Skip to content

charts/wire-ingress: remove query param from logs - #5361

Draft
jschaul wants to merge 3 commits into
developfrom
envoy-log-format
Draft

charts/wire-ingress: remove query param from logs#5361
jschaul wants to merge 3 commits into
developfrom
envoy-log-format

Conversation

@jschaul

@jschaul jschaul commented Jul 22, 2026

Copy link
Copy Markdown
Member

Part of WPB-27370

When using the wire-ingress provided EnvoyProxy, ensure the request path's query string is removed from the logs, to ensure access_tokens passed as query string are not logged. Browsers are required to pass them on a query string on some endpoints such as /await.

This PR entirely removes query strings. Other options could include only sanitizing access tokens (as done in ingress-nginx) but not other query parameters.

  • Check if sanitizing only access tokens (instead of removing all query param) could work (and how)
  • add a (possibly manual) test (and docs) showing before/after this PR to show this acutally works as expected

Checklist

  • Add a new entry in an appropriate subdirectory of changelog.d
  • Read and follow the PR guidelines

@zebot zebot added the ok-to-test Approved for running tests in CI, overrides not-ok-to-test if both labels exist label Jul 22, 2026
jschaul added 3 commits July 27, 2026 12:18
Part of WPB-27370

When using the wire-ingress provided EnvoyProxy, ensure the request path's query string is removed from the logs, to ensure access_tokens passed as query string are not logged. Browsers are required to pass them on a query string on some endpoints such as /await.
@jschaul
jschaul force-pushed the envoy-log-format branch from afefec6 to 1597f2c Compare July 27, 2026 10:18
@jschaul
jschaul marked this pull request as ready for review July 27, 2026 16:04
@jschaul
jschaul requested review from a team as code owners July 27, 2026 16:04
@jschaul
jschaul marked this pull request as draft July 27, 2026 16:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ok-to-test Approved for running tests in CI, overrides not-ok-to-test if both labels exist

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants