diff --git a/.env.example b/.env.example index 5a6831bbb..570fdcf8b 100644 --- a/.env.example +++ b/.env.example @@ -346,6 +346,19 @@ # Default: # ACTIONLOG_WORKFLOW_FUNCTIONS_ENABLED= +############################################################################### +# Enables actionlog for compose record create, update, and delete. which is disabled by default. +# +# [IMPORTANT] +# ==== +# This is temp fix for now, it will be removed completely in future release. +# Once new env var will be introduced for actionlog policy, which will enable more control over action log policies. +# ==== +# +# Type: bool +# Default: +# ACTIONLOG_COMPOSE_RECORD_ENABLED= + ############################################################################### ############################################################################### # API Gateway diff --git a/app/options/actionLog.cue b/app/options/actionLog.cue index 8784387e7..e41880df3 100644 --- a/app/options/actionLog.cue +++ b/app/options/actionLog.cue @@ -18,6 +18,20 @@ actionLog: schema.#optionsGroup & { workflow_functions_enabled: { type: "bool" } + compose_record_enabled: { + type: "bool" + defaultGoExpr: "false" + description: """ + Enables actionlog for compose record create, update, and delete. which is disabled by default. + + [IMPORTANT] + ==== + This is temp fix for now, it will be removed completely in future release. + Once new env var will be introduced for actionlog policy, which will enable more control over action log policies. + ==== + + """ + } } title: "Actionlog" } diff --git a/compose/service/record.go b/compose/service/record.go index 133a6c102..b2f1e1a39 100644 --- a/compose/service/record.go +++ b/compose/service/record.go @@ -474,8 +474,9 @@ func (svc record) Bulk(ctx context.Context, oo ...*types.RecordBulkOperation) (r continue } + _ = svc.recordAction(ctx, aProp, action, err) if err != nil { - return svc.recordAction(ctx, aProp, action, err) + return err } rr = append(rr, r) diff --git a/compose/service/service.go b/compose/service/service.go index 5d7e6a1b0..eff48ac59 100644 --- a/compose/service/service.go +++ b/compose/service/service.go @@ -111,6 +111,19 @@ func Initialize(ctx context.Context, log *zap.Logger, s store.Storer, c Config) tee = logger.MakeDebugLogger() } + // Record log policy update + if !c.ActionLog.ComposeRecordEnabled { + policy = actionlog.NewPolicyAll( + policy, + + actionlog.NewPolicyAll( + actionlog.NewPolicyMatchResource("compose:record"), + actionlog.NewPolicyMatchAction("create", "update", "delete"), + actionlog.NewPolicyMatchSeverity(actionlog.Emergency), + ), + ) + } + DefaultActionlog = actionlog.NewService(DefaultStore, log, tee, policy) } diff --git a/pkg/options/options.gen.go b/pkg/options/options.gen.go index 665e48315..9b45965c5 100644 --- a/pkg/options/options.gen.go +++ b/pkg/options/options.gen.go @@ -79,6 +79,7 @@ type ( Enabled bool `env:"ACTIONLOG_ENABLED"` Debug bool `env:"ACTIONLOG_DEBUG"` WorkflowFunctionsEnabled bool `env:"ACTIONLOG_WORKFLOW_FUNCTIONS_ENABLED"` + ComposeRecordEnabled bool `env:"ACTIONLOG_COMPOSE_RECORD_ENABLED"` } ApigwOpt struct { @@ -452,7 +453,8 @@ func SMTP() (o *SMTPOpt) { // This function is auto-generated func ActionLog() (o *ActionLogOpt) { o = &ActionLogOpt{ - Enabled: true, + Enabled: true, + ComposeRecordEnabled: false, } // Custom defaults