Skip to content

Workloadapi FetchX509SVID logs selectors at info on success#6254

Closed
zmt wants to merge 2 commits intospiffe:mainfrom
zmt:moreSelectorLogs0
Closed

Workloadapi FetchX509SVID logs selectors at info on success#6254
zmt wants to merge 2 commits intospiffe:mainfrom
zmt:moreSelectorLogs0

Conversation

@zmt
Copy link
Contributor

@zmt zmt commented Aug 19, 2025

Pull Request check list

  • Commit conforms to CONTRIBUTING.md?
  • Proper tests/regressions included?
  • Documentation updated?

Affected functionality
Agent logging on successful FetchX509SVID.

Description of change
Agent logs at info level with selectors on successful FetchX509SVID.

Initial follow-up to discussion in #6179, relates to #2651, and probably depends on #2666 (closed unplanned).

Signed-off-by: Zack Train <ztrain@uber.com>
@zmt zmt changed the title FetchX509SVID logs selectors at info on success Workloadapi FetchX509SVID logs selectors at info on success Aug 19, 2025
@amartinezfayo
Copy link
Member

We discussed this in the SPIRE Contributor call and concluded that logging a “Fetched X.509 SVID” message at the Info level each time an X509-SVID is fetched could overwhelm the agent logs.

This might be a good opportunity to introduce Audit Logging in the agent, similar to what we already have in the server. That way, this event could be captured as an audit log, allowing users to opt in if they want to track fetched X.509 SVIDs.

Even though selectors may change after attestation, I think it’s still valuable to include selectors in the audit log entry. Users should be able to have the selectors redacted.

@zmt
Copy link
Contributor Author

zmt commented Aug 20, 2025

I'm going to abandon this for now. I like the suggestion of adding audit log capability to spire-agent.

@zmt zmt closed this Aug 20, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

2 participants