Skip to content

✨ feat(audit): improve logging in export dir - #765

Open
Tamar-Dinavetsky wants to merge 10 commits into
migtools:mainfrom
Tamar-Dinavetsky:feat/audit-logging
Open

✨ feat(audit): improve logging in export dir#765
Tamar-Dinavetsky wants to merge 10 commits into
migtools:mainfrom
Tamar-Dinavetsky:feat/audit-logging

Conversation

@Tamar-Dinavetsky

@Tamar-Dinavetsky Tamar-Dinavetsky commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

#773

Adds missing log statements to the export command:

  • Info log at start and end of export run
  • Error logs before returns that were silent (discoverPreferredResources, validateExportNamespace, timeout
    detection)
  • Warn log when all resource types return Forbidden

Summary by CodeRabbit

Summary by CodeRabbit

  • Chores
    • Improved export status reporting throughout discovery, collection, writing, timeout handling, validation, filtering, and completion.
    • Added clearer diagnostics for skipped resources, parsing and retrieval failures, custom resource handling, and access restrictions.
    • Standardized log formatting, capitalization, error details, and severity levels for more consistent export output.

@coderabbitai

coderabbitai Bot commented Aug 4, 2026

Copy link
Copy Markdown

Review Change Stack

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

The export command now logs lifecycle events, validation and discovery failures, resource counts, RBAC filtering, timeout errors, all-Forbidden results, and completion. Error formatting uses %v instead of %#v.

Changes

Export observability

Layer / File(s) Summary
Export lifecycle logging
cmd/export/export.go
Added lifecycle, validation, resource-count, timeout, write-failure, Forbidden-condition, and completion logs.
Resource discovery logging
cmd/export/discover.go
Added diagnostics for discovery decisions, resource listing, extraction, writing, and object retrieval.
Cluster and CRD collection logging
cmd/export/cluster.go, cmd/export/crd.go
Adjusted log levels, match-path details, collection status, message capitalization, punctuation, and error formatting.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

  • migtools/crane#518: The changes update the same resource-listing error handling in cmd/export/discover.go, including Forbidden, MethodNotSupported, and NotFound logging.

Suggested reviewers: stillalearner, aufi

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly identifies the main change: improved logging in the export command.
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
cmd/export/export.go (1)

214-214: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Use a consistent error verb for logging.

These new error logs use %v for the error value. Other error logs in this function, for example at Line 200 and Line 210, use %#v. Use one verb consistently across the function for error logging.

♻️ Proposed fix for consistent error formatting
-		log.Errorf("namespace validation failed: %v", err)
+		log.Errorf("namespace validation failed: %#v", err)
-		log.Errorf("cannot discover preferred resources: %v", err)
+		log.Errorf("cannot discover preferred resources: %#v", err)
-				log.Errorf("timeout listing resource %q: %v", resErr.APIResource.Kind, resErr.Error)
+				log.Errorf("timeout listing resource %q: %#v", resErr.APIResource.Kind, resErr.Error)

Also applies to: 255-255, 279-279

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cmd/export/export.go` at line 214, Update the error log calls in the export
function, including the messages for namespace validation and the other
indicated errors, to use the same %#v formatting verb already used by nearby
error logs instead of %v. Keep the existing log messages and error handling
unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@cmd/export/export.go`:
- Line 214: Update the error log calls in the export function, including the
messages for namespace validation and the other indicated errors, to use the
same %#v formatting verb already used by nearby error logs instead of %v. Keep
the existing log messages and error handling unchanged.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 0c750163-832d-4c9f-aedb-31f428c4115b

📥 Commits

Reviewing files that changed from the base of the PR and between 6fd2f2e and 3be0f8f.

📒 Files selected for processing (1)
  • cmd/export/export.go

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
cmd/export/export.go (1)

213-216: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add the namespace to the validation failure log.

The log message "namespace validation failed: %v" does not include o.userSpecifiedNamespace. Add the namespace value so the log entry is self-contained and actionable without cross-referencing the earlier "Starting export" log line.

🛠️ Proposed fix
 	if err := validateExportNamespace(context.Background(), kubeClient, o.userSpecifiedNamespace, log); err != nil {
-		log.Errorf("namespace validation failed: %v", err)
+		log.Errorf("namespace validation failed for namespace %q: %v", o.userSpecifiedNamespace, err)
 		return err
 	}

As per coding guidelines, "Do not skip error context - include resource names and types."

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cmd/export/export.go` around lines 213 - 216, Update the validation failure
log in the export flow around validateExportNamespace to include
o.userSpecifiedNamespace alongside the existing error details, making the entry
self-contained while preserving the current error return behavior.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@cmd/export/export.go`:
- Around line 213-216: Update the validation failure log in the export flow
around validateExportNamespace to include o.userSpecifiedNamespace alongside the
existing error details, making the entry self-contained while preserving the
current error return behavior.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: fbdfd18b-049c-47db-81e9-541f4787fc3f

📥 Commits

Reviewing files that changed from the base of the PR and between 3be0f8f and d2d9f5b.

📒 Files selected for processing (1)
  • cmd/export/export.go

@Tamar-Dinavetsky Tamar-Dinavetsky changed the title feat(audit): improve logging ✨ feat(audit): improve logging Aug 4, 2026
@Tamar-Dinavetsky Tamar-Dinavetsky self-assigned this Aug 4, 2026

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 6

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@cmd/export/cluster.go`:
- Around line 240-252: Update the acceptance logs in the ServiceAccount branch,
ClusterRole acceptance path, and direct SCC RoleRef path to include the specific
match path: ServiceAccount namespace/name, ClusterRoleBinding name, or SCC
RoleRef details. Follow the existing context format used by the Group, User, and
SCC-via-ClusterRoleBinding logs, while preserving the current acceptance
behavior.
- Line 229: Update the conversion warnings in the ClusterRoleBinding,
ClusterRole, and SCC paths to include the source object's GetKind(), GetName(),
actual %T, and API resource name alongside the error. Use the f variable when
formatting nested ClusterRoleBinding objects in the ClusterRole and SCC paths,
and apply the same context to the warnings around lines 266-273 and 290-299.

In `@cmd/export/discover.go`:
- Around line 289-301: Update all listing failure logs in the surrounding
error-handling switch, including the timeout log before it, to include
g.APIResource.Name alongside groupVersion and kind. Preserve the existing
severity levels and messages while ensuring timeout, forbidden,
unsupported-method, not-found, and generic errors identify the resource name.
- Line 391: Update the four type-assertion error returns in the resource
discovery flow near the existing logger.Errorf call to include API resource
name, group version, kind, and received type. Wrap the iteration error at the
first return with %w while preserving the underlying error, and apply the same
resource context to the returns at the other three locations.
- Around line 302-305: Preserve the original per-item GET error through the
aggregate error path so resourceToExtract can detect Kubernetes API timeouts and
context deadline exceeded with errors.Is. Update iterateItemsByGet/EachListItem
error aggregation and groupResourceError formatting to wrap the underlying error
rather than stringify it, then add a regression test covering per-item GET
timeouts for imagestreamtags or imagetags.
- Around line 225-227: Update the ServerPreferredResources error-handling flow
to log an error before returning when discovery.IsGroupDiscoveryFailedError has
no resource lists. Preserve the existing warning for partial discovery failures
and the existing error log for other failures.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 6a4de162-4cd0-43d2-83b3-0771939e51a7

📥 Commits

Reviewing files that changed from the base of the PR and between d2d9f5b and a45d311.

📒 Files selected for processing (4)
  • cmd/export/cluster.go
  • cmd/export/crd.go
  • cmd/export/discover.go
  • cmd/export/export.go
🚧 Files skipped from review as they are similar to previous changes (1)
  • cmd/export/export.go

Comment thread cmd/export/cluster.go Outdated
Comment thread cmd/export/cluster.go Outdated
Comment thread cmd/export/discover.go
Comment thread cmd/export/discover.go Outdated
Comment thread cmd/export/discover.go
Comment thread cmd/export/discover.go Outdated
Comment thread cmd/export/cluster.go Outdated
@Tamar-Dinavetsky Tamar-Dinavetsky changed the title ✨ feat(audit): improve logging ✨ feat(audit): improve logging in export dir Aug 6, 2026
@Tamar-Dinavetsky

Copy link
Copy Markdown
Contributor Author

/rfr

@stillalearner stillalearner left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants