From 0d64f4e05a315833fdaeebdd6d5230e9947e2d18 Mon Sep 17 00:00:00 2001 From: Will Krause Date: Wed, 28 Jan 2026 19:22:18 -0500 Subject: [PATCH] fix(ec2): add error logging for credential failures in EC2 discovery When an EC2 upstream is configured with invalid or missing AWS credentials, the discovery would fail silently without clear error logs. This made it difficult to diagnose issues where EC2 instances became inaccessible. This change adds explicit ERROR level logging in eds.go when: - Secret listing fails for EC2 upstream discovery - EC2 instance fetching fails (e.g., invalid credentials, access denied) The error message now clearly indicates "failed to fetch EC2 instances for upstream discovery" with the underlying error details. Co-Authored-By: Claude Opus 4.5 --- changelog/v1.21.0-beta14/ec2-credential-error-logging.yaml | 5 +++++ projects/gloo/pkg/plugins/aws/ec2/eds.go | 2 ++ 2 files changed, 7 insertions(+) create mode 100644 changelog/v1.21.0-beta14/ec2-credential-error-logging.yaml diff --git a/changelog/v1.21.0-beta14/ec2-credential-error-logging.yaml b/changelog/v1.21.0-beta14/ec2-credential-error-logging.yaml new file mode 100644 index 00000000000..a9e18bdf75c --- /dev/null +++ b/changelog/v1.21.0-beta14/ec2-credential-error-logging.yaml @@ -0,0 +1,5 @@ +changelog: +- type: FIX + issueLink: https://github.com/solo-io/gloo/issues/0000 + resolvesIssue: false + description: Add ERROR level logging when EC2 upstream discovery fails due to invalid or missing AWS credentials. diff --git a/projects/gloo/pkg/plugins/aws/ec2/eds.go b/projects/gloo/pkg/plugins/aws/ec2/eds.go index c508ac8c5da..759b8d4d064 100644 --- a/projects/gloo/pkg/plugins/aws/ec2/eds.go +++ b/projects/gloo/pkg/plugins/aws/ec2/eds.go @@ -92,6 +92,7 @@ func (c *edsWatcher) updateEndpointsList(endpointsChan chan v1.EndpointList, err for _, ns := range c.secretNamespaces { nsSecrets, err := c.secretClient.List(ns, clients.ListOpts{Ctx: c.watchContext}) if err != nil { + contextutils.LoggerFrom(c.watchContext).Errorw("failed to list secrets for EC2 upstream discovery", "namespace", ns, "error", err) errs <- err return } @@ -100,6 +101,7 @@ func (c *edsWatcher) updateEndpointsList(endpointsChan chan v1.EndpointList, err allEndpoints, err := getLatestEndpoints(c.watchContext, c.ec2InstanceLister, secrets, c.writeNamespace, c.upstreams) if err != nil { + contextutils.LoggerFrom(c.watchContext).Errorw("failed to fetch EC2 instances for upstream discovery", "error", err) errs <- err return }