Improve logs for APE checking #1574

New issue

Open

opened 2024-12-20 09:57:11 +00:00 by dkirillov · 1 comment

dkirillov commented

2024-12-20 09:57:11 +00:00

Member

Sometime storage node returns Access Denied after APE checking and we not always can understand what goes wrong.
We can know what policies presence in system with frostfs-adm morph ape list-rule-chains but we don't know what request be checked in APE.

Describe the solution you'd like

Add debug logs here for example
and in any other similar places.
Something like in s3-gw

	`reqLogOrDefault(r.Context(), cfg.Log).Debug(logs.PolicyRequest, zap.String("action", op),`
	`zap.String("resource", res), zap.Any("request properties", requestProps),`
	`zap.Any("resource properties", resourceProps))`

Describe alternatives you've considered

Hide such debug logs behind tags

Additional context

Having such additional logs could help understand the reason of #1572 faster

## Is your feature request related to a problem? Please describe. Sometime storage node returns `Access Denied` after APE checking and we not always can understand what goes wrong. We can know what policies presence in system with `frostfs-adm morph ape list-rule-chains` but we don't know what request be checked in APE. ## Describe the solution you'd like Add debug logs [here](https://git.frostfs.info/TrueCloudLab/frostfs-node/src/commit/df05057ed46632e7746fcaa26731987a9070b2e5/pkg/services/common/ape/checker.go#L98) for example and in any other similar places. Something like in s3-gw https://git.frostfs.info/TrueCloudLab/frostfs-s3-gw/src/commit/e0ce59fd32beb9274e48adf1c52d41292ceeafd5/api/middleware/policy.go#L201-L203 ## Describe alternatives you've considered Hide such debug logs behind tags ## Additional context Having such additional logs could help understand the reason of https://git.frostfs.info/TrueCloudLab/frostfs-node/issues/1572 faster