Add ability to set log level and enable json logging for all consul-k8s commands

.circleci/config.yml

@@ -48,7 +48,7 @@ commands:
         type: string
       consul-k8s-image:
         type: string
-        default: "docker.mirror.hashicorp.services/hashicorpdev/consul-k8s:latest"
+        default: "kschoche/consul-k8s-dev-logging"
     steps:
       - when:
           condition: << parameters.failfast >>

templates/connect-inject-deployment.yaml

@@ -83,6 +83,11 @@ spec:
               CONSUL_FULLNAME="{{template "consul.fullname" . }}"
 
               consul-k8s inject-connect \
+                {{- if .Values.connectInject.logLevel }}
+                -log-level={{ .Values.connectInject.logLevel }} \
+                {{- else }}
+                -log-level={{ .Values.global.logLevel }} \
+                {{- end }}
                 -default-inject={{ .Values.connectInject.default }} \
                 -consul-image="{{ default .Values.global.image .Values.connectInject.imageConsul }}" \
                 -envoy-image="{{ .Values.global.imageEnvoy }}" \
@@ -106,9 +111,6 @@ spec:
                 {{- if .Values.global.openshift.enabled }}
                 -enable-openshift \
                 {{- end }}
-                {{- if .Values.connectInject.logLevel }}
-                -log-level={{ .Values.connectInject.logLevel }} \
-                {{- end }}
                 {{- if (or (and (ne (.Values.connectInject.metrics.defaultEnabled | toString) "-") .Values.connectInject.metrics.defaultEnabled) (and (eq (.Values.connectInject.metrics.defaultEnabled | toString) "-") .Values.global.metrics.enabled)) }}
                 -default-enable-metrics=true \
                 {{- else }}

templates/controller-deployment.yaml

@@ -59,10 +59,14 @@ spec:
         - "-ec"
         - |
           consul-k8s controller \
+            {{- if .Values.controller.logLevel }}
+            -log-level={{ .Values.controller.logLevel }} \
+            {{- else }}
+            -log-level={{ .Values.global.logLevel }} \
+            {{- end }}
             -webhook-tls-cert-dir=/tmp/controller-webhook/certs \
             -datacenter={{ .Values.global.datacenter }} \
             -enable-leader-election \
-            -log-level={{ .Values.controller.logLevel | quote }} \
             {{- if .Values.global.enableConsulNamespaces }}
             -enable-namespaces=true \
             {{- if .Values.connectInject.consulNamespaces.consulDestinationNamespace }}

templates/create-federation-secret-job.yaml

@@ -116,17 +116,19 @@ spec:
             - "-ec"
             - |
                 consul-k8s create-federation-secret \
-                  {{- if (and .Values.global.gossipEncryption.secretName .Values.global.gossipEncryption.secretKey) }}
-                  -gossip-key-file=/consul/gossip/gossip.key \
-                  {{- end }}
-                  {{- if .Values.global.acls.createReplicationToken }}
-                  -export-replication-token=true \
-                  {{- end }}
-                  -mesh-gateway-service-name={{ .Values.meshGateway.consulServiceName }} \
-                  -k8s-namespace="${NAMESPACE}" \
-                  -resource-prefix="{{ template "consul.fullname" . }}" \
-                  -server-ca-cert-file=/consul/tls/ca/tls.crt \
-                  -server-ca-key-file=/consul/tls/server/ca/tls.key
+                -log-level={{ .Values.global.logLevel }} \
+                -log-json={{ .Values.global.logJSON }} \
+                {{- if (and .Values.global.gossipEncryption.secretName .Values.global.gossipEncryption.secretKey) }}
+                -gossip-key-file=/consul/gossip/gossip.key \
+                {{- end }}
+                {{- if .Values.global.acls.createReplicationToken }}
+                -export-replication-token=true \
+                {{- end }}
+                -mesh-gateway-service-name={{ .Values.meshGateway.consulServiceName }} \
+                -k8s-namespace="${NAMESPACE}" \
+                -resource-prefix="{{ template "consul.fullname" . }}" \
+                -server-ca-cert-file=/consul/tls/ca/tls.crt \
+                -server-ca-key-file=/consul/tls/server/ca/tls.key
           resources:
             requests:
               memory: "50Mi"

templates/ingress-gateways-deployment.yaml

@@ -166,6 +166,8 @@ spec:
                 WAN_ADDR="${HOST_IP}"
                 {{- else if (or (eq $serviceType "ClusterIP") (eq $serviceType "LoadBalancer")) }}
                 consul-k8s service-address \
+                  -log-level={{ $root.Values.global.logLevel }} \
+                  -log-json={{ $root.Values.global.logJSON }} \
                   -k8s-namespace={{ $root.Release.Namespace }} \
                   -name={{ template "consul.fullname" $root }}-{{ .name }} \
                   -output-file=/tmp/address.txt
@@ -368,11 +370,11 @@ spec:
                   - "/bin/sh"
                   - "-ec"
                   - |
-                      /consul-bin/consul services deregister \
-                      {{- if $root.Values.global.enableConsulNamespaces }}
-                      -namespace={{ default $defaults.consulNamespace .consulNamespace }} \
-                      {{- end }}
-                      -id="${POD_NAME}"
+                    /consul-bin/consul services deregister \
+                    {{- if $root.Values.global.enableConsulNamespaces }}
+                    -namespace={{ default $defaults.consulNamespace .consulNamespace }} \
+                    {{- end }}
+                    -id="${POD_NAME}"
 
         # consul-sidecar ensures the ingress gateway is always registered with
         # the local Consul agent, even if it loses the initial registration.
@@ -417,13 +419,17 @@ spec:
               value: http://$(HOST_IP):8500
             {{- end }}
           command:
-            - consul-k8s
-            - consul-sidecar
-            - -service-config=/consul/service/service.hcl
-            - -consul-binary=/consul-bin/consul
-            {{- if $root.Values.global.acls.manageSystemACLs }}
-            - -token-file=/consul/service/acl-token
-            {{- end }}
+            - "/bin/sh"
+            - "-ec"
+            - |
+                consul-k8s consul-sidecar \
+                  -log-level={{ $root.Values.global.logLevel }} \
+                  -log-json={{ $root.Values.global.logJSON }} \
+                  -service-config=/consul/service/service.hcl \
+                  {{- if $root.Values.global.acls.manageSystemACLs }}
+                  -token-file=/consul/service/acl-token \
+                  {{- end }}
+                  -consul-binary=/consul-bin/consul
       {{- if (default $defaults.priorityClassName .priorityClassName) }}
       priorityClassName: {{ default $defaults.priorityClassName .priorityClassName | quote }}
       {{- end }}

templates/mesh-gateway-deployment.yaml

@@ -147,6 +147,8 @@ spec:
                 WAN_ADDR="${NODE_NAME}"
                 {{- else if and (eq $source "Service") (or (eq $serviceType "ClusterIP") (eq $serviceType "LoadBalancer")) }}
                 consul-k8s service-address \
+                  -log-level={{ .Values.global.logLevel }} \
+                  -log-json={{ .Values.global.logJSON }} \
                   -k8s-namespace={{ .Release.Namespace }} \
                   -name={{ template "consul.fullname" . }}-mesh-gateway \
                   -output-file=/tmp/address.txt
@@ -363,13 +365,17 @@ spec:
               value: http://$(HOST_IP):8500
             {{- end }}
           command:
-            - consul-k8s
-            - consul-sidecar
-            - -service-config=/consul/service/service.hcl
-            - -consul-binary=/consul-bin/consul
-            {{- if .Values.global.acls.manageSystemACLs }}
-            - -token-file=/consul/service/acl-token
-            {{- end }}
+            - "/bin/sh"
+            - "-ec"
+            - |
+                consul-k8s consul-sidecar \
+                  -log-level={{ .Values.global.logLevel }} \
+                  -log-json={{ .Values.global.logJSON }} \
+                  -service-config=/consul/service/service.hcl \
+                  {{- if .Values.global.acls.manageSystemACLs }}
+                  -token-file=/consul/service/acl-token \
+                  {{- end }}
+                  -consul-binary=/consul-bin/consul
       {{- if .Values.meshGateway.priorityClassName }}
       priorityClassName: {{ .Values.meshGateway.priorityClassName | quote }}
       {{- end }}

templates/server-acl-init-cleanup-job.yaml

@@ -47,11 +47,14 @@ spec:
         - name: server-acl-init-cleanup
           image: {{ .Values.global.imageK8S }}
           command:
-            - consul-k8s
-          args:
-            - delete-completed-job
-            - -k8s-namespace={{ .Release.Namespace }}
-            - {{ template "consul.fullname" . }}-server-acl-init
+            - "/bin/sh"
+            - "-ec"
+            - |
+                consul-k8s delete-completed-job \
+                  -log-level={{ .Values.global.logLevel }} \
+                  -log-json={{ .Values.global.logJSON }} \
+                  -k8s-namespace={{ .Release.Namespace }} \
+                  {{ template "consul.fullname" . }}-server-acl-init
           resources:
             requests:
               memory: "50Mi"

templates/server-acl-init-job.yaml

@@ -98,6 +98,8 @@ spec:
               CONSUL_FULLNAME="{{template "consul.fullname" . }}"
 
               consul-k8s server-acl-init \
+                -log-level={{ .Values.global.logLevel }} \
+                -log-json={{ .Values.global.logJSON }} \
                 -resource-prefix=${CONSUL_FULLNAME} \
                 -k8s-namespace={{ .Release.Namespace }} \
 

templates/sync-catalog-deployment.yaml

@@ -113,6 +113,12 @@ spec:
             - "-ec"
             - |
               consul-k8s sync-catalog \
+                {{- if .Values.syncCatalog.logLevel }}
+                -log-level={{ .Values.syncCatalog.logLevel }} \
+                {{- else }}
+                -log-level={{ .Values.global.logLevel }} \
+                {{- end }}
+                -log-json={{ .Values.global.logJSON }} \
                 -k8s-default-sync={{ .Values.syncCatalog.default }} \
                 {{- if (not .Values.syncCatalog.toConsul) }}
                 -to-consul=false \
@@ -143,9 +149,6 @@ spec:
                 {{- if .Values.syncCatalog.consulWriteInterval }}
                 -consul-write-interval={{ .Values.syncCatalog.consulWriteInterval }} \
                 {{- end }}
-                {{- if .Values.syncCatalog.logLevel }}
-                -log-level={{ .Values.syncCatalog.logLevel }} \
-                {{- end }}
                 {{- if .Values.syncCatalog.k8sTag }}
                 -consul-k8s-tag={{ .Values.syncCatalog.k8sTag }} \
                 {{- end }}

templates/terminating-gateways-deployment.yaml

@@ -365,13 +365,17 @@ spec:
               value: http://$(HOST_IP):8500
             {{- end }}
           command:
-            - consul-k8s
-            - consul-sidecar
-            - -service-config=/consul/service/service.hcl
-            - -consul-binary=/consul-bin/consul
-            {{- if $root.Values.global.acls.manageSystemACLs }}
-            - -token-file=/consul/service/acl-token
-            {{- end }}
+            - "/bin/sh"
+            - "-ec"
+            - |
+                consul-k8s consul-sidecar \
+                  -log-level={{ $root.Values.global.logLevel }} \
+                  -log-json={{ $root.Values.global.logJSON }} \
+                  -service-config=/consul/service/service.hcl \
+                  {{- if $root.Values.global.acls.manageSystemACLs }}
+                  -token-file=/consul/service/acl-token \
+                  {{- end }}
+                  -consul-binary=/consul-bin/consul
       {{- if (default $defaults.priorityClassName .priorityClassName) }}
       priorityClassName: {{ (default $defaults.priorityClassName .priorityClassName) | quote }}
       {{- end }}

templates/tls-init-job.yaml

@@ -61,6 +61,8 @@ spec:
               # and use * at the start of the dns name when setting -additional-dnsname.
               set -o noglob
               consul-k8s tls-init \
+                -log-level={{ .Values.global.logLevel }} \
+                -log-json={{ .Values.global.logJSON }} \
                 -domain={{ .Values.global.domain }} \
                 -days=730 \
                 -name-prefix={{ template "consul.fullname" . }} \

templates/webhook-cert-manager-deployment.yaml

@@ -37,6 +37,8 @@ spec:
         - "-ec"
         - |
           consul-k8s webhook-cert-manager \
+            -log-level={{ .Values.global.logLevel }} \
+            -log-json={{ .Values.global.logJSON }} \
             -config-file=/bootstrap/config/webhook-config.json \
             -deployment-name={{ template "consul.fullname" . }}-webhook-cert-manager \
             -deployment-namespace={{ .Release.Namespace }}

test/unit/connect-inject-deployment.bats

@@ -1346,7 +1346,7 @@ EOF
 #--------------------------------------------------------------------
 # logLevel
 
-@test "connectInject/Deployment: logLevel info by default" {
+@test "connectInject/Deployment: logLevel info by default from global" {
   cd `chart_dir`
   local cmd=$(helm template \
       -s templates/connect-inject-deployment.yaml  \
@@ -1359,7 +1359,7 @@ EOF
   [ "${actual}" = "true" ]
 }
 
-@test "connectInject/Deployment: logLevel can be set" {
+@test "connectInject/Deployment: logLevel can be overridden" {
   cd `chart_dir`
   local cmd=$(helm template \
       -s templates/connect-inject-deployment.yaml  \

test/unit/controller-deployment.bats

@@ -481,3 +481,34 @@ load _helpers
       yq '[.spec.template.spec.containers[0].env[].name] | any(contains("CONSUL_HTTP_TOKEN"))' | tee /dev/stderr)
   [ "${actual}" = "true" ]
 }
+
+#--------------------------------------------------------------------
+# logLevel
+
+@test "controller/Deployment: logLevel info by default from global" {
+  cd `chart_dir`
+  local cmd=$(helm template \
+      -s templates/controller-deployment.yaml  \
+      --set 'controller.enabled=true' \
+      . | tee /dev/stderr |
+      yq '.spec.template.spec.containers[0].command' | tee /dev/stderr)
+
+  local actual=$(echo "$cmd" |
+    yq 'any(contains("-log-level=info"))' | tee /dev/stderr)
+  [ "${actual}" = "true" ]
+}
+
+@test "controller/Deployment: logLevel can be overridden" {
+  cd `chart_dir`
+  local cmd=$(helm template \
+      -s templates/controller-deployment.yaml  \
+      --set 'controller.enabled=true' \
+      --set 'controller.logLevel=debug' \
+      . | tee /dev/stderr |
+      yq '.spec.template.spec.containers[0].command' | tee /dev/stderr)
+
+  local actual=$(echo "$cmd" |
+    yq 'any(contains("-log-level=debug"))' | tee /dev/stderr)
+  [ "${actual}" = "true" ]
+}
+

test/unit/ingress-gateways-deployment.bats

@@ -1173,6 +1173,8 @@ key2: value2' \
       yq -s -r '.[0].spec.template.spec.initContainers | map(select(.name == "service-init"))[0] | .command[2]' | tee /dev/stderr)
 
   exp='consul-k8s service-address \
+  -log-level=info \
+  -log-json=false \
   -k8s-namespace=default \
   -name=RELEASE-NAME-consul-ingress-gateway \
   -output-file=/tmp/address.txt
@@ -1239,6 +1241,8 @@ EOF
   -token-sink-file=/consul/service/acl-token
 
 consul-k8s service-address \
+  -log-level=info \
+  -log-json=false \
   -k8s-namespace=default \
   -name=RELEASE-NAME-consul-ingress-gateway \
   -output-file=/tmp/address.txt

test/unit/mesh-gateway-deployment.bats

@@ -816,6 +816,8 @@ key2: value2' \
       yq -r '.spec.template.spec.initContainers | map(select(.name == "service-init"))[0] | .command[2]' | tee /dev/stderr)
 
   exp='consul-k8s service-address \
+  -log-level=info \
+  -log-json=false \
   -k8s-namespace=default \
   -name=RELEASE-NAME-consul-mesh-gateway \
   -output-file=/tmp/address.txt
@@ -871,6 +873,8 @@ EOF
   -token-sink-file=/consul/service/acl-token
 
 consul-k8s service-address \
+  -log-level=info \
+  -log-json=false \
   -k8s-namespace=default \
   -name=RELEASE-NAME-consul-mesh-gateway \
   -output-file=/tmp/address.txt
@@ -923,6 +927,8 @@ EOF
       yq -r '.spec.template.spec.initContainers | map(select(.name == "service-init"))[0] | .command[2]' | tee /dev/stderr)
 
   exp='consul-k8s service-address \
+  -log-level=info \
+  -log-json=false \
   -k8s-namespace=default \
   -name=RELEASE-NAME-consul-mesh-gateway \
   -output-file=/tmp/address.txt
@@ -1200,6 +1206,8 @@ EOF
       yq -r '.spec.template.spec.initContainers | map(select(.name == "service-init"))[0] | .command[2]' | tee /dev/stderr)
 
   exp='consul-k8s service-address \
+  -log-level=info \
+  -log-json=false \
   -k8s-namespace=default \
   -name=RELEASE-NAME-consul-mesh-gateway \
   -output-file=/tmp/address.txt
@@ -1317,6 +1325,8 @@ EOF
       yq -r '.spec.template.spec.initContainers | map(select(.name == "service-init"))[0] | .command[2]' | tee /dev/stderr)
 
   exp='consul-k8s service-address \
+  -log-level=info \
+  -log-json=false \
   -k8s-namespace=default \
   -name=RELEASE-NAME-consul-mesh-gateway \
   -output-file=/tmp/address.txt
@@ -1367,6 +1377,8 @@ EOF
       yq -r '.spec.template.spec.initContainers | map(select(.name == "service-init"))[0] | .command[2]' | tee /dev/stderr)
 
   exp='consul-k8s service-address \
+  -log-level=info \
+  -log-json=false \
   -k8s-namespace=default \
   -name=RELEASE-NAME-consul-mesh-gateway \
   -output-file=/tmp/address.txt

test/unit/server-acl-init-cleanup-job.bats

@@ -54,8 +54,13 @@ load _helpers
       -s templates/server-acl-init-cleanup-job.yaml  \
       --set 'global.acls.manageSystemACLs=true' \
       . | tee /dev/stderr |
-      yq -c '.spec.template.spec.containers[0].args' | tee /dev/stderr)
-  [ "${actual}" = '["delete-completed-job","-k8s-namespace=default","RELEASE-NAME-consul-server-acl-init"]' ]
+      yq -r '.spec.template.spec.containers[0].command[2]' | tee /dev/stderr)
+  exp='consul-k8s delete-completed-job \
+  -log-level=info \
+  -log-json=false \
+  -k8s-namespace=default \
+  RELEASE-NAME-consul-server-acl-init'
+  [ "${actual}" = "${exp}" ]
 }
 
 @test "serverACLInitCleanup/Job: enabled with externalServers.enabled=true and global.acls.manageSystemACLs=true, but server.enabled set to false" {