Adding nginx_proxy access_log format ability

apis/v1alpha2/nginxproxy_types.go

@@ -297,6 +297,12 @@ type NginxLogging struct {
 	// +optional
 	// +kubebuilder:default=info
 	AgentLevel *AgentLogLevel `json:"agentLevel,omitempty"`
+
+	// AccessLog defines the access log settings, including format itself and disabling option.
+	// For now only path /dev/stdout can be used.
+	//
+	// +optional
+	AccessLog *NginxAccessLog `json:"accessLog,omitempty"`
 }
 
 // NginxErrorLogLevel type defines the log level of error logs for NGINX.
@@ -352,6 +358,22 @@ const (
 	AgentLogLevelFatal AgentLogLevel = "fatal"
 )
 
+// NginxAccessLog defines the configuration for an NGINX access log.
+type NginxAccessLog struct {
+	// Disabled turns off access logging when set to true.
+	//
+	// +optional
+	Disabled *bool `json:"disabled,omitempty"`
+
+	// Format specifies the custom log format string.
+	// If not specified, NGINX default 'combined' format is used.
+	// For now only path /dev/stdout can be used.
+	// See https://nginx.org/en/docs/http/ngx_http_log_module.html#log_format
+	//
+	// +optional
+	Format *string `json:"format,omitempty"`
+}
+
 // NginxPlus specifies NGINX Plus additional settings. These will only be applied if NGINX Plus is being used.
 type NginxPlus struct {
 	// AllowedAddresses specifies IPAddresses or CIDR blocks to the allow list for accessing the NGINX Plus API.

config/crd/bases/gateway.nginx.org_nginxproxies.yaml

@@ -8016,6 +8016,23 @@ spec:
               logging:
                 description: Logging defines logging related settings for NGINX.
                 properties:
+                  accessLog:
+                    description: |-
+                      AccessLog defines the access log settings, including format itself and disabling option.
+                      For now only path /dev/stdout can be used.
+                    properties:
+                      disabled:
+                        description: Disabled turns off access logging when set to
+                          true.
+                        type: boolean
+                      format:
+                        description: |-
+                          Format specifies the custom log format string.
+                          If not specified, NGINX default 'combined' format is used.
+                          For now only path /dev/stdout can be used.
+                          See https://nginx.org/en/docs/http/ngx_http_log_module.html#log_format
+                        type: string
+                    type: object
                   agentLevel:
                     default: info
                     description: |-

deploy/crds.yaml

@@ -8603,6 +8603,23 @@ spec:
               logging:
                 description: Logging defines logging related settings for NGINX.
                 properties:
+                  accessLog:
+                    description: |-
+                      AccessLog defines the access log settings, including format itself and disabling option.
+                      For now only path /dev/stdout can be used.
+                    properties:
+                      disabled:
+                        description: Disabled turns off access logging when set to
+                          true.
+                        type: boolean
+                      format:
+                        description: |-
+                          Format specifies the custom log format string.
+                          If not specified, NGINX default 'combined' format is used.
+                          For now only path /dev/stdout can be used.
+                          See https://nginx.org/en/docs/http/ngx_http_log_module.html#log_format
+                        type: string
+                    type: object
                   agentLevel:
                     default: info
                     description: |-

internal/controller/nginx/config/base_http_config.go

@@ -12,6 +12,9 @@ var baseHTTPTemplate = gotemplate.Must(gotemplate.New("baseHttp").Parse(baseHTTP
 
 type httpConfig struct {
 	DNSResolver             *dataplane.DNSResolverConfig
+	AccessLog               *dataplane.AccessLog
+	DefaultAccessLogPath    string
+	DefaultLogFormatName    string
 	Includes                []shared.Include
 	NginxReadinessProbePort int32
 	IPFamily                shared.IPFamily
@@ -27,6 +30,9 @@ func executeBaseHTTPConfig(conf dataplane.Configuration) []executeResult {
 		NginxReadinessProbePort: conf.BaseHTTPConfig.NginxReadinessProbePort,
 		IPFamily:                getIPFamily(conf.BaseHTTPConfig),
 		DNSResolver:             conf.BaseHTTPConfig.DNSResolver,
+		AccessLog:               conf.Logging.AccessLog,
+		DefaultAccessLogPath:    dataplane.DefaultAccessLogPath,
+		DefaultLogFormatName:    dataplane.DefaultLogFormatName,
 	}
 
 	results := make([]executeResult, 0, len(includes)+1)

internal/controller/nginx/config/base_http_config_template.go

@@ -48,6 +48,20 @@ server {
     }
 }
 
+{{- /* Define custom log format */ -}}
+{{- /* Access log directives for AccessLog. If path is "off" we disable logging. */ -}}
+{{- /* We use a fixed name for user-defined log format to avoid complexity of passing the name around. */ -}}
+{{- if .AccessLog }}
+  {{- if .AccessLog.Disabled }}
+access_log off;
+  {{- else }}
+  {{- if .AccessLog.Format }}
+log_format {{ .DefaultLogFormatName }} '{{ .AccessLog.Format }}';
+access_log {{ .DefaultAccessLogPath }} {{ .DefaultLogFormatName }};
+  {{- end }}
+  {{- end }}
+{{- end }}
+
 {{ range $i := .Includes -}}
 include {{ $i.Name }};
 {{ end -}}

internal/controller/nginx/config/base_http_config_test.go

@@ -1,6 +1,7 @@
 package config
 
 import (
+	"fmt"
 	"sort"
 	"strings"
 	"testing"
@@ -10,6 +11,77 @@ import (
 	"github.com/nginx/nginx-gateway-fabric/v2/internal/controller/state/dataplane"
 )
 
+func TestLoggingSettingsTemplate(t *testing.T) {
+	t.Parallel()
+
+	logFormat := "$remote_addr - [$time_local] \"$request\" $status $body_bytes_sent"
+
+	tests := []struct {
+		name              string
+		accessLog         *dataplane.AccessLog
+		expectedOutputs   []string
+		unexpectedOutputs []string
+	}{
+		{
+			name:      "Log format and access log with custom path and custom format name",
+			accessLog: &dataplane.AccessLog{Format: logFormat},
+			expectedOutputs: []string{
+				fmt.Sprintf("log_format %s '%s'", dataplane.DefaultLogFormatName, logFormat),
+				fmt.Sprintf("access_log %s %s", dataplane.DefaultAccessLogPath, dataplane.DefaultLogFormatName),
+			},
+		},
+		{
+			name:      "Empty format",
+			accessLog: &dataplane.AccessLog{Format: ""},
+			unexpectedOutputs: []string{
+				fmt.Sprintf("log_format %s '%s'", dataplane.DefaultLogFormatName, logFormat),
+				fmt.Sprintf("access_log %s %s", dataplane.DefaultAccessLogPath, dataplane.DefaultLogFormatName),
+			},
+		},
+		{
+			name:      "Access log off while format presented",
+			accessLog: &dataplane.AccessLog{Disabled: true, Format: logFormat},
+			expectedOutputs: []string{
+				`access_log off;`,
+			},
+			unexpectedOutputs: []string{
+				fmt.Sprintf("access_log off %s", dataplane.DefaultLogFormatName),
+			},
+		},
+		{
+			name:      "Access log off",
+			accessLog: &dataplane.AccessLog{Disabled: true},
+			expectedOutputs: []string{
+				`access_log off;`,
+			},
+			unexpectedOutputs: []string{
+				`log_format`,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			g := NewWithT(t)
+
+			conf := dataplane.Configuration{
+				Logging: dataplane.Logging{AccessLog: tt.accessLog},
+			}
+
+			res := executeBaseHTTPConfig(conf)
+			g.Expect(res).To(HaveLen(1))
+			httpConfig := string(res[0].data)
+			for _, expectedOutput := range tt.expectedOutputs {
+				g.Expect(httpConfig).To(ContainSubstring(expectedOutput))
+			}
+			for _, unexpectedOutput := range tt.unexpectedOutputs {
+				g.Expect(httpConfig).ToNot(ContainSubstring(unexpectedOutput))
+			}
+		})
+	}
+}
+
 func TestExecuteBaseHttp_HTTP2(t *testing.T) {
 	t.Parallel()
 	confOn := dataplane.Configuration{

internal/controller/provisioner/objects.go

@@ -406,11 +406,18 @@ func (p *NginxProvisioner) buildNginxConfigMaps(
 		workerConnections = *nProxyCfg.WorkerConnections
 	}
 
+	// Add LogFormats and AccessLogs to mainFields
+	accessLog := addAccessLogsToNginxConfig(logging)
+
 	mainFields := map[string]interface{}{
 		"ErrorLevel":        logLevel,
 		"WorkerConnections": workerConnections,
 	}
 
+	if accessLog != nil {
+		mainFields["AccessLog"] = accessLog
+	}
+
 	// Create events ConfigMap data using template
 	eventsFields := map[string]interface{}{
 		"WorkerConnections": workerConnections,
@@ -1436,3 +1443,19 @@ func DetermineNginxImageName(
 
 	return fmt.Sprintf("%s:%s", image, tag), pullPolicy
 }
+
+func addAccessLogsToNginxConfig(logging *ngfAPIv1alpha2.NginxLogging) *ngfAPIv1alpha2.NginxAccessLog {
+	accessLog := &ngfAPIv1alpha2.NginxAccessLog{}
+	if logging == nil {
+		return accessLog
+	}
+
+	if logging.AccessLog != nil {
+		accessLog = &ngfAPIv1alpha2.NginxAccessLog{
+			Disabled: logging.AccessLog.Disabled,
+			Format:   logging.AccessLog.Format,
+		}
+	}
+
+	return accessLog
+}

internal/controller/state/dataplane/configuration.go

@@ -28,6 +28,10 @@ const (
 	defaultErrorLogLevel           = "info"
 	DefaultWorkerConnections       = int32(1024)
 	DefaultNginxReadinessProbePort = int32(8081)
+	// DefaultLogFormatName is used when user provides custom access_log format.
+	DefaultLogFormatName = "ngf_user_defined_log_format"
+	// DefaultAccessLogPath is the default path for the access log.
+	DefaultAccessLogPath = "/dev/stdout"
 )
 
 // BuildConfiguration builds the Configuration from the Graph.
@@ -1206,6 +1210,8 @@ func convertAddresses(addresses []ngfAPIv1alpha2.RewriteClientIPAddress) []strin
 	return trustedAddresses
 }
 
+// buildLogging converts the API logging spec (currently singular LogFormat / AccessLog fields
+// in v1alpha2) into internal slice-based representation used by templates.
 func buildLogging(gateway *graph.Gateway) Logging {
 	logSettings := Logging{ErrorLevel: defaultErrorLogLevel}
 
@@ -1218,11 +1224,33 @@ func buildLogging(gateway *graph.Gateway) Logging {
 		if ngfProxy.Logging.ErrorLevel != nil {
 			logSettings.ErrorLevel = string(*ngfProxy.Logging.ErrorLevel)
 		}
+
+		srcLogSettings := ngfProxy.Logging
+
+		if accessLog := buildAccessLog(srcLogSettings); accessLog != nil {
+			logSettings.AccessLog = accessLog
+		}
 	}
 
 	return logSettings
 }
 
+func buildAccessLog(srcLogSettings *ngfAPIv1alpha2.NginxLogging) *AccessLog {
+	if srcLogSettings.AccessLog != nil {
+		if srcLogSettings.AccessLog.Disabled != nil && *srcLogSettings.AccessLog.Disabled {
+			return &AccessLog{Disabled: true}
+		}
+
+		if srcLogSettings.AccessLog.Format != nil && *srcLogSettings.AccessLog.Format != "" {
+			return &AccessLog{
+				Format: *srcLogSettings.AccessLog.Format,
+			}
+		}
+	}
+
+	return nil
+}
+
 func buildWorkerConnections(gateway *graph.Gateway) int32 {
 	if gateway == nil || gateway.EffectiveNginxProxy == nil {
 		return DefaultWorkerConnections