Logging request payload for auditing

[Karel Pazdera]

Hi,

I would like to use external processor (written as GRPC service) for request payload auditing.
Is there any way how to match request headers with request body so I can store full request payload? I would prefer to use STREAMED mode for request body if possible.

I am currently using this config (testing in Docker Compose):

static_resources:

  secrets:

    - name: validation_context

      validation_context:

        trusted_ca:

          filename: /run/secrets/ca-cert

    - name: audit_log_service_cert

      tls_certificate:

        certificate_chain:

          filename: /run/secrets/audit-log-service-cert

    - name: audit_log_service_key

      tls_certificate:

        certificate_chain:

          filename: /run/secrets/audit-log-service-key

  listeners:

    - name: listener_0

      address:

        socket_address:

          protocol: TCP

          address: 0.0.0.0

          port_value: 10000

      filter_chains:

        - filters:

            - name: envoy.filters.network.http_connection_manager

              typed_config:

                "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager

                stat_prefix: ingress_http

                access_log:

                  - name: envoy.access_loggers.stdout

                    typed_config:

                      "@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog

                      log_format:

                        text_format_source:

                          inline_string: "[%START_TIME%] \"%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%\" %RESPONSE_CODE% %RESPONSE_FLAGS% \"%RESP(X-EXTPROC-HELLO)%\" \"%RESP(CONTENT-TYPE)%\" \"%RESP(CONTENT-LENGTH)%\" %DURATION% ms\n"

                http_filters:

                  - name: envoy.filters.http.ext_proc

                    typed_config:

                      "@type": type.googleapis.com/envoy.extensions.filters.http.ext_proc.v3.ExternalProcessor

                      grpc_service:

                        envoy_grpc:

                          cluster_name: ext_proc_cluster

                      failure_mode_allow: true

                      observability_mode: true

                      processing_mode:

                        request_header_mode: SEND

                        response_header_mode: SEND

                        request_body_mode: STREAMED

                        response_body_mode: STREAMED

                  - name: envoy.filters.http.router

                    typed_config:

                      "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router

                route_config:

                  name: local_route

                  virtual_hosts:

                    - name: local_service

                      domains:

                        - "*"

                      routes:

                        - match:

                            prefix: "/"

                          route:

                            cluster: local_service

  clusters:

    - name: ext_proc_cluster

      connect_timeout: 0.25s

      type: LOGICAL_DNS

      lb_policy: ROUND_ROBIN

      typed_extension_protocol_options:

        envoy.extensions.upstreams.http.v3.HttpProtocolOptions:

          "@type": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions

          explicit_http_config:

            http2_protocol_options: {}

      load_assignment:

        cluster_name: ext_proc_cluster

        endpoints:

          - lb_endpoints:

              - endpoint:

                  address:

                    socket_address:

                      address: audit-log-service

                      port_value: 10010

      transport_socket:

        name: envoy.transport_sockets.tls

        typed_config:

          "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext

          common_tls_context:

            validation_context_sds_secret_config:

              name: validation_context

    - name: local_service

      connect_timeout: 0.25s

      type: LOGICAL_DNS

      lb_policy: ROUND_ROBIN

      load_assignment:

        cluster_name: local_service

        endpoints:

          - lb_endpoints:

              - endpoint:

                  address:

                    socket_address:

                      address: encryption-in-transit

                      port_value: 9090

      transport_socket:

        name: envoy.transport_sockets.tls

        typed_config:

          "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext

          common_tls_context:

            validation_context_sds_secret_config:

              name: validation_context

Regards

Karel