Skip to content

[v18] Log errors in tbot Workload API gRPC handlers #60193

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
strideynet merged 1 commit into from
Oct 13, 2025
Merged

[v18] Log errors in tbot Workload API gRPC handlers #60193

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
71 changes: 60 additions & 11 deletions lib/tbot/services/workloadidentity/workload_api.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -317,7 +317,7 @@ func (s *WorkloadAPIService) authenticateClient(
func (s *WorkloadAPIService) FetchX509SVID(
_ *workloadpb.X509SVIDRequest,
srv workloadpb.SpiffeWorkloadAPI_FetchX509SVIDServer,
) error {
) (err error) {
ctx := srv.Context()

log, creds, err := s.authenticateClient(ctx)
Expand All @@ -326,7 +326,17 @@ func (s *WorkloadAPIService) FetchX509SVID(
}

log.InfoContext(ctx, "FetchX509SVID stream opened by workload")
defer log.InfoContext(ctx, "FetchX509SVID stream has closed")
defer func() {
if err != nil {
s.log.ErrorContext(
ctx,
"FetchX509SVID stream closed with error",
"err", err,
)
return
}
s.log.InfoContext(ctx, "FetchX509SVID stream has closed")
}()

bundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
if err != nil {
Expand Down Expand Up @@ -428,10 +438,20 @@ func (s *WorkloadAPIService) FetchX509SVID(
func (s *WorkloadAPIService) FetchX509Bundles(
_ *workloadpb.X509BundlesRequest,
srv workloadpb.SpiffeWorkloadAPI_FetchX509BundlesServer,
) error {
) (err error) {
ctx := srv.Context()
s.log.InfoContext(ctx, "FetchX509Bundles stream opened by workload")
defer s.log.InfoContext(ctx, "FetchX509Bundles stream has closed")
defer func() {
if err != nil {
s.log.ErrorContext(
ctx,
"FetchX509Bundles stream closed with error",
"err", err,
)
return
}
s.log.InfoContext(ctx, "FetchX509Bundles stream has closed")
}()

for {
bundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
Expand Down Expand Up @@ -547,14 +567,24 @@ func (s *WorkloadAPIService) fetchX509SVIDs(
func (s *WorkloadAPIService) FetchJWTSVID(
ctx context.Context,
req *workloadpb.JWTSVIDRequest,
) (*workloadpb.JWTSVIDResponse, error) {
) (res *workloadpb.JWTSVIDResponse, err error) {
log, attr, err := s.authenticateClient(ctx)
if err != nil {
return nil, trace.Wrap(err, "authenticating client")
}

log.InfoContext(ctx, "FetchJWTSVID request received from workload")
defer log.InfoContext(ctx, "FetchJWTSVID request handled")
defer func() {
if err != nil {
s.log.ErrorContext(
ctx,
"FetchJWTSVID request handling failed",
"err", err,
)
return
}
s.log.InfoContext(ctx, "FetchJWTSVID request handled")
}()
if req.SpiffeId == "" {
log = log.With("requested_spiffe_id", req.SpiffeId)
}
Expand Down Expand Up @@ -659,10 +689,20 @@ func (s *WorkloadAPIService) FetchJWTSVID(
func (s *WorkloadAPIService) FetchJWTBundles(
_ *workloadpb.JWTBundlesRequest,
srv workloadpb.SpiffeWorkloadAPI_FetchJWTBundlesServer,
) error {
) (err error) {
ctx := srv.Context()
s.log.InfoContext(ctx, "FetchJWTBundles stream started by workload")
defer s.log.InfoContext(ctx, "FetchJWTBundles stream ended")
defer func() {
if err != nil {
s.log.ErrorContext(
ctx,
"FetchJWTBundles stream closed with error",
"err", err,
)
return
}
s.log.InfoContext(ctx, "FetchJWTBundles stream has closed")
}()

for {
bundleSet, err := s.trustBundleCache.GetBundleSet(ctx)
Expand Down Expand Up @@ -702,10 +742,19 @@ func (s *WorkloadAPIService) FetchJWTBundles(
func (s *WorkloadAPIService) ValidateJWTSVID(
ctx context.Context,
req *workloadpb.ValidateJWTSVIDRequest,
) (*workloadpb.ValidateJWTSVIDResponse, error) {
) (res *workloadpb.ValidateJWTSVIDResponse, err error) {
s.log.InfoContext(ctx, "ValidateJWTSVID request received from workload")
defer s.log.InfoContext(ctx, "ValidateJWTSVID request handled")

defer func() {
if err != nil {
s.log.ErrorContext(
ctx,
"ValidateJWTSVID request handling failed",
"err", err,
)
return
}
s.log.InfoContext(ctx, "ValidateJWTSVID request handled")
}()
// The SPIFFE Workload API (6.2.3):
// > All fields in the ValidateJWTSVIDRequest and ValidateJWTSVIDResponse
// > message are mandatory.
Expand Down
Loading