Skip to content

Commit

Permalink
Print traces and debug messages from OPA
Browse files Browse the repository at this point in the history
When running at trace log level the execution trace and debug messages
will be printed to the log (stderr by default), and when running at the
debug log level the execution traces will be omited.

For example:
```
$ ec validate image --policy $POLICY --image $IMAGE --trace
...
ime="2023-10-31T12:56:37+01:00" level=trace msg="[data.policy.release.attestation_task_bundle.warn] | | | Redo true" func=Run file=" conftest_evaluator.go:180"
time="2023-10-31T12:56:37+01:00" level=trace msg="[data.policy.release.attestation_task_bundle.warn] | | Redo __local2965__ = data.lib.tasks_from_pipelinerun" func=Run file=" conftest_evaluator.go:180"
time="2023-10-31T12:56:37+01:00" level=trace msg="[data.policy.release.attestation_task_bundle.warn] | | Redo __local2708__ = [{\"annotations\": {\"custom\": {\"collections\": [\"redhat\"], \"depends_on\": [\"attestation_type.known_attestation_type\"], \"failure_msg\": \"Pipeline task '%s' uses an out of date task bundle '%s'\", \"short_name\": \"task_ref_bundles_current\", \"solution\": \"A task bundle used is not the most recent. The most recent task bundles are defined as in xref:acceptable_bundles.adoc#_task_bundles[acceptable bundles] list.\"}, \"description\": \"For each Task in the SLSA Provenance attestation, check if the Tekton Bundle used is the most recent xref:acceptable_bundles.adoc#_task_bundles[acceptable bundle].\", \"scope\": \"rule\", \"title\": \"Task bundles are latest versions\"}, \"path\": [\"policy\", \"release\", \"attestation_task_bundle\", \"warn\"]}, {\"annotations\": {\"description\": \"To be able to reproduce and audit builds accurately it's important to know exactly what happened during the build. To do this Enterprise Contract requires that all tasks are defined in a set of known and trusted task bundles. This package includes rules to confirm that the tasks that built the image were defined in task bundles, and that the task bundles used are from the list of known and trusted bundles.\", \"scope\": \"package\", \"title\": \"Task bundle checks\"}, \"path\": [\"policy\", \"release\", \"attestation_task_bundle\"]}]" func=Run file=" conftest_evaluator.go:180"
time="2023-10-31T12:56:37+01:00" level=trace msg="[data.policy.release.attestation_task_bundle.warn] | Unify set() = _" func=Run file=" conftest_evaluator.go:180"
time="2023-10-31T12:56:37+01:00" level=trace msg="[data.policy.release.attestation_task_bundle.warn] | Exit data.policy.release.attestation_task_bundle.warn = _" func=Run file=" conftest_evaluator.go:180"
time="2023-10-31T12:56:37+01:00" level=trace msg="[data.policy.release.attestation_task_bundle.warn] Redo data.policy.release.attestation_task_bundle.warn = _" func=Run file=" conftest_evaluator.go:180"
time="2023-10-31T12:56:37+01:00" level=trace msg="[data.policy.release.attestation_task_bundle.warn] | Redo data.policy.release.attestation_task_bundle.warn = _" func=Run file=" conftest_evaluator.go:180"
time="2023-10-31T12:56:37+01:00" level=debug msg="[data.policy.release.attestation_task_bundle.warn] /tmp/ec-work-321015487/policy/9af95111f/bundles.rego:31: HELLO\n" func=Run file=" conftest_evaluator.go:187"
```

```
$ ec validate image --policy $POLICY --image $IMAGE --debug
...
time="2023-10-31T12:56:37+01:00" level=debug msg="[data.policy.release.attestation_task_bundle.warn] /tmp/ec-work-321015487/policy/9af95111f/bundles.rego:31: HELLO\n" func=Run file=" conftest_evaluator.go:187"
```
  • Loading branch information
zregvart committed Nov 2, 2023
1 parent fdc6682 commit d750047
Show file tree
Hide file tree
Showing 2 changed files with 28 additions and 9 deletions.
35 changes: 27 additions & 8 deletions internal/evaluator/conftest_evaluator.go
Original file line number Diff line number Diff line change
Expand Up @@ -163,23 +163,42 @@ type conftestRunner struct {
}

func (r conftestRunner) Run(ctx context.Context, fileList []string) (result []Outcome, data Data, err error) {
if log.IsLevelEnabled(log.TraceLevel) {
r.Trace = true
}

var conftestResult []output.CheckResult
conftestResult, err = r.TestRunner.Run(ctx, fileList)
if err != nil {
return
}

for _, r := range conftestResult {
for _, res := range conftestResult {
if log.IsLevelEnabled(log.TraceLevel) {
for _, q := range res.Queries {
for _, t := range q.Traces {
log.Tracef("[%s] %s", q.Query, t)
}
}
}
if log.IsLevelEnabled(log.DebugLevel) {
for _, q := range res.Queries {
for _, o := range q.Outputs {
log.Debugf("[%s] %s", q.Query, o)
}
}
}

result = append(result, Outcome{
FileName: r.FileName,
Namespace: r.Namespace,
FileName: res.FileName,
Namespace: res.Namespace,
// Conftest doesn't give us a list of successes, just a count. Here we turn that count
// into a placeholder slice of that size to make processing easier later on.
Successes: make([]Result, r.Successes),
Skipped: toRules(r.Skipped),
Warnings: toRules(r.Warnings),
Failures: toRules(r.Failures),
Exceptions: toRules(r.Exceptions),
Successes: make([]Result, res.Successes),
Skipped: toRules(res.Skipped),
Warnings: toRules(res.Warnings),
Failures: toRules(res.Failures),
Exceptions: toRules(res.Exceptions),
})
}

Expand Down
2 changes: 1 addition & 1 deletion internal/logging/logging.go
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ func InitLogging(verbose, quiet, debug, trace bool) {
var v string
switch {
case trace:
level = log.DebugLevel
level = log.TraceLevel
setupDebugMode()
v = "9"
case debug:
Expand Down

0 comments on commit d750047

Please sign in to comment.