add nginx access log toggle (#402)

* add nginx access log toggle

Signed-off-by: ajaumet <ajaumet@scaleway.com>

* Update templates/nginx/nginx-config.yaml

Co-authored-by: Niclas Schad <niclas.schad@gmail.com>
Signed-off-by: ajaumet <ajaumet@scaleway.com>

* update CHANGELOG.md

Signed-off-by: ajaumet <ajaumet@scaleway.com>

* fix the values reference in nginx config

Signed-off-by: ajaumet <ajaumet@scaleway.com>

Signed-off-by: ajaumet <ajaumet@scaleway.com>
Co-authored-by: ajaumet <ajaumet@scaleway.com>
Co-authored-by: Niclas Schad <niclas.schad@gmail.com>

Author: 3 people

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## master / unreleased
 
+* [ENHANCEMENT] Add verboseLogging option to nginx config #402
 * [DEPENDENCY] Update quay.io/cortexproject/cortex Docker tag to v1.13.1 #401
 * [ENHANCEMENT] Add pod topology spread constrant option to Ingester/Alertmanager statefulset #403
 

README.md

@@ -494,6 +494,7 @@ Kubernetes: `^1.19.0-0`
 | nginx.​config.​mainSnippet | string | `""` | arbitrary snippet to inject in the top section of the nginx config |
 | nginx.​config.​serverSnippet | string | `""` | arbitrary snippet to inject in the server { } section of the nginx config |
 | nginx.​config.​setHeaders | object | `{}` |  |
+| nginx.​config.​verboseLogging | bool | `true` | Enables all access logs from nginx, otherwise ignores 2XX and 3XX status codes |
 | nginx.​containerSecurityContext.​enabled | bool | `true` |  |
 | nginx.​containerSecurityContext.​readOnlyRootFilesystem | bool | `false` |  |
 | nginx.​enabled | bool | `true` |  |

templates/nginx/nginx-config.yaml

@@ -28,7 +28,17 @@ data:
       log_format   main '$remote_addr - $remote_user [$time_local]  $status '
         '"$request" $body_bytes_sent "$http_referer" '
         '"$http_user_agent" "$http_x_forwarded_for" $http_x_scope_orgid';
+
+      {{- if .Values.nginx.config.verboseLogging }}
       access_log   /dev/stderr  main;
+      {{- else }}
+      map $status $loggable {
+        ~^[23]  0;
+        default 1;
+      }
+      access_log   /dev/stderr  main  if=$loggable;
+      {{- end }}
+
       sendfile     on;
       tcp_nopush   on;
       resolver {{ default (printf "kube-dns.kube-system.svc.%s" .Values.clusterDomain ) .Values.nginx.config.dnsResolver }}{{- if .Values.nginx.config.dnsTTL }} valid={{ .Values.nginx.config.dnsTTL }}{{- end }};

values.yaml

@@ -1278,6 +1278,8 @@ nginx:
     basicAuthSecretName: ""
     # -- Including the valid parameter to the `resolver` directive to re-resolve names every `dnsTTL` seconds/minutes
     dnsTTL: "15s"
+    # -- Enables all access logs from nginx, otherwise ignores 2XX and 3XX status codes
+    verboseLogging: true
   image:
     repository: nginx
     tag: 1.23