DevFW-CICD/ingress-nginx-helm
12
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Making auth access logs optional (#10335)

Browse source
This commit is contained in:
Marcelo Cyreno 2023-08-28 11:37:44 -03:00 committed by GitHub
parent 1ce25127bd
commit 93f9ac2521
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 7 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
internal/ingress/controller/config/config.go
View file

@ -131,6 +131,10 @@ type Configuration struct {
// By default this is disabled // By default this is disabled
EnableAccessLogForDefaultBackend bool `json:"enable-access-log-for-default-backend"` EnableAccessLogForDefaultBackend bool `json:"enable-access-log-for-default-backend"`
// EnableAuthAccessLog enable auth access log
// By default this is disabled
EnableAuthAccessLog bool `json:"enable-auth-access-log"`
// AccessLogPath sets the path of the access logs for both http and stream contexts if enabled // AccessLogPath sets the path of the access logs for both http and stream contexts if enabled
// http://nginx.org/en/docs/http/ngx_http_log_module.html#access_log // http://nginx.org/en/docs/http/ngx_http_log_module.html#access_log
// http://nginx.org/en/docs/stream/ngx_stream_log_module.html#access_log // http://nginx.org/en/docs/stream/ngx_stream_log_module.html#access_log
@ -871,6 +875,7 @@ func NewDefault() Configuration {
AccessLogPath: "/var/log/nginx/access.log", AccessLogPath: "/var/log/nginx/access.log",
AccessLogParams: "", AccessLogParams: "",
EnableAccessLogForDefaultBackend: false, EnableAccessLogForDefaultBackend: false,
EnableAuthAccessLog: false,
WorkerCPUAffinity: "", WorkerCPUAffinity: "",
ErrorLogPath: "/var/log/nginx/error.log", ErrorLogPath: "/var/log/nginx/error.log",
BlockCIDRs: defBlockEntity, BlockCIDRs: defBlockEntity,

2
rootfs/etc/nginx/template/nginx.tmpl
View file

@ -1102,7 +1102,9 @@ stream {
opentelemetry_propagate; opentelemetry_propagate;
{{ end }} {{ end }}
{{ if not $all.Cfg.EnableAuthAccessLog }}
access_log off; access_log off;
{{ end }}
# Ensure that modsecurity will not run on an internal location as this is not accessible from outside # Ensure that modsecurity will not run on an internal location as this is not accessible from outside
{{ if $all.Cfg.EnableModsecurity }} {{ if $all.Cfg.EnableModsecurity }}