CCL-2140: add per-cluster Envoy access log override

api/v1/qdrantcluster_types.go

@@ -762,6 +762,17 @@ type Ingress struct {
 	// Traefik specifies the traefik ingress specific configurations.
 	// +optional
 	Traefik *TraefikConfig `json:"traefik,omitempty"`
+	// EnableAccessLog overrides the region-wide Envoy proxy access log setting
+	// for this cluster: true forces it on, false forces it off, and unset
+	// follows the region.
+	//
+	// The override matters in both directions. A single tenant can carry most
+	// of a region's traffic, so "off" has to be expressible for one cluster
+	// without giving up the log for every other cluster in that region; and
+	// "on" has to be expressible for a cluster under investigation without
+	// enabling the whole region.
+	// +optional
+	EnableAccessLog *bool `json:"enableAccessLog,omitempty"`
 }
 
 func (i *Ingress) GetAnnotations() map[string]string {
@@ -785,6 +796,16 @@ func (i *Ingress) GetTls(def bool) bool {
 	return *i.TLS
 }
 
+// GetEnableAccessLog returns whether the Envoy access log is enabled for this
+// cluster, falling back to def (the region-wide setting) when the cluster does
+// not override it.
+func (i *Ingress) GetEnableAccessLog(def bool) bool {
+	if i == nil || i.EnableAccessLog == nil {
+		return def
+	}
+	return *i.EnableAccessLog
+}
+
 func (i *Ingress) GetNGINX() *NGINXConfig {
 	if i == nil {
 		return nil

api/v1/qdrantcluster_types_test.go

@@ -196,3 +196,34 @@ func TestValidate(t *testing.T) {
 		})
 	}
 }
+
+// TestIngressGetEnableAccessLog pins the three-state override. The false case is
+// the one that matters operationally: a single tenant can carry most of a
+// region's traffic, so it has to be possible to silence one cluster without
+// giving up the log for every other cluster in the region.
+func TestIngressGetEnableAccessLog(t *testing.T) {
+	testCases := []struct {
+		name    string
+		ingress *Ingress
+		region  bool
+		want    bool
+	}{
+		{"nil ingress follows the region", nil, true, true},
+		{"unset follows the region (on)", &Ingress{}, true, true},
+		{"unset follows the region (off)", &Ingress{}, false, false},
+		{"true forces on against a disabled region", &Ingress{EnableAccessLog: ptr.To(true)}, false, true},
+		{"false forces off against an enabled region", &Ingress{EnableAccessLog: ptr.To(false)}, true, false},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, tc.ingress.GetEnableAccessLog(tc.region))
+		})
+	}
+}
+
+func TestIngressJSONOmitsUnsetEnableAccessLog(t *testing.T) {
+	data, err := json.Marshal(Ingress{})
+
+	assert.NoError(t, err)
+	assert.NotContains(t, string(data), "enableAccessLog")
+}

charts/qdrant-kubernetes-api/templates/region-crds/qdrant.io_qdrantclusters.yaml

@@ -451,6 +451,18 @@ spec:
                       type: string
                     description: Annotations specifies annotations for the ingress.
                     type: object
+                  enableAccessLog:
+                    description: |-
+                      EnableAccessLog overrides the region-wide Envoy proxy access log setting
+                      for this cluster: true forces it on, false forces it off, and unset
+                      follows the region.
+
+                      The override matters in both directions. A single tenant can carry most
+                      of a region's traffic, so "off" has to be expressible for one cluster
+                      without giving up the log for every other cluster in that region; and
+                      "on" has to be expressible for a cluster under investigation without
+                      enabling the whole region.
+                    type: boolean
                   enabled:
                     description: Enabled specifies whether to enable ingress for the
                       cluster or not.

crds/qdrant.io_qdrantclusters.yaml

@@ -450,6 +450,18 @@ spec:
                       type: string
                     description: Annotations specifies annotations for the ingress.
                     type: object
+                  enableAccessLog:
+                    description: |-
+                      EnableAccessLog overrides the region-wide Envoy proxy access log setting
+                      for this cluster: true forces it on, false forces it off, and unset
+                      follows the region.
+
+                      The override matters in both directions. A single tenant can carry most
+                      of a region's traffic, so "off" has to be expressible for one cluster
+                      without giving up the log for every other cluster in that region; and
+                      "on" has to be expressible for a cluster under investigation without
+                      enabling the whole region.
+                    type: boolean
                   enabled:
                     description: Enabled specifies whether to enable ingress for the
                       cluster or not.

docs/api.md

@@ -371,6 +371,7 @@ _Appears in:_
 | `tlsSecretName` _string_ | TLSSecretName specifies the name of the secret containing the tls certificate. |  | Optional: \{\} <br /> |
 | `nginx` _[NGINXConfig](#nginxconfig)_ | NGINX specifies the nginx ingress specific configurations. |  | Optional: \{\} <br /> |
 | `traefik` _[TraefikConfig](#traefikconfig)_ | Traefik specifies the traefik ingress specific configurations. |  | Optional: \{\} <br /> |
+| `enableAccessLog` _boolean_ | EnableAccessLog overrides the region-wide Envoy proxy access log setting<br />for this cluster: true forces it on, false forces it off, and unset<br />follows the region.<br />The override matters in both directions. A single tenant can carry most<br />of a region's traffic, so "off" has to be expressible for one cluster<br />without giving up the log for every other cluster in that region; and<br />"on" has to be expressible for a cluster under investigation without<br />enabling the whole region. |  | Optional: \{\} <br /> |
 
 
 #### KubernetesDistribution