weave-gitops icon indicating copy to clipboard operation
weave-gitops copied to clipboard

Adds more debug logging to help figure out OIDC/RBAC issues

Open foot opened this issue 2 years ago • 1 comments
trafficstars

What changed?

  • We log out the namespaces we've guessed a user has access
  • Include user a bit more in the logs too
  • Remove "attempt to read token from auth header" as its not that useful

Why was this change made?

Make it easier to debug why things may be missing on the apps/sources etc pages

How was this change implemented?

Adding more logging

How did you validate the change?

Manually

Examples

{"level":"debug","ts":1674665219.1867902,"logger":"gitops","caller":"clustersmngr/factory.go:386","msg":"Updated namespaces cache","namespaces":{"default/vcluster":["default","kube-system","kube-public","kube-node-lease","flux-system"],"management":[]}}
{"level":"error","ts":1674665219.1871428,"logger":"gitops","caller":"clustersmngr/factory.go:595","msg":"error updating namespaces from user client","user":"id=\"alice\" groups=[foo] tokenLength=922","error":"1 error occurred:\n\t* Failed to list resource on cluster=\"management\" namespace=\"\" err=\"namespaces is forbidden: User \\\"alice\\\" cannot list resource \\\"namespaces\\\" in API group \\\"\\\" at the cluster scope\"\n\n"}
{"level":"debug","ts":1674665219.2782335,"logger":"gitops","caller":"clustersmngr/factory.go:603","msg":"Updated namespace access cache for user","userNamespaces":{"default/vcluster":["flux-system"],"management":[]},"user":"id=\"alice\" groups=[foo] tokenLength=922","ttl":"30s"}

foot avatar Jan 25 '23 16:01 foot

@foot Is this still in progress?

lasomethingsomething avatar Oct 30 '23 11:10 lasomethingsomething