@liminw @yangminzhu

Description:

I’m proposing to add a new ‘LOG’ action to the RBAC filter API to choose whether to log requests based on permission and principal information. Based on the decision, a key-value pair can be set by the RBAC filter and later read by other filters to determine whether they should log a request. This makes it very flexible for access loggers and custom telemetry backends to act based on the decision. The implementation is very simple because it uses the same matching logic as the current RBAC filter.

Example:

  rules:
    action: LOG
    policies:
      log-policy:
        permissions:
          - header: { name: ":method", exact_match: "GET" }
        principals:
          - authenticated:
              principal_name:
                exact: "cluster.local/ns/default/sa/admin"

• Log any GET requests made with the service account "cluster.local/ns/default/sa/admin".