feat: include template ID in re-emitted boundary logs (#21618)

Boundary policies are currently defined at the template level, so
including the template ID in re-emitted logs by the control plane
allows policy creators to filter and observe boundary activity for
specific templates. This makes it easier to verify that policies are
working as expected and to debug issues with specific template
configurations.
This commit is contained in:
Zach
2026-01-22 08:37:16 -07:00
committed by GitHub
parent 4c7844ad3d
commit 6d8e6d4830
4 changed files with 8 additions and 0 deletions
+4
View File
@@ -78,9 +78,11 @@ func TestBoundaryLogs_EndToEnd(t *testing.T) {
sink := &logSink{}
logger := slog.Make(sink)
workspaceID := uuid.New()
templateID := uuid.New()
reporter := &agentapi.BoundaryLogsAPI{
Log: logger,
WorkspaceID: workspaceID,
TemplateID: templateID,
}
ctx, cancel := context.WithCancel(context.Background())
@@ -123,6 +125,7 @@ func TestBoundaryLogs_EndToEnd(t *testing.T) {
require.Equal(t, "boundary_request", entry.Message)
require.Equal(t, "allow", getField(entry.Fields, "decision"))
require.Equal(t, workspaceID.String(), getField(entry.Fields, "workspace_id"))
require.Equal(t, templateID.String(), getField(entry.Fields, "template_id"))
require.Equal(t, "GET", getField(entry.Fields, "http_method"))
require.Equal(t, "https://example.com/allowed", getField(entry.Fields, "http_url"))
require.Equal(t, "*.example.com", getField(entry.Fields, "matched_rule"))
@@ -155,6 +158,7 @@ func TestBoundaryLogs_EndToEnd(t *testing.T) {
require.Equal(t, "boundary_request", entry.Message)
require.Equal(t, "deny", getField(entry.Fields, "decision"))
require.Equal(t, workspaceID.String(), getField(entry.Fields, "workspace_id"))
require.Equal(t, templateID.String(), getField(entry.Fields, "template_id"))
require.Equal(t, "POST", getField(entry.Fields, "http_method"))
require.Equal(t, "https://blocked.com/denied", getField(entry.Fields, "http_url"))
require.Equal(t, nil, getField(entry.Fields, "matched_rule"))