feat(applicationlayer): WAF observability — gateway audit-log capture + Felix/fluentd event log (EV-6650) by electricjesus · Pull Request #4895 · tigera/operator

electricjesus · 2026-06-04T21:23:12Z

Description

Operator render for the Gateway API WAF observability path (EV-6650), split out of #4821:

Audit-log capture (gateway proxy render) — pkg/render/gatewayapi/gateway_api.go:
- EnvoyProxy.Spec.Logging.Level = {default: warn, wasm: info} — surfaces the Coraza WASM filter's AuditLog: lines in Envoy's application log.
- EnvoyProxy.Spec.ExtraArgs += --log-path /access_logs/envoy.log — redirects the application log onto the existing access-logs emptyDir (ExtraArgs rather than a container-args Patch, which would replace EG's generated args; the path sits directly under /access_logs because Envoy doesn't create --log-path parent dirs).
- WAF_AUDIT_LOG_PATH=/access_logs/envoy.log on the l7-log-collector, which tails the file and forwards WAF decision records via PolicySync.ReportWAF.
Felix + fluentd event-log legs — WAFEventLogsFileEnabled (FelixConfiguration) and WAF_LOG_FILE (fluentd) so WAF block / would-block decisions land in the tigera_secure_ee_waf index.

Release Note

Add operator render for Gateway API WAF observability (EV-6650): capture the Coraza audit log from the gateway proxy, and enable the Felix + fluentd legs (WAFEventLogsFileEnabled, WAF_LOG_FILE) so WAF block / would-block decisions land in the tigera_secure_ee_waf index.

For PR author

Tests for change.
If changing pkg/apis/, run make gen-files
If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

Milestone set according to targeted release.
Appropriate labels:
- release-note-required
- docs-pr-required

Linked

Design: tigera/designs#25 (PMREQ-384)
Producer pair: tigera/calico-private#12142 (EV-6650) — must merge first
Stacked on: feat(applicationlayer): WAF v3 (Coraza WASM) render — kube-controllers plumbing + admission webhook #4821

Wire the EnvoyProxy render so the data-plane Envoy proxy captures the Coraza WAF filter's audit decision log (EV-6650 WAF observability): - Tune EnvoyProxy.Spec.Logging.Level to {default: warn, wasm: info} so the wasm component's "AuditLog:" lines (emitted via proxywasm.LogInfo) surface in Envoy's application log while the rest stays quiet. Envoy Gateway passes arbitrary component keys through to --component-log-level, and Envoy recognises "wasm". - Append --log-path /access_logs/envoy.log via EnvoyProxy.Spec.ExtraArgs to redirect Envoy's application log to a file on the existing access-logs emptyDir (already mounted in both the envoy container, which writes it, and the l7-log-collector, which reads it). ExtraArgs is used rather than a container-args Patch, which would replace Envoy Gateway's generated args. The file is directly under /access_logs (not a subdirectory) because Envoy does not create --log-path parent directories. - Set WAF_AUDIT_LOG_PATH=/access_logs/envoy.log on the l7-log-collector init container so it can tail the file and forward WAF decision records via PolicySync.ReportWAF. Refs EV-6650

…gateway data plane The gateway data-plane WAF (design-25) emits Coraza audit events that the l7-collector forwards to Felix via ReportWAF. For those events to reach Elasticsearch they need the same Felix -> waf.log -> fluentd -> linseed pipeline the legacy ApplicationLayer WAF uses, but two of its enablement knobs were never wired for the gateway path: - FelixConfiguration.WAFEventLogsFileEnabled gates Felix's ReportWAF handler and the waf.log file reporter; without it ReportWAF returns "WAFEvents disabled". The ApplicationLayer controller already owns this field, so OR in the GatewayAPI WAF extension state (and add a GatewayAPI watch so toggling it re-reconciles). Also set it in the TPROXYMode upgrade-workaround branch, since it is an independent field. - fluentd-node's in_tail_waf_logs source is gated by the WAF_LOG_FILE env, which the operator never set. Set it alongside FLOW_LOG_FILE / DNS_LOG_FILE; the path is always present and the file only exists when a WAF producer is enabled. Refs EV-6650

… GatewayAPI read error Review feedback on tigera#4895: - WAF_AUDIT_LOG_PATH could mismatch a user-supplied --log-path. The render respected an ExtraArgs --log-path carried over from a custom base EnvoyProxy but always pointed the l7-log-collector at the default path. The l7-log-collector can only read the shared access-logs volume, so the operator now owns --log-path: ensureExtraArg sets/replaces it to wafAuditLogPath, keeping it consistent with WAF_AUDIT_LOG_PATH by construction. - isGatewayWAFEnabled swallowed every GetGatewayAPI error as "disabled", which would spuriously flip WAFEventLogsFileEnabled off on a transient/RBAC read error. It now returns (bool, error): a missing CR is disabled (no error); any other error propagates so the reconcile requeues instead of churning FelixConfiguration. Refs EV-6650

… capture + Felix/fluentd event log (EV-6650) Pre-pick of tigera#4895 (source still OPEN on master). Squashed application of the branch's 3 commits (incl. review feedback: operator owns --log-path; GatewayAPI read error propagated) onto release-v1.43. Reconcile to the real master squash SHA once tigera#4895 merges. Refs EV-6650

jaderhs · 2026-06-29T10:17:02Z

+// ensureExtraArg sets "flag value" in an Envoy Gateway ExtraArgs slice (func-e parses each token as
+// a separate element), replacing the value if flag is already present or appending the flag/value
+// pair if not. It copies the slice so it never mutates a slice backing a cached EnvoyProxy object.
+func ensureExtraArg(args []string, flag, value string) []string {


Nitpick: If the envoy binary supports -- to separate non-option args then this function should not replace args after --

Good point. ensureExtraArg now stops at a bare --. It only matches the flag among the options before it, and a newly inserted pair goes before the --, so anything after stays put. Specs added for both cases. Done in 74261471b.

Per review nit: a bare "--" ends option parsing, so the helper must not match or replace a flag that appears after it (there it is a positional, not an option). ensureExtraArg now scans only tokens before "--", and inserts a new flag/value pair before the separator. Adds specs for both cases. Refs EV-6650

… capture + Felix/fluentd event log (EV-6650) Pre-pick of tigera#4895 (source still OPEN on master). Squashed application of the branch's commits (incl. review feedback: operator owns --log-path with -- terminator handling; GatewayAPI read error propagated) onto release-v1.43. Reconcile to the real master squash SHA once tigera#4895 merges. Refs EV-6650

electricjesus added docs-pr-required release-note-required labels Jun 4, 2026

marvin-tigera added this to the v1.43.0 milestone Jun 4, 2026

electricjesus mentioned this pull request Jun 4, 2026

feat(applicationlayer): WAF v3 (Coraza WASM) render — kube-controllers plumbing + admission webhook #4821

Merged

4 tasks

radTuti modified the milestones: v1.43.0, v1.44.0 Jun 12, 2026

electricjesus force-pushed the seth/waf-audit-log-capture-ev6650 branch from 85bafe8 to 105189d Compare June 27, 2026 20:43

electricjesus marked this pull request as ready for review June 27, 2026 20:43

electricjesus requested a review from a team as a code owner June 27, 2026 20:43

electricjesus force-pushed the seth/waf-audit-log-capture-ev6650 branch from 105189d to 2a110b1 Compare June 27, 2026 21:47

electricjesus mentioned this pull request Jun 29, 2026

[v3.24] feat(applicationlayer): WAF observability — gateway audit-log capture + Felix/fluentd event log (EV-6650) #4976

Merged

5 tasks

electricjesus added 2 commits June 29, 2026 09:37

electricjesus force-pushed the seth/waf-audit-log-capture-ev6650 branch from 2a110b1 to 4f6d9a4 Compare June 29, 2026 08:37

jaderhs reviewed Jun 29, 2026

View reviewed changes

Comment thread pkg/render/gatewayapi/gateway_api.go

jaderhs reviewed Jun 29, 2026

View reviewed changes

Comment thread pkg/controller/applicationlayer/applicationlayer_controller.go Outdated

jaderhs reviewed Jun 29, 2026

View reviewed changes

jaderhs approved these changes Jun 29, 2026

View reviewed changes

electricjesus merged commit 94ed9a9 into tigera:master Jun 29, 2026
6 checks passed

electricjesus deleted the seth/waf-audit-log-capture-ev6650 branch June 29, 2026 10:48

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(applicationlayer): WAF observability — gateway audit-log capture + Felix/fluentd event log (EV-6650)#4895

feat(applicationlayer): WAF observability — gateway audit-log capture + Felix/fluentd event log (EV-6650)#4895
electricjesus merged 4 commits into
tigera:masterfrom
electricjesus:seth/waf-audit-log-capture-ev6650

electricjesus commented Jun 4, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

jaderhs Jun 29, 2026

Uh oh!

electricjesus Jun 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

electricjesus commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Release Note

For PR author

For PR reviewers

Linked

Uh oh!

Uh oh!

Uh oh!

jaderhs Jun 29, 2026

Choose a reason for hiding this comment

Uh oh!

electricjesus Jun 29, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

electricjesus commented Jun 4, 2026 •

edited

Loading