add decision logger config

charts/authorizer/Chart.lock

@@ -3,4 +3,4 @@ dependencies:
   repository: oci://ghcr.io/aserto-dev/helm
   version: 0.1.4
 digest: sha256:018291c7638b93c7e47707393a5f72872ecb4ff06670fa660637392fdc28c873
-generated: "2024-10-24T12:07:51.34431-04:00"
+generated: "2024-10-30T15:49:03.917898+02:00"

charts/authorizer/Chart.yaml

@@ -21,7 +21,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.1.6
+version: 0.1.7
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/authorizer/templates/_helpers.tpl

@@ -96,3 +96,13 @@ tls:
 allowed_headers:
 {{- $cfg.allowed_headers | default (list "Aserto-Tenant-Id" "Authorization" "Content-Type" "Depth") | toYaml | nindent 2 }}
 {{- end }}
+
+{{- define "authorizer.decisionLogger" -}}
+{{- with .Values.decisionLogs -}}
+type: file
+config:
+  log_file_path: /decisions/decisions.log
+  max_file_size_mb: {{ .file.maxFileSizeMB | default "50" }}
+  max_file_count: {{ .file.maxFileCount | default "2" }}
+{{- end }}
+{{- end }}

charts/authorizer/templates/config.yaml

@@ -55,6 +55,11 @@ stringData:
         - key: ${AUTHORIZER_ROOT_KEY}
           account: [email protected]
 
+  {{- if (.Values.decisionLogs).enabled }}
+    decision_logger:
+      {{- include "authorizer.decisionLogger" . | nindent 6 }}
+  {{- end }}
+
     opa:
       instance_id: "-"
       graceful_shutdown_period_seconds: 2

charts/authorizer/templates/deployment.yaml

@@ -40,6 +40,13 @@ spec:
           emptyDir: {}
           {{- end }}
           {{- end }}
+        - name: decisions
+        {{- if (.Values.decisionLogs).enabled | and ((.Values.decisionLogs).persistence).enabled }}
+          persistentVolumeClaim:
+            claimName: {{ include "authorizer.fullname" . }}-pvc-decisions
+        {{- else }}
+          emptyDir: {}
+        {{- end }}
         - name: https-certs
           {{- with (include "aserto-lib.httpsConfig" . | fromYaml) }}
           {{- if .certSecret }}
@@ -94,6 +101,9 @@ spec:
               readOnly: true
             - name: grpc-certs
               mountPath: /grpc-certs
+            - name: decisions
+              mountPath: /decisions
+              readOnly: false
             {{- if (include "aserto-lib.grpcConfig" . | fromYaml).certSecret  }}
               readOnly: true
             {{- end }}

charts/authorizer/templates/pvc-decisions.yaml

@@ -0,0 +1,22 @@
+{{- with (.Values.decisionLogs).persistence -}}
+{{- if .enabled | and ($.Values.decisionLogs).enabled }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "authorizer.fullname" $ }}-pvc-decisions
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .storage | default "100Mi" }}
+  {{- if .storageClassName }}
+  storageClassName: {{ .storageClassName }}
+  {{- end }}
+  {{- if .selector }}
+  selector:
+    {{- .selector | toYaml | nindent 4 }}
+  {{- end }}
+{{- end }}
+{{- end }}
+

charts/authorizer/values.yaml

@@ -17,6 +17,15 @@ apiKey:
   secretName: authorizer-keys
   secretKey: api-key
 
+decisionLogs:
+  enabled: true
+  # The 'file' and 'remote' options are mutually exclusive. If both are specified, 'remote' is used.
+  file:
+    # Write decision logs to a local file.
+    # The logs are written to the spool directory (/decisions) and rotated when they reach the maximum size.
+    maxFileSizeMB: 50
+    maxFileCount: 2
+
 # jwtAcceptableTimeSkewSeconds: 5