Add explicit option for enabling RBAC logging

app/boot_levels.go

@@ -285,7 +285,7 @@ func (app *CortezaApp) Provision(ctx context.Context) (err error) {
 		//       w/o using any access control
 
 		var (
-			ac  = rbac.NewService(app.Log, app.Store)
+			ac  = rbac.NewService(zap.NewNop(), app.Store)
 			acr = make([]*rbac.Role, 0)
 		)
 		for _, r := range auth.ProvisionUser().Roles() {
@@ -337,8 +337,13 @@ func (app *CortezaApp) InitServices(ctx context.Context) (err error) {
 	}
 
 	if rbac.Global() == nil {
+		log := zap.NewNop()
+		if app.Opt.RBAC.Log {
+			log = app.Log
+		}
+
 		//Initialize RBAC subsystem
-		ac := rbac.NewService(app.Log, app.Store)
+		ac := rbac.NewService(log, app.Store)
 
 		// and (re)load rules from the storage backend
 		ac.Reload(ctx)

pkg/options/RBAC.gen.go

@@ -10,6 +10,7 @@ package options
 
 type (
 	RBACOpt struct {
+		Log                bool   `env:"RBAC_LOG"`
 		ServiceUser        string `env:"RBAC_SERVICE_USER"`
 		BypassRoles        string `env:"RBAC_BYPASS_ROLES"`
 		AuthenticatedRoles string `env:"RBAC_AUTHENTICATED_ROLES"`

pkg/options/RBAC.yaml

@@ -13,6 +13,10 @@ props:
 #    default: true
 #    description: When disabled all operations on all resources are allowed
 
+  - name: log
+    type: bool
+    description: Log RBAC related events and actions
+
   - name: serviceUser
   - name: bypassRoles
     # Using literal string instead of DefaultBypassRole constant for clarity & documentation