Inconsistent logging for Agent's plugin: SVIDStore "sconecas_sessionmanager" version 1

[Benardi]

Problem

There seems to be an inconsistency in the debugging logging when posting the "svid-session". Whether the session has been posted or not, there's no debug log stating it has been posted like there is for the spire-ca session:

time="2021-11-17T14:31:08Z" level=debug msg="SVID stored successfully" entry=a74c6921-8ec1-44ee-aa5a-55224fa51d5a revision_number=2 spiffe_id="spiffe://example.org/scone-service" subsystem_name=svid_store_service svid_store=sconecas_sessionmanager

OBS: Informing the SVID has been stored successfully should not be an INFO level log? Sounds way too important to be relegated into a DEBUG level log.

Example Server's Entry

Entry ID         : a74c6921-8ec1-44ee-aa5a-55224fa51d5a
SPIFFE ID        : spiffe://example.org/scone-service
Parent ID        : spiffe://example.org/spire/agent/k8s_sat/minikube/1cbfcf70-d6f7-4c1c-a531-808f83a79898
Revision         : 0
TTL              : default
Selector         : sconecas_sessionmanager:session_hash:e4ff1d56ecbe4cc8e59dc732fb51de0a48a679ca81cc8236c6aa85f98708360d
Selector         : sconecas_sessionmanager:session_name:fMlPiGTFGdupNoZ/svid-session
Selector         : sconecas_sessionmanager:trust_bundle_session_name:fMlPiGTFGdupNoZ/bundle-session
StoreSvid        : true

Agent's log once entry is created:

time="2021-11-17T14:31:06Z" level=debug msg="SVID updated" entry=a74c6921-8ec1-44ee-aa5a-55224fa51d5a spiffe_id="spiffe://example.org/scone-service" subsystem_name=svid_store_cache
time="2021-11-17T14:31:08Z" level=warning msg="cannot read predecessor for session " external=false open /run/spire/data/store-svid-scone/spire-svid-fMlPiGTFGdupNoZ/svid-session: no such file or directory="<unknown>" plugin_name=sconecas_sessionmanager plugin_type=SVIDStore subsystem_name=catalog
time="2021-11-17T14:31:08Z" level=info msg="Posting Session:" external=false name: spire-svid-fMlPiGTFGdupNoZ/svid-session
version: "0.3"
predecessor: ~
secrets:
  - name: svid
    kind: x509
    value: |
        -----BEGIN CERTIFICATE-----
        MIIB6jCCAY+gAwIBAgIQQFyvzsEGZi3bZXQtux4ZxzAKBggqhkjOPQQDAjAeMQsw
        CQYDVQQGEwJVUzEPMA0GA1UEChMGU1BJRkZFMB4XDTIxMTExNzE0MzA1NloXDTIx
        MTExODAwMzEwNlowHTELMAkGA1UEBhMCVVMxDjAMBgNVBAoTBVNQSVJFMFkwEwYH
        KoZIzj0CAQYIKoZIzj0DAQcDQgAEZC+aGIP2XmReoc0oHCOyzHWkW+7JA19vwQOV
        eFY4lbnCkAGjpAMQzSysWKm/mbfdJwrAbTe1f45vOPqwgNEHW6OBrzCBrDAOBgNV
        HQ8BAf8EBAMCA6gwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1Ud
        EwEB/wQCMAAwHQYDVR0OBBYEFBfO4qrG0PPyiS7IakIz4Ctekg+SMB8GA1UdIwQY
        MBaAFMkuAGRouHsUDYO5WZAl1TuvEctLMC0GA1UdEQQmMCSGInNwaWZmZTovL2V4
        YW1wbGUub3JnL3Njb25lLXNlcnZpY2UwCgYIKoZIzj0EAwIDSQAwRgIhAMQ4Dx/G
        qhmI6AmfR8JLiTM4AjLN354zq+4QCmrpOlf1AiEA/A38J5Rn2UnNZA1ioN54e3XY
        WK08xj028nBQ/UzOeVk=
        -----END CERTIFICATE-----
        -----BEGIN CERTIFICATE-----
        MIIB4TCCAWagAwIBAgIQNaMETvG863jgrgXJAsajYDAKBggqhkjOPQQDAzAeMQsw
        CQYDVQQGEwJVUzEPMA0GA1UECgwGU1BJRkZFMB4XDTIxMTExNzEzMTczMFoXDTIx
        MTExODEzMTc0MFowHjELMAkGA1UEBhMCVVMxDzANBgNVBAoTBlNQSUZGRTBZMBMG
        ByqGSM49AgEGCCqGSM49AwEHA0IABOa0ra94d58HYIzcLSYeDAMewWNlwefkevQ6
        fhUOkG6xHpcAH82+amvPs31+Mu9BBDxidIzpQtPtbr1zNc9lrh+jgYUwgYIwDgYD
        VR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFMkuAGRouHsU
        DYO5WZAl1TuvEctLMB8GA1UdIwQYMBaAFIel81ei8DWswPhkxFTnbtO6OcjoMB8G
        A1UdEQQYMBaGFHNwaWZmZTovL2V4YW1wbGUub3JnMAoGCCqGSM49BAMDA2kAMGYC
        MQD/dlCVHDasdsPBmz0I8E+Z/BtRHcuvw+10hSxxybBmMuHMz2U+0Yi6C4ibkAFs
        OfgCMQDj9jXh/DqBYwP9JYC9gH6AwNCHmEsUZzFr+ekaW8j3WBVkoOihex5HpFls
        L+56iqY=
        -----END CERTIFICATE-----
        
    export:
        session: fMlPiGTFGdupNoZ/svid-session
        session_hash: e4ff1d56ecbe4cc8e59dc732fb51de0a48a679ca81cc8236c6aa85f98708360d
    private_key: svid_key
  - name: svid_key
    kind: private-key
    value: |
        -----BEGIN PRIVATE KEY-----
        MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgn8WL2ZJopJf7403H
        FFH4FJRoYZUJD8JHG3pRQWIl5tehRANCAARkL5oYg/ZeZF6hzSgcI7LMdaRb7skD
        X2/BA5V4VjiVucKQAaOkAxDNLKxYqb+Zt90nCsBtN7V/jm84+rCA0Qdb
        -----END PRIVATE KEY-----
        
    export:
        session: fMlPiGTFGdupNoZ/svid-session
="<unknown>" plugin_name=sconecas_sessionmanager plugin_type=SVIDStore subsystem_name=catalog
time="2021-11-17T14:31:08Z" level=info msg="Saving predecessor hash=16a9a38ebb38f7235133c5d852b5dcf2b9428ebdc426171d6d76c60ddb989619 session_name=spire-svid-fMlPiGTFGdupNoZ/svid-session dir=/run/spire/data/store-svid-scone" external=false plugin_name=sconecas_sessionmanager plugin_type=SVIDStore subsystem_name=catalog
time="2021-11-17T14:31:08Z" level=warning msg="cannot read predecessor for session " external=false open /run/spire/data/store-svid-scone/spire-ca-fMlPiGTFGdupNoZ/bundle-session: no such file or directory="<unknown>" plugin_name=sconecas_sessionmanager plugin_type=SVIDStore subsystem_name=catalog
time="2021-11-17T14:31:08Z" level=info msg="Posting Session:" external=false name: spire-ca-fMlPiGTFGdupNoZ/bundle-session
version: "0.3"
predecessor: ~
secrets:
  - name: spire-ca
    kind: x509-ca
    export_public: true
    value: |
        -----BEGIN CERTIFICATE-----
        MIIBzDCCAVOgAwIBAgIJAJM4DhRH0vmuMAoGCCqGSM49BAMEMB4xCzAJBgNVBAYT
        AlVTMQ8wDQYDVQQKDAZTUElGRkUwHhcNMTgwNTEzMTkzMzQ3WhcNMjMwNTEyMTkz
        MzQ3WjAeMQswCQYDVQQGEwJVUzEPMA0GA1UECgwGU1BJRkZFMHYwEAYHKoZIzj0C
        AQYFK4EEACIDYgAEWjB+nSGSxIYiznb84xu5WGDZj80nL7W1c3zf48Why0ma7Y7m
        CBKzfQkrgDguI4j0Z+0/tDH/r8gtOtLLrIpuMwWHoe4vbVBFte1vj6Xt6WeE8lXw
        cCvLs/mcmvPqVK9jo10wWzAdBgNVHQ4EFgQUh6XzV6LwNazA+GTEVOdu07o5yOgw
        DwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwGQYDVR0RBBIwEIYOc3Bp
        ZmZlOi8vbG9jYWwwCgYIKoZIzj0EAwQDZwAwZAIwE4Me13qMC9i6Fkx0h26y09QZ
        IbuRqA9puLg9AeeAAyo5tBzRl1YL0KNEp02VKSYJAjBdeJvqjJ9wW55OGj1JQwDF
        D7kWeEB6oMlwPbI/5hEY3azJi16I0uN1JSYTSWGSqWc=
        -----END CERTIFICATE-----
        
="<unknown>" plugin_name=sconecas_sessionmanager plugin_type=SVIDStore subsystem_name=catalog
time="2021-11-17T14:31:08Z" level=info msg="Saving predecessor hash=a7e84069cb234425bef2918ffd8c3367886e3c868f3054be01108065b769605e session_name=spire-ca-fMlPiGTFGdupNoZ/bundle-session dir=/run/spire/data/store-svid-scone" external=false plugin_name=sconecas_sessionmanager plugin_type=SVIDStore subsystem_name=catalog
time="2021-11-17T14:31:08Z" level=debug msg="SVID stored successfully" entry=a74c6921-8ec1-44ee-aa5a-55224fa51d5a revision_number=2 spiffe_id="spiffe://example.org/scone-service" subsystem_name=svid_store_service svid_store=sconecas_sessionmanager

[azdagron]

Was this issue created in this repository by accident? That plugin does not exist in this repository. I'll close this issue for now. If I am misunderstanding the request, please let re-open and let me know :)

As an aside: logging the private key is dangerous and should be avoided.

[SilvaMatteus]

Hi guys!

I am sure that @Benardi posted in the wrong place :)

The logging of the scone session is present in a specific build for demonstration purposes only :P