginxPlus bool, hasAppProtect bool, hasA
514524
// GenerateNginxMainConfig generates MainConfig.
515525
func GenerateNginxMainConfig(staticCfgParams *StaticConfigParams, config *ConfigParams) *version1.MainConfig {
516526
nginxCfg := &version1.MainConfig{
517-
AccessLogOff: config.MainAccessLogOff,
527+
AccessLog: config.MainAccessLog,
518528
DefaultServerAccessLogOff: config.DefaultServerAccessLogOff,
519529
DefaultServerReturn: config.DefaultServerReturn,
520530
DisableIPV6: staticCfgParams.DisableIPV6,

‎internal/configs/configmaps_test.go

+79
Original file line numberDiff line numberDiff line change
@@ -203,3 +203,82 @@ func TestParseConfigMapWithoutTLSPassthroughProxyProtocol(t *testing.T) {
203203
})
204204
}
205205
}
206+
207+
func TestParseConfigMapAccessLog(t *testing.T) {
208+
t.Parallel()
209+
tests := []struct {
210+
accessLog string
211+
accessLogOff string
212+
want string
213+
msg string
214+
}{
215+
{
216+
accessLogOff: "False",
217+
accessLog: "syslog:server=localhost:514",
218+
want: "syslog:server=localhost:514",
219+
msg: "Non default access_log",
220+
},
221+
{
222+
accessLogOff: "False",
223+
accessLog: "/tmp/nginx main",
224+
want: "/dev/stdout main",
225+
msg: "access_log to file is not allowed",
226+
},
227+
{
228+
accessLogOff: "True",
229+
accessLog: "/dev/stdout main",
230+
want: "off",
231+
msg: "Disabled access_log",
232+
},
233+
}
234+
nginxPlus := true
235+
hasAppProtect := false
236+
hasAppProtectDos := false
237+
hasTLSPassthrough := false
238+
for _, test := range tests {
239+
t.Run(test.msg, func(t *testing.T) {
240+
cm := &v1.ConfigMap{
241+
Data: map[string]string{
242+
"access-log": test.accessLog,
243+
"access-log-off": test.accessLogOff,
244+
},
245+
}
246+
result := ParseConfigMap(cm, nginxPlus, hasAppProtect, hasAppProtectDos, hasTLSPassthrough)
247+
if result.MainAccessLog != test.want {
248+
t.Errorf("want %q, got %q", test.want, result.MainAccessLog)
249+
}
250+
})
251+
}
252+
}
253+
254+
func TestParseConfigMapAccessLogDefault(t *testing.T) {
255+
t.Parallel()
256+
tests := []struct {
257+
accessLog string
258+
accessLogOff string
259+
want string
260+
msg string
261+
}{
262+
{
263+
want: "/dev/stdout main",
264+
msg: "Default access_log",
265+
},
266+
}
267+
nginxPlus := true
268+
hasAppProtect := false
269+
hasAppProtectDos := false
270+
hasTLSPassthrough := false
271+
for _, test := range tests {
272+
t.Run(test.msg, func(t *testing.T) {
273+
cm := &v1.ConfigMap{
274+
Data: map[string]string{
275+
"access-log-off": "False",
276+
},
277+
}
278+
result := ParseConfigMap(cm, nginxPlus, hasAppProtect, hasAppProtectDos, hasTLSPassthrough)
279+
if result.MainAccessLog != test.want {
280+
t.Errorf("want %q, got %q", test.want, result.MainAccessLog)
281+
}
282+
})
283+
}
284+
}

‎internal/configs/version1/__snapshots__/template_test.snap

+32-21
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ http {
3434
default $upstream_trailer_grpc_status;
3535
'' $sent_http_grpc_status;
3636
}
37-
access_log /dev/stdout main;
37+
access_log /dev/stdout main;
3838

3939
sendfile on;
4040
#tcp_nopush on;
@@ -164,7 +164,8 @@ http {
164164
' "$http_referer" "$http_user_agent"'
165165
;
166166
app_protect_dos_arb_fqdn arb.test.server.com;
167-
access_log /dev/stdout main;
167+
168+
access_log /dev/stdout main;
168169
app_protect_failure_mode_action pass;
169170
app_protect_compressed_requests_action pass;
170171
app_protect_cookie_seed ABCDEFGHIJKLMNOP;
@@ -306,7 +307,8 @@ http {
306307
'' $sent_http_grpc_status;
307308
}
308309
app_protect_enforcer_address enforcer.svc.local;
309-
access_log /dev/stdout main;
310+
311+
access_log /dev/stdout main;
310312
311313
sendfile on;
312314
#tcp_nopush on;
@@ -1711,7 +1713,8 @@ http {
17111713
default $upstream_trailer_grpc_status;
17121714
'' $sent_http_grpc_status;
17131715
}
1714-
access_log /dev/stdout main;
1716+
1717+
access_log /dev/stdout main;
17151718
17161719
sendfile on;
17171720
#tcp_nopush on;
@@ -1848,7 +1851,8 @@ http {
18481851
default $upstream_trailer_grpc_status;
18491852
'' $sent_http_grpc_status;
18501853
}
1851-
access_log /dev/stdout main;
1854+
1855+
access_log /dev/stdout main;
18521856
18531857
sendfile on;
18541858
#tcp_nopush on;
@@ -1985,7 +1989,8 @@ http {
19851989
default $upstream_trailer_grpc_status;
19861990
'' $sent_http_grpc_status;
19871991
}
1988-
access_log /dev/stdout main;
1992+
1993+
access_log /dev/stdout main;
19891994
19901995
sendfile on;
19911996
#tcp_nopush on;
@@ -2122,7 +2127,8 @@ http {
21222127
default $upstream_trailer_grpc_status;
21232128
'' $sent_http_grpc_status;
21242129
}
2125-
access_log /dev/stdout main;
2130+
2131+
access_log /dev/stdout main;
21262132
21272133
sendfile on;
21282134
#tcp_nopush on;
@@ -2259,7 +2265,8 @@ http {
22592265
default $upstream_trailer_grpc_status;
22602266
'' $sent_http_grpc_status;
22612267
}
2262-
access_log /dev/stdout main;
2268+
2269+
access_log /dev/stdout main;
22632270
22642271
sendfile on;
22652272
#tcp_nopush on;
@@ -2422,7 +2429,8 @@ http {
24222429
' "$http_referer" "$http_user_agent"'
24232430
;
24242431
app_protect_dos_arb_fqdn arb.test.server.com;
2425-
access_log /dev/stdout main;
2432+
2433+
access_log /dev/stdout main;
24262434
app_protect_failure_mode_action pass;
24272435
app_protect_compressed_requests_action pass;
24282436
app_protect_cookie_seed ABCDEFGHIJKLMNOP;
@@ -2569,7 +2577,8 @@ http {
25692577
'outcome=$app_protect_dos_outcome, reason=$app_protect_dos_outcome_reason, '
25702578
'ip_tls=$remote_addr:$app_protect_dos_tls_fp, ';
25712579
app_protect_dos_arb_fqdn arb.test.server.com;
2572-
access_log /dev/stdout main;
2580+
2581+
access_log /dev/stdout main;
25732582
app_protect_failure_mode_action pass;
25742583
app_protect_compressed_requests_action pass;
25752584
app_protect_cookie_seed ABCDEFGHIJKLMNOP;
@@ -2722,7 +2731,8 @@ http {
27222731
' "$http_referer" "$http_user_agent"'
27232732
;
27242733
app_protect_dos_arb_fqdn arb.test.server.com;
2725-
access_log /dev/stdout main;
2734+
2735+
access_log /dev/stdout main;
27262736
app_protect_failure_mode_action pass;
27272737
app_protect_compressed_requests_action pass;
27282738
app_protect_cookie_seed ABCDEFGHIJKLMNOP;
@@ -2863,7 +2873,8 @@ http {
28632873
default $upstream_trailer_grpc_status;
28642874
'' $sent_http_grpc_status;
28652875
}
2866-
access_log /dev/stdout main;
2876+
2877+
access_log /dev/stdout main;
28672878
28682879
sendfile on;
28692880
#tcp_nopush on;
@@ -3017,7 +3028,7 @@ http {
30173028
default $upstream_trailer_grpc_status;
30183029
'' $sent_http_grpc_status;
30193030
}
3020-
access_log /dev/stdout main;
3031+
access_log /dev/stdout main;
30213032
30223033
sendfile on;
30233034
#tcp_nopush on;
@@ -3138,7 +3149,7 @@ http {
31383149
default $upstream_trailer_grpc_status;
31393150
'' $sent_http_grpc_status;
31403151
}
3141-
access_log /dev/stdout main;
3152+
access_log /dev/stdout main;
31423153
31433154
sendfile on;
31443155
#tcp_nopush on;
@@ -3259,7 +3270,7 @@ http {
32593270
default $upstream_trailer_grpc_status;
32603271
'' $sent_http_grpc_status;
32613272
}
3262-
access_log /dev/stdout main;
3273+
access_log /dev/stdout main;
32633274
32643275
sendfile on;
32653276
#tcp_nopush on;
@@ -3380,7 +3391,7 @@ http {
33803391
default $upstream_trailer_grpc_status;
33813392
'' $sent_http_grpc_status;
33823393
}
3383-
access_log /dev/stdout main;
3394+
access_log /dev/stdout main;
33843395
33853396
sendfile on;
33863397
#tcp_nopush on;
@@ -3501,7 +3512,7 @@ http {
35013512
default $upstream_trailer_grpc_status;
35023513
'' $sent_http_grpc_status;
35033514
}
3504-
access_log /dev/stdout main;
3515+
access_log /dev/stdout main;
35053516
35063517
sendfile on;
35073518
#tcp_nopush on;
@@ -3641,7 +3652,7 @@ http {
36413652
default $upstream_trailer_grpc_status;
36423653
'' $sent_http_grpc_status;
36433654
}
3644-
access_log /dev/stdout main;
3655+
access_log /dev/stdout main;
36453656
36463657
sendfile on;
36473658
#tcp_nopush on;
@@ -3762,7 +3773,7 @@ http {
37623773
default $upstream_trailer_grpc_status;
37633774
'' $sent_http_grpc_status;
37643775
}
3765-
access_log /dev/stdout main;
3776+
access_log /dev/stdout main;
37663777
37673778
sendfile on;
37683779
#tcp_nopush on;
@@ -3884,7 +3895,7 @@ http {
38843895
default $upstream_trailer_grpc_status;
38853896
'' $sent_http_grpc_status;
38863897
}
3887-
access_log /dev/stdout main;
3898+
access_log /dev/stdout main;
38883899
38893900
sendfile on;
38903901
#tcp_nopush on;
@@ -4005,7 +4016,7 @@ http {
40054016
default $upstream_trailer_grpc_status;
40064017
'' $sent_http_grpc_status;
40074018
}
4008-
access_log /dev/stdout main;
4019+
access_log /dev/stdout main;
40094020
40104021
sendfile on;
40114022
#tcp_nopush on;

‎internal/configs/version1/config.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -191,7 +191,7 @@ type Location struct {
191191

192192
// MainConfig describe the main NGINX configuration file.
193193
type MainConfig struct {
194-
AccessLogOff bool
194+
AccessLog string
195195
DefaultServerAccessLogOff bool
196196
DefaultServerReturn string
197197
DisableIPV6 bool

‎internal/configs/version1/nginx-plus.tmpl

+1-5
Original file line numberDiff line numberDiff line change
@@ -90,11 +90,7 @@ http {
9090
app_protect_enforcer_address {{ .AppProtectV5EnforcerAddr }};
9191
{{- end}}
9292

93-
{{- if .AccessLogOff}}
94-
access_log off;
95-
{{- else}}
96-
access_log /dev/stdout main;
97-
{{- end}}
93+
access_log {{.AccessLog}};
9894

9995
{{- if .LatencyMetrics}}
10096
log_format response_time '{"upstreamAddress":"$upstream_addr", "upstreamResponseTime":"$upstream_response_time", "proxyHost":"$proxy_host", "upstreamStatus": "$upstream_status"}';

‎internal/configs/version1/nginx.tmpl

+1-5
Original file line numberDiff line numberDiff line change
@@ -62,11 +62,7 @@ http {
6262
default "{{ .StaticSSLPath }}";
6363
}
6464
{{- end }}
65-
{{- if .AccessLogOff}}
66-
access_log off;
67-
{{- else}}
68-
access_log /dev/stdout main;
69-
{{- end}}
65+
access_log {{.AccessLog}};
7066

7167
{{- if .LatencyMetrics}}
7268
log_format response_time '{"upstreamAddress":"$upstream_addr", "upstreamResponseTime":"$upstream_response_time", "proxyHost":"$proxy_host", "upstreamStatus": "$upstream_status"}';

0 commit comments

Comments
 (0)