[v3.24] feat(applicationlayer): WAF observability — gateway audit-log capture + Felix/fluentd event log (EV-6650)

[electricjesus]

Cherry-pick of #4895.

Description

Operator render for the Gateway API WAF observability path (EV-6650), split out of #4821:

• Audit-log capture (gateway proxy render) — pkg/render/gatewayapi/gateway_api.go:
  • EnvoyProxy.Spec.Logging.Level = {default: warn, wasm: info} — surfaces the Coraza WASM filter's AuditLog: lines in Envoy's application log.
  • EnvoyProxy.Spec.ExtraArgs += --log-path /access_logs/envoy.log — redirects the application log onto the existing access-logs emptyDir (ExtraArgs rather than a container-args Patch, which would replace EG's generated args; the path sits directly under /access_logs because Envoy doesn't create --log-path parent dirs).
  • WAF_AUDIT_LOG_PATH=/access_logs/envoy.log on the l7-log-collector, which tails the file and forwards WAF decision records via PolicySync.ReportWAF.
• Felix + fluentd event-log legs — WAFEventLogsFileEnabled (FelixConfiguration) and WAF_LOG_FILE (fluentd) so WAF block / would-block decisions land in the tigera_secure_ee_waf index.

Release Note

Add operator render for Gateway API WAF observability (EV-6650): capture the Coraza audit log from the gateway proxy, and enable the Felix + fluentd legs (WAFEventLogsFileEnabled, WAF_LOG_FILE) so WAF block / would-block decisions land in the tigera_secure_ee_waf index.

For PR author

• Tests for change.
• If changing pkg/apis/, run make gen-files
• If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

• Milestone set according to targeted release.
• Appropriate labels:
  • release-note-required
  • docs-pr-required

Linked

• Design: tigera/designs#25 (PMREQ-384)
• Producer pair: tigera/calico-private#12142 (EV-6650) — must merge first
• Stacked on: feat(applicationlayer): WAF v3 (Coraza WASM) render — kube-controllers plumbing + admission webhook #4821