Skip to content

Commit b787814

Browse files
ramondekleinramondeklein
committed
Use log.level
1 parent 4d16c6b commit b787814

16 files changed

+74
-62
lines changed

‎Dockerfile.dev

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM golang:1.21-alpine as build
1+
FROM golang:1.22-alpine as build
22

33
LABEL maintainer="MinIO Inc <[email protected]>"
44

‎cmd/kes/migrate.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ func migrate(args []string) {
109109
srcConf, err := kesconf.ReadFile(fromPath)
110110
cli.Assert(err == nil, err)
111111

112-
src, err := srcConf.KeyStore.Connect(ctx, false)
112+
src, err := srcConf.KeyStore.Connect(ctx)
113113
cli.Assert(err == nil, err)
114114

115115
iter := &kes.ListIter[string]{
@@ -121,7 +121,7 @@ func migrate(args []string) {
121121
dstConf, err := kesconf.ReadFile(toPath)
122122
cli.Assert(err == nil, err)
123123

124-
dst, err := dstConf.KeyStore.Connect(ctx, false)
124+
dst, err := dstConf.KeyStore.Connect(ctx)
125125
cli.Assert(err == nil, err)
126126

127127
var (

‎cmd/kes/server.go

+16-8
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@ func serverCmd(args []string) {
8787
cmd.StringVar(&tlsCertFlag, "cert", "", "Path to the TLS certificate")
8888
cmd.StringVar(&mtlsAuthFlag, "auth", "", "Controls how the server handles mTLS authentication")
8989
cmd.BoolVar(&devFlag, "dev", false, "Start the KES server in development mode")
90-
cmd.BoolVar(&verboseFlag, "verbose", false, "Log verbose output (Vault only)")
90+
cmd.BoolVar(&verboseFlag, "verbose", false, "Log verbose output")
9191
if err := cmd.Parse(args[1:]); err != nil {
9292
if errors.Is(err, flag.ErrHelp) {
9393
os.Exit(2)
@@ -176,18 +176,26 @@ func startServer(addrFlag, configFlag string, verbose bool) error {
176176
ctx, cancel := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
177177
defer cancel()
178178

179-
conf, err := rawConfig.Config(ctx, verbose)
179+
srv := &kes.Server{}
180+
logLevel := slog.LevelInfo
181+
if rawConfig.Log != nil {
182+
srv.ErrLevel.Set(rawConfig.Log.ErrLevel)
183+
srv.AuditLevel.Set(rawConfig.Log.AuditLevel)
184+
logLevel = rawConfig.Log.LogLevel
185+
}
186+
if verbose {
187+
logLevel = slog.LevelDebug
188+
}
189+
slog.SetLogLoggerLevel(logLevel)
190+
191+
conf, err := rawConfig.Config(ctx)
180192
if err != nil {
181193
return err
182194
}
183195
defer conf.Keys.Close()
184196

185-
srv := &kes.Server{}
186197
conf.Cache = configureCache(conf.Cache)
187-
if rawConfig.Log != nil {
188-
srv.ErrLevel.Set(rawConfig.Log.ErrLevel)
189-
srv.AuditLevel.Set(rawConfig.Log.AuditLevel)
190-
}
198+
191199
sighup := make(chan os.Signal, 10)
192200
signal.Notify(sighup, syscall.SIGHUP)
193201
defer signal.Stop(sighup)
@@ -240,7 +248,7 @@ func startServer(addrFlag, configFlag string, verbose bool) error {
240248
fmt.Fprintf(os.Stderr, "Failed to reload server config: %v\n", err)
241249
continue
242250
}
243-
config, err := file.Config(ctx, verbose)
251+
config, err := file.Config(ctx)
244252
if err != nil {
245253
fmt.Fprintf(os.Stderr, "Failed to reload server config: %v\n", err)
246254
continue

‎internal/http/log.go renamed to ‎internal/keystore/vault/log.go

+20-18
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,16 @@
1-
package http
1+
package vault
22

33
import (
44
"log/slog"
55
"net/http"
6-
"slices"
76
"time"
87
)
98

10-
// LoggingTransport is an http.RoundTripper that logs the request and response.
11-
type LoggingTransport struct {
9+
type loggingTransport struct {
1210
http.RoundTripper
13-
skipPaths []string
1411
}
1512

16-
// NewLoggingTransport creates an http.RoundTripper that logs the request and response.
17-
func NewLoggingTransport(rt http.RoundTripper, skipPaths ...string) *LoggingTransport {
18-
return &LoggingTransport{
19-
RoundTripper: rt,
20-
skipPaths: skipPaths,
21-
}
22-
}
23-
24-
// RoundTrip implements the RoundTripper interface.
25-
func (lt *LoggingTransport) RoundTrip(req *http.Request) (*http.Response, error) {
13+
func (lt *loggingTransport) RoundTrip(req *http.Request) (*http.Response, error) {
2614
rt := lt.RoundTripper
2715
if rt == nil {
2816
rt = http.DefaultTransport
@@ -32,28 +20,42 @@ func (lt *LoggingTransport) RoundTrip(req *http.Request) (*http.Response, error)
3220
resp, err := rt.RoundTrip(req)
3321

3422
// don't log health checks
35-
if !slices.Contains(lt.skipPaths, req.URL.Path) {
23+
if req.URL.Path != "/v1/sys/health" {
3624
switch {
3725
case err != nil:
38-
slog.Info("HTTP error",
26+
slog.Debug("HTTP error",
3927
slog.String("method", req.Method),
4028
slog.String("url", req.URL.String()),
29+
slog.String("auth", obfuscateToken(req.Header.Get("X-Vault-Token"))),
4130
slog.Duration("duration", time.Since(start)),
4231
slog.String("error", err.Error()))
4332
case resp.StatusCode >= 300:
44-
slog.Info("HTTP error response",
33+
slog.Debug("HTTP error response",
4534
slog.String("method", req.Method),
4635
slog.String("url", req.URL.String()),
36+
slog.String("auth", obfuscateToken(req.Header.Get("X-Vault-Token"))),
4737
slog.Duration("duration", time.Since(start)),
4838
slog.String("status", resp.Status))
4939
default:
5040
slog.Debug("HTTP success response",
5141
slog.String("method", req.Method),
5242
slog.String("url", req.URL.String()),
43+
slog.String("auth", obfuscateToken(req.Header.Get("X-Vault-Token"))),
5344
slog.Duration("duration", time.Since(start)),
5445
slog.String("status", resp.Status))
5546
}
5647
}
5748

5849
return resp, err
5950
}
51+
52+
func obfuscateToken(token string) string {
53+
switch {
54+
case len(token) == 0:
55+
return ""
56+
case len(token) > 8:
57+
return "***" + token[len(token)-4:]
58+
default:
59+
return "***"
60+
}
61+
}

‎internal/keystore/vault/vault.go

+5-12
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@ import (
2727
"aead.dev/mem"
2828
vaultapi "github.com/hashicorp/vault/api"
2929
"github.com/minio/kes"
30-
xhttp "github.com/minio/kes/internal/http"
3130
"github.com/minio/kes/internal/keystore"
3231
kesdk "github.com/minio/kms-go/kes"
3332
)
@@ -41,7 +40,7 @@ type Store struct {
4140

4241
// Connect connects to a Hashicorp Vault server with
4342
// the given configuration.
44-
func Connect(ctx context.Context, c *Config, verbose bool) (*Store, error) {
43+
func Connect(ctx context.Context, c *Config) (*Store, error) {
4544
c = c.Clone()
4645

4746
if c.Engine == "" {
@@ -114,8 +113,8 @@ func Connect(ctx context.Context, c *Config, verbose bool) (*Store, error) {
114113
tr.DisableKeepAlives = true
115114
tr.MaxIdleConnsPerHost = -1
116115
}
117-
if verbose {
118-
config.HttpClient.Transport = xhttp.NewLoggingTransport(config.HttpClient.Transport, "/v1/sys/health")
116+
if slog.Default().Enabled(ctx, slog.LevelDebug) {
117+
config.HttpClient.Transport = &loggingTransport{config.HttpClient.Transport}
119118
}
120119
vaultClient, err := vaultapi.NewClient(config)
121120
if err != nil {
@@ -150,14 +149,8 @@ func Connect(ctx context.Context, c *Config, verbose bool) (*Store, error) {
150149
lastAuthSuccess = false
151150
}
152151
} else {
153-
if verbose {
154-
obfuscatedToken := secret.Auth.ClientToken
155-
if len(obfuscatedToken) > 10 {
156-
obfuscatedToken = obfuscatedToken[:2] + "***" + obfuscatedToken[len(obfuscatedToken)-4:]
157-
} else {
158-
obfuscatedToken = "***"
159-
}
160-
slog.Info("Authentication successful", slog.String("token", obfuscatedToken))
152+
if slog.Default().Enabled(ctx, slog.LevelDebug) {
153+
slog.Debug("Authentication successful", slog.String("token", obfuscateToken(secret.Auth.ClientToken)))
161154
}
162155
lastAuthSuccess = true
163156
}

‎internal/sys/build.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ import (
1616
type BinaryInfo struct {
1717
Version string // The version of this binary
1818
CommitID string // The git commit hash
19-
Runtime string // The Go runtime version, e.g. go1.21.0
19+
Runtime string // The Go runtime version, e.g. go1.22.0
2020
Compiler string // The Go compiler used to build this binary
2121
}
2222

‎kesconf/aws_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ func TestAWS(t *testing.T) {
2929
ctx, cancel := testingContext(t)
3030
defer cancel()
3131

32-
store, err := config.KeyStore.Connect(ctx, false)
32+
store, err := config.KeyStore.Connect(ctx)
3333
if err != nil {
3434
t.Fatal(err)
3535
}

‎kesconf/azure_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ func TestAzure(t *testing.T) {
3535
ctx, cancel := testingContext(t)
3636
defer cancel()
3737

38-
store, err := config.KeyStore.Connect(ctx, false)
38+
store, err := config.KeyStore.Connect(ctx)
3939
if err != nil {
4040
t.Fatal(err)
4141
}

‎kesconf/config.go

+6
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,7 @@ type ymlFile struct {
6666
Log struct {
6767
Error env[string] `yaml:"error"`
6868
Audit env[string] `yaml:"audit"`
69+
Level env[string] `yaml:"level"`
6970
} `yaml:"log"`
7071

7172
Keys []struct {
@@ -299,6 +300,10 @@ func ymlToServerConfig(y *ymlFile) (*File, error) {
299300
if err != nil {
300301
return nil, err
301302
}
303+
logLevel, err := parseLogLevel(y.Log.Level.Value)
304+
if err != nil {
305+
return nil, err
306+
}
302307

303308
for path, api := range y.API.Paths {
304309
if api.Timeout.Value < 0 {
@@ -354,6 +359,7 @@ func ymlToServerConfig(y *ymlFile) (*File, error) {
354359
Log: &LogConfig{
355360
ErrLevel: errLevel,
356361
AuditLevel: auditLevel,
362+
LogLevel: logLevel,
357363
},
358364
KeyStore: keystore,
359365
}

‎kesconf/file.go

+15-12
Original file line numberDiff line numberDiff line change
@@ -159,7 +159,7 @@ func (f *File) TLSConfig() (*tls.Config, error) {
159159
// Config returns a new KES configuration as specified by
160160
// the File. It connects to the KeyStore using the given
161161
// context.
162-
func (f *File) Config(ctx context.Context, verbose bool) (*kes.Config, error) {
162+
func (f *File) Config(ctx context.Context) (*kes.Config, error) {
163163
conf := &kes.Config{
164164
Admin: f.Admin,
165165
}
@@ -211,7 +211,7 @@ func (f *File) Config(ctx context.Context, verbose bool) (*kes.Config, error) {
211211
}
212212

213213
if f.KeyStore != nil {
214-
keystore, err := f.KeyStore.Connect(ctx, verbose)
214+
keystore, err := f.KeyStore.Connect(ctx)
215215
if err != nil {
216216
return nil, err
217217
}
@@ -298,6 +298,9 @@ type LogConfig struct {
298298
// Audit determines whether the KES server logs audit events to STDOUT.
299299
// It does not en/disable audit logging in general.
300300
AuditLevel slog.Level
301+
302+
// Log level for which to report KES diagnostic messages.
303+
LogLevel slog.Level
301304
}
302305

303306
// APIConfig is a structure that holds the API configuration
@@ -365,7 +368,7 @@ type Key struct {
365368
type KeyStore interface {
366369
// Connect establishes and returns a new connection
367370
// to the keystore.
368-
Connect(ctx context.Context, verbose bool) (kes.KeyStore, error)
371+
Connect(ctx context.Context) (kes.KeyStore, error)
369372
}
370373

371374
// FSKeyStore is a structure containing the configuration
@@ -382,7 +385,7 @@ type FSKeyStore struct {
382385
}
383386

384387
// Connect returns a kv.Store that stores key-value pairs in a path on the filesystem.
385-
func (s *FSKeyStore) Connect(context.Context, bool) (kes.KeyStore, error) {
388+
func (s *FSKeyStore) Connect(context.Context) (kes.KeyStore, error) {
386389
return fs.NewStore(s.Path)
387390
}
388391

@@ -528,7 +531,7 @@ type VaultTransit struct {
528531
}
529532

530533
// Connect returns a kv.Store that stores key-value pairs on a Hashicorp Vault server.
531-
func (s *VaultKeyStore) Connect(ctx context.Context, verbose bool) (kes.KeyStore, error) {
534+
func (s *VaultKeyStore) Connect(ctx context.Context) (kes.KeyStore, error) {
532535
if s.AppRole == nil && s.Kubernetes == nil {
533536
return nil, errors.New("edge: failed to connect to hashicorp vault: no authentication method specified")
534537
}
@@ -568,7 +571,7 @@ func (s *VaultKeyStore) Connect(ctx context.Context, verbose bool) (kes.KeyStore
568571
KeyName: s.Transit.KeyName,
569572
}
570573
}
571-
return vault.Connect(ctx, c, verbose)
574+
return vault.Connect(ctx, c)
572575
}
573576

574577
// FortanixKeyStore is a structure containing the
@@ -594,7 +597,7 @@ type FortanixKeyStore struct {
594597
}
595598

596599
// Connect returns a kv.Store that stores key-value pairs on a Fortanix SDKMS server.
597-
func (s *FortanixKeyStore) Connect(ctx context.Context, _ bool) (kes.KeyStore, error) {
600+
func (s *FortanixKeyStore) Connect(ctx context.Context) (kes.KeyStore, error) {
598601
return fortanix.Connect(ctx, &fortanix.Config{
599602
Endpoint: s.Endpoint,
600603
GroupID: s.GroupID,
@@ -629,7 +632,7 @@ type KeySecureKeyStore struct {
629632
}
630633

631634
// Connect returns a kv.Store that stores key-value pairs on a Gemalto KeySecure instance.
632-
func (s *KeySecureKeyStore) Connect(ctx context.Context, _ bool) (kes.KeyStore, error) {
635+
func (s *KeySecureKeyStore) Connect(ctx context.Context) (kes.KeyStore, error) {
633636
return gemalto.Connect(ctx, &gemalto.Config{
634637
Endpoint: s.Endpoint,
635638
CAPath: s.CAPath,
@@ -678,7 +681,7 @@ type GCPSecretManagerKeyStore struct {
678681
}
679682

680683
// Connect returns a kv.Store that stores key-value pairs on GCP SecretManager.
681-
func (s *GCPSecretManagerKeyStore) Connect(ctx context.Context, _ bool) (kes.KeyStore, error) {
684+
func (s *GCPSecretManagerKeyStore) Connect(ctx context.Context) (kes.KeyStore, error) {
682685
return gcp.Connect(ctx, &gcp.Config{
683686
Endpoint: s.Endpoint,
684687
ProjectID: s.ProjectID,
@@ -722,7 +725,7 @@ type AWSSecretsManagerKeyStore struct {
722725
}
723726

724727
// Connect returns a kv.Store that stores key-value pairs on AWS SecretsManager.
725-
func (s *AWSSecretsManagerKeyStore) Connect(ctx context.Context, _ bool) (kes.KeyStore, error) {
728+
func (s *AWSSecretsManagerKeyStore) Connect(ctx context.Context) (kes.KeyStore, error) {
726729
return aws.Connect(ctx, &aws.Config{
727730
Addr: s.Endpoint,
728731
Region: s.Region,
@@ -758,7 +761,7 @@ type AzureKeyVaultKeyStore struct {
758761
}
759762

760763
// Connect returns a kv.Store that stores key-value pairs on Azure KeyVault.
761-
func (s *AzureKeyVaultKeyStore) Connect(_ context.Context, verbose bool) (kes.KeyStore, error) {
764+
func (s *AzureKeyVaultKeyStore) Connect(_ context.Context) (kes.KeyStore, error) {
762765
if (s.TenantID != "" || s.ClientID != "" || s.ClientSecret != "") && s.ManagedIdentityClientID != "" {
763766
return nil, errors.New("edge: failed to connect to Azure KeyVault: more than one authentication method specified")
764767
}
@@ -808,7 +811,7 @@ type EntrustKeyControlKeyStore struct {
808811
}
809812

810813
// Connect returns a kv.Store that stores key-value pairs on Entrust KeyControl.
811-
func (s *EntrustKeyControlKeyStore) Connect(ctx context.Context, _ bool) (kes.KeyStore, error) {
814+
func (s *EntrustKeyControlKeyStore) Connect(ctx context.Context) (kes.KeyStore, error) {
812815
var rootCAs *x509.CertPool
813816
if s.CAPath != "" {
814817
ca, err := https.CertPoolFromFile(s.CAPath)

‎kesconf/fortanix_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ func TestFortanix(t *testing.T) {
3030
ctx, cancel := testingContext(t)
3131
defer cancel()
3232

33-
store, err := config.KeyStore.Connect(ctx, false)
33+
store, err := config.KeyStore.Connect(ctx)
3434
if err != nil {
3535
t.Fatal(err)
3636
}

‎kesconf/fs_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ func TestFS(t *testing.T) {
2424
ctx, cancel := testingContext(t)
2525
defer cancel()
2626

27-
store, err := config.Connect(ctx, false)
27+
store, err := config.Connect(ctx)
2828
if err != nil {
2929
t.Fatal(err)
3030
}

‎kesconf/gcp_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ func TestGCP(t *testing.T) {
3030
ctx, cancel := testingContext(t)
3131
defer cancel()
3232

33-
store, err := config.KeyStore.Connect(ctx, false)
33+
store, err := config.KeyStore.Connect(ctx)
3434
if err != nil {
3535
t.Fatal(err)
3636
}

0 commit comments

Comments
 (0)