Since major of function of Relay is to sign the request by fetching the IMDSv2 credentials, we can afford to have debug logs in production for only aws component.
The log is not dependent on customer's dataplane traffic and is only fetched every 1 hour to refresh the credentials. In case of issue fetching the credentials the logs will help identify the problem faster instead of teaching customer how to fetch the debug level logs from relay container.
This will help chase the issues where Relay is not able to fetch the credentials because IMDS is disabled. Or in other instances token fetch fails and Envoy end up doing IMDSv1 calls etc.
Summary
Enable debug loglevel for aws component in relay
Since major of function of Relay is to sign the request by fetching the IMDSv2 credentials, we can afford to have debug logs in production for only aws component.
The log is not dependent on customer's dataplane traffic and is only fetched every 1 hour to refresh the credentials. In case of issue fetching the credentials the logs will help identify the problem faster instead of teaching customer how to fetch the debug level logs from relay container.
This will help chase the issues where Relay is not able to fetch the credentials because IMDS is disabled. Or in other instances token fetch fails and Envoy end up doing IMDSv1 calls etc.
Implementation details
Enable https://www.envoyproxy.io/docs/envoy/latest/operations/cli.html#cmdoption-component-log-level component log level only for aws component.
Testing
New tests cover the changes: yes
Manual testing logs which will start showing up inside relay container at /var/logs/*
Description for the changelog
Licensing
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.