weave-gitops
weave-gitops copied to clipboard
Adds more debug logging to help figure out OIDC/RBAC issues
trafficstars
What changed?
- We log out the namespaces we've guessed a user has access
- Include user a bit more in the logs too
- Remove "attempt to read token from auth header" as its not that useful
Why was this change made?
Make it easier to debug why things may be missing on the apps/sources etc pages
How was this change implemented?
Adding more logging
How did you validate the change?
Manually
Examples
{"level":"debug","ts":1674665219.1867902,"logger":"gitops","caller":"clustersmngr/factory.go:386","msg":"Updated namespaces cache","namespaces":{"default/vcluster":["default","kube-system","kube-public","kube-node-lease","flux-system"],"management":[]}}
{"level":"error","ts":1674665219.1871428,"logger":"gitops","caller":"clustersmngr/factory.go:595","msg":"error updating namespaces from user client","user":"id=\"alice\" groups=[foo] tokenLength=922","error":"1 error occurred:\n\t* Failed to list resource on cluster=\"management\" namespace=\"\" err=\"namespaces is forbidden: User \\\"alice\\\" cannot list resource \\\"namespaces\\\" in API group \\\"\\\" at the cluster scope\"\n\n"}
{"level":"debug","ts":1674665219.2782335,"logger":"gitops","caller":"clustersmngr/factory.go:603","msg":"Updated namespace access cache for user","userNamespaces":{"default/vcluster":["flux-system"],"management":[]},"user":"id=\"alice\" groups=[foo] tokenLength=922","ttl":"30s"}
@foot Is this still in progress?