l7policy: Log allowed traffic once.

Signed-off-by: Jarno Rajahalme <[email protected]>

Author: jrajahalme

cilium/l7policy.cc

@@ -218,6 +218,8 @@ Http::FilterHeadersStatus AccessFilter::decodeHeaders(Http::RequestHeaderMap& he
     }
 
     // must have a policy configured
+    // This is safe as the upstream filter was introduced at Cilium 1.16 and
+    // bpf_metadata config has had 'enforce_policy_on_l7lb' set since Cilium 1.15.
     if (policy_fs->pod_ip_.length() == 0 && policy_fs->ingress_policy_name_.length() == 0) {
       ENVOY_CONN_LOG(warn, "cilium.network: no policy configured", conn.ref());
       return Http::FilterHeadersStatus::StopIteration;
@@ -264,8 +266,6 @@ Http::FilterHeadersStatus AccessFilter::decodeHeaders(Http::RequestHeaderMap& he
                                    absl::nullopt, absl::string_view());
         return Http::FilterHeadersStatus::StopIteration;
       }
-      // Log as a forwarded request
-      config_->log(*log_entry_, ::cilium::EntryType::Request);
     }
 
     // Is there an Ingress policy?
@@ -282,9 +282,9 @@ Http::FilterHeadersStatus AccessFilter::decodeHeaders(Http::RequestHeaderMap& he
                                    absl::nullopt, absl::string_view());
         return Http::FilterHeadersStatus::StopIteration;
       }
-      // Log as a forwarded request
-      config_->log(*log_entry_, ::cilium::EntryType::Request);
     }
+    // Log as a forwarded request, once.
+    config_->log(*log_entry_, ::cilium::EntryType::Request);
   }
   return Http::FilterHeadersStatus::Continue;
 }