kuma
kuma copied to clipboard
kumahq
Indicate if request was blocked by TrafficPermission in AccessLogs
Description
It would be useful to have policy id in logs/response headers/something else(?) to be able to quickly identify which policy caused "RBAC: access denied".
This can be achieved using dynamic_metadata - shadow_effective_policy_id and be retrieved, and forwarded to log/header by LUA filter.
Is there a way to log this for all policies, i.e. not just limit this to RBAC and TrafficPermissions?
There is some info in the "Affected DPPs" tab in GUI:
so you can roughly match up policies to proxies
Triage: The first step would be to mark in logs that the request was rejected because of traffic permission The second step would be to say which traffic permission rejected the request. This one might be hard to implement because of new policy merging.
This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed. If you think this issue is still relevant, please comment on it or attend the next triage meeting.
![github-actions[bot] avatar](https://avatars.githubusercontent.com/in/15368?v=4 "Published by a pub.dev verified publisher"){kind=small}
This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed. If you think this issue is still relevant, please comment on it or attend the next triage meeting.
This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed. If you think this issue is still relevant, please comment on it or attend the next triage meeting.
This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed. If you think this issue is still relevant, please comment on it or attend the next triage meeting.
This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed. If you think this issue is still relevant, please comment on it or attend the next triage meeting.
This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed. If you think this issue is still relevant, please comment on it or attend the next triage meeting.
Hi, is there a way to get this in latest version of kuma?
This is not yet implemented, these are just ideas on how to implement this.
This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed. If you think this issue is still relevant, please comment on it or attend the next triage meeting.