pomerium/internal/controlplane
Joe Kralicky 554e77bc7c
envoy: log mtls failures (#5210)
envoy: log mtls failures

This implements limited listener-based access logging for downstream
transport failures, only enabled when downstream_mtls.enforcement is
set to 'reject_connection'. Client certificate details and the error
message will be logged.

Additionally, the new key 'client-certificate' can be set in the
access_log_fields list in the configuration, which will add peer
certificate properties (issuer, subject, SANs) to the existing
per-request http logs.

---------

Co-authored-by: Kenneth Jenkins <51246568+kenjenkins@users.noreply.github.com>
2024-08-09 14:05:10 -04:00
..
xdsmgr core/lint: upgrade golangci-lint, replace interface{} with any (#5099) 2024-05-02 14:33:52 -06:00
events.go config: remove source, remove deadcode, fix linting issues (#4118) 2023-04-21 17:25:11 -06:00
events_test.go core/lint: upgrade golangci-lint, replace interface{} with any (#5099) 2024-05-02 14:33:52 -06:00
grpc_accesslog.go envoy: log mtls failures (#5210) 2024-08-09 14:05:10 -04:00
grpc_accesslog_test.go logs: add ip address to access logs (#4391) 2023-08-09 07:09:00 -06:00
http.go core/telemetry: move requestid to pkg directory (#4911) 2024-01-19 13:18:16 -07:00
server.go controlplane: avoid calling Close on nil listener (#5156) 2024-06-27 08:48:43 -07:00
server_test.go authorize: move sign out and jwks urls to route, update issuer for JWT (#4046) 2023-03-08 12:40:15 -07:00
xds.go core/logging: less verbose logs (#5040) 2024-03-29 15:26:20 -06:00