You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I'd like to emit access logs in JSON format so as to be able to improve
their visibility in our OpenSearch index. In addition to this I made a
number of changes:
* I did a general update of direct dependencies (apologies for the
vendor folder changes)
* I removed references and flags related to legacy Kubernetes versions
in our manifest/CRD generation
* I've switched to using the latest version of `controller-gen`
* I'm using docker buildx build with a platform flag specifying the
architecture to be linux amd64
* I've extended some of the RBAC roles to align with changes in our
internal "deployment" repo
Example pod logs showing admin logs and cluster access logs (admin logs
left as default - but we can move these to JSON to if we want):
JSON access log (prettified):
```json
{
"response_code": 0,
"upstream_cluster": "example-www_TCP_443",
"bytes_received": 1294,
"bytes_sent": 5999,
"downstream_local_address": "10.129.191.27:443",
"duration": 445,
"upstream_host": "93.184.215.14:443",
"downstream_remote_address": "10.129.187.50:48990",
"response_flags": "-",
"start_time": "2025-01-08T14:12:19.041Z",
"upstream_local_address": "10.129.191.27:37028"
}
```
Copy file name to clipboardExpand all lines: config/crd/bases/egress.monzo.com_externalservices.yaml
+59-41Lines changed: 59 additions & 41 deletions
Original file line number
Diff line number
Diff line change
@@ -1,11 +1,9 @@
1
-
2
1
---
3
2
apiVersion: apiextensions.k8s.io/v1
4
3
kind: CustomResourceDefinition
5
4
metadata:
6
5
annotations:
7
-
controller-gen.kubebuilder.io/version: v0.4.0
8
-
creationTimestamp: null
6
+
controller-gen.kubebuilder.io/version: v0.17.0
9
7
name: externalservices.egress.monzo.com
10
8
spec:
11
9
group: egress.monzo.com
@@ -22,14 +20,19 @@ spec:
22
20
description: ExternalService is the Schema for the externalservices API
23
21
properties:
24
22
apiVersion:
25
-
description: 'APIVersion defines the versioned schema of this representation
26
-
of an object. Servers should convert recognized schemas to the latest
27
-
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
23
+
description: |-
24
+
APIVersion defines the versioned schema of this representation of an object.
25
+
Servers should convert recognized schemas to the latest internal value, and
26
+
may reject unrecognized values.
27
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
28
28
type: string
29
29
kind:
30
-
description: 'Kind is a string value representing the REST resource this
31
-
object represents. Servers may infer this from the endpoint the client
32
-
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
30
+
description: |-
31
+
Kind is a string value representing the REST resource this object represents.
32
+
Servers may infer this from the endpoint the client submits requests to.
33
+
Cannot be updated.
34
+
In CamelCase.
35
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
33
36
type: string
34
37
metadata:
35
38
type: object
@@ -40,29 +43,38 @@ spec:
40
43
description: DnsName is a DNS name target for the external service
41
44
type: string
42
45
envoyClusterMaxConnections:
43
-
description: The maximum number of connections that Envoy will establish
44
-
to all hosts in an upstream cluster (defaults to 1024). If this
45
-
circuit breaker overflows the upstream_cx_overflow counter for the
46
-
cluster will increment.
46
+
description: |-
47
+
The maximum number of connections that Envoy will establish to all hosts in an upstream cluster (defaults to 1024).
48
+
If this circuit breaker overflows the upstream_cx_overflow counter for the cluster will increment.
47
49
format: int32
48
50
type: integer
49
51
envoyDnsRefreshRateS:
50
52
description: "Corresponds to Envoy's dns_refresh_rate config field
51
-
for this cluster, in seconds See\thttps://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto"
53
+
for this cluster, in seconds\nSee\thttps://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto"
52
54
format: int64
53
55
type: integer
56
+
envoyJsonAdminAccessLogs:
57
+
description: |-
58
+
Output admin logs in JSON format as opposed to a text string.
59
+
Defaults to false
60
+
type: boolean
61
+
envoyJsonClusterAccessLogs:
62
+
description: |-
63
+
Output access logs in JSON format as opposed to a text string.
64
+
Defaults to false
65
+
type: boolean
54
66
envoyLogLevel:
55
67
description: Input to the --log-level command line option. See the
56
68
help text for the available log levels and the default.
57
69
type: string
58
70
envoyRespectDnsTTL:
59
71
description: "Corresponds to Envoy's respect_dns_ttl config field
60
-
for this cluster. See\thttps://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto"
72
+
for this cluster.\nSee\thttps://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto"
61
73
type: boolean
62
74
hijackDns:
63
-
description: 'If true, add a `egress.monzo.com/hijack-dns: true` label
64
-
to produced Service objects CoreDNS can watch this label and decide
65
-
to rewrite DnsName -> clusterIP'
75
+
description: |-
76
+
If true, add a `egress.monzo.com/hijack-dns: true` label to produced Service objects
77
+
CoreDNS can watch this label and decide to rewrite DnsName -> clusterIP
66
78
type: boolean
67
79
ipOverride:
68
80
description: When set allows overwriting the A records of the DNS
@@ -90,8 +102,9 @@ spec:
90
102
format: int32
91
103
type: integer
92
104
protocol:
93
-
description: The protocol (TCP or UDP) which traffic must match.
94
-
If not specified, this field defaults to TCP.
105
+
description: |-
106
+
The protocol (TCP or UDP) which traffic must match. If not specified, this
107
+
field defaults to TCP.
95
108
type: string
96
109
type: object
97
110
type: array
@@ -100,18 +113,28 @@ spec:
100
113
for gateway pods. Defaults to 100m, 50Mi, 2, 1Gi
101
114
properties:
102
115
claims:
103
-
description: "Claims lists the names of resources, defined in
104
-
spec.resourceClaims, that are used by this container. \n This
105
-
is an alpha field and requires enabling the DynamicResourceAllocation
106
-
feature gate. \n This field is immutable. It can only be set
107
-
for containers."
116
+
description: |-
117
+
Claims lists the names of resources, defined in spec.resourceClaims,
118
+
that are used by this container.
119
+
120
+
This is an alpha field and requires enabling the
121
+
DynamicResourceAllocation feature gate.
122
+
123
+
This field is immutable. It can only be set for containers.
108
124
items:
109
125
description: ResourceClaim references one entry in PodSpec.ResourceClaims.
110
126
properties:
111
127
name:
112
-
description: Name must match the name of one entry in pod.spec.resourceClaims
113
-
of the Pod where this field is used. It makes that resource
114
-
available inside a container.
128
+
description: |-
129
+
Name must match the name of one entry in pod.spec.resourceClaims of
130
+
the Pod where this field is used. It makes that resource available
131
+
inside a container.
132
+
type: string
133
+
request:
134
+
description: |-
135
+
Request is the name chosen for a request in the referenced claim.
136
+
If empty, everything from the claim is made available, otherwise
0 commit comments