fix: add logging to authentication errors in controller and router

Log authentication failures across the controller service (Listen,
GetLease, RequestLease, ReleaseLease, ListLeases, Register, Unregister,
Status, Dial), the Auth helpers (AuthClient, AuthExporter) which cover
all ClientService call sites, the router service, and the Python
exporter's PassphraseInterceptor.

The peer IP address is extracted from the gRPC context and included in
every auth log entry. For ClientService paths the peer is attached via
peerAddr(); for ControllerService unary handlers logContext() is called
at the start of each method so the peer propagates into all subsequent
log entries including the auth failure.

Log level: Info (not Error) is used intentionally, following the
convention established by kube-apiserver. Authentication rejections are
expected adversarial events, not controller bugs. Using Error would
conflate "something is broken in the controller" with "a caller sent a
bad token", muddying alerts. The controller-runtime/logr interface has
no native Warn level (the backend is zapr, which maps logr.Info ->
zap INFO and logr.Error -> zap ERROR with no WARN in between), so Info
at the default V=0 verbosity is the correct choice for security-relevant
but operationally normal events.

Also fix the router JWT validation gRPC status code from
codes.InvalidArgument to codes.Unauthenticated, which is the
semantically correct code for a failed authentication.

Fixes #811

Author: mangelajo

controller/internal/service/auth/auth.go

@@ -2,17 +2,34 @@ package auth
 
 import (
 	"context"
+	"net"
 
 	jumpstarterdevv1alpha1 "github.com/jumpstarter-dev/jumpstarter-controller/api/v1alpha1"
 	"github.com/jumpstarter-dev/jumpstarter-controller/internal/authentication"
 	"github.com/jumpstarter-dev/jumpstarter-controller/internal/authorization"
 	"github.com/jumpstarter-dev/jumpstarter-controller/internal/oidc"
 	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/peer"
 	"google.golang.org/grpc/status"
 	"k8s.io/apiserver/pkg/authorization/authorizer"
 	kclient "sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/log"
 )
 
+// peerAddr returns the remote IP address from the gRPC peer info stored in ctx,
+// or "unknown" if unavailable.
+func peerAddr(ctx context.Context) string {
+	p, ok := peer.FromContext(ctx)
+	if !ok {
+		return "unknown"
+	}
+	host, _, err := net.SplitHostPort(p.Addr.String())
+	if err != nil {
+		return p.Addr.String()
+	}
+	return host
+}
+
 type Auth struct {
 	client kclient.Client
 	authn  authentication.ContextAuthenticator
@@ -35,6 +52,8 @@ func NewAuth(
 }
 
 func (s *Auth) AuthClient(ctx context.Context, namespace string) (*jumpstarterdevv1alpha1.Client, error) {
+	logger := log.FromContext(ctx).WithValues("peer", peerAddr(ctx))
+
 	jclient, err := oidc.VerifyClientObjectToken(
 		ctx,
 		s.authn,
@@ -44,17 +63,22 @@ func (s *Auth) AuthClient(ctx context.Context, namespace string) (*jumpstarterde
 	)
 
 	if err != nil {
+		logger.Info("client authentication failed", "error", err.Error())
 		return nil, err
 	}
 
 	if namespace != jclient.Namespace {
-		return nil, status.Error(codes.PermissionDenied, "namespace mismatch")
+		err := status.Error(codes.PermissionDenied, "namespace mismatch")
+		logger.Info("client authentication failed", "client", jclient.Name, "error", err.Error())
+		return nil, err
 	}
 
 	return jclient, nil
 }
 
 func (s *Auth) AuthExporter(ctx context.Context, namespace string) (*jumpstarterdevv1alpha1.Exporter, error) {
+	logger := log.FromContext(ctx).WithValues("peer", peerAddr(ctx))
+
 	jexporter, err := oidc.VerifyExporterObjectToken(
 		ctx,
 		s.authn,
@@ -64,11 +88,14 @@ func (s *Auth) AuthExporter(ctx context.Context, namespace string) (*jumpstarter
 	)
 
 	if err != nil {
+		logger.Info("exporter authentication failed", "error", err.Error())
 		return nil, err
 	}
 
 	if namespace != jexporter.Namespace {
-		return nil, status.Error(codes.PermissionDenied, "namespace mismatch")
+		err := status.Error(codes.PermissionDenied, "namespace mismatch")
+		logger.Info("exporter authentication failed", "exporter", jexporter.Name, "error", err.Error())
+		return nil, err
 	}
 
 	return jexporter, nil

controller/internal/service/controller_service.go

@@ -240,11 +240,12 @@ func (s *ControllerService) authenticateExporter(ctx context.Context) (*jumpstar
 }
 
 func (s *ControllerService) Register(ctx context.Context, req *pb.RegisterRequest) (*pb.RegisterResponse, error) {
+	ctx = logContext(ctx)
 	logger := log.FromContext(ctx)
 
 	exporter, err := s.authenticateExporter(ctx)
 	if err != nil {
-		logger.Info("unable to authenticate exporter", "error", err.Error())
+		logger.Info("exporter authentication failed", "error", err.Error())
 		return nil, err
 	}
 
@@ -311,7 +312,7 @@ func (s *ControllerService) Unregister(
 
 	exporter, err := s.authenticateExporter(ctx)
 	if err != nil {
-		logger.Error(err, "unable to authenticate exporter")
+		logger.Info("unable to authenticate exporter", "error", err.Error())
 		return nil, err
 	}
 
@@ -524,6 +525,7 @@ func (s *ControllerService) Listen(req *pb.ListenRequest, stream pb.ControllerSe
 
 	exporter, err := s.authenticateExporter(ctx)
 	if err != nil {
+		logger.Info("exporter authentication failed", "error", err.Error())
 		return err
 	}
 
@@ -613,7 +615,7 @@ func (s *ControllerService) Status(req *pb.StatusRequest, stream pb.ControllerSe
 
 	exporter, err := s.authenticateExporter(ctx)
 	if err != nil {
-		logger.Error(err, "unable to authenticate exporter")
+		logger.Info("unable to authenticate exporter", "error", err.Error())
 		return err
 	}
 
@@ -747,7 +749,7 @@ func (s *ControllerService) Dial(ctx context.Context, req *pb.DialRequest) (*pb.
 
 	client, err := s.authenticateClient(ctx)
 	if err != nil {
-		logger.Error(err, "unable to authenticate client")
+		logger.Info("unable to authenticate client", "error", err.Error())
 		return nil, err
 	}
 
@@ -898,8 +900,12 @@ func (s *ControllerService) GetLease(
 	ctx context.Context,
 	req *pb.GetLeaseRequest,
 ) (*pb.GetLeaseResponse, error) {
+	ctx = logContext(ctx)
+	logger := log.FromContext(ctx)
+
 	client, err := s.authenticateClient(ctx)
 	if err != nil {
+		logger.Info("client authentication failed", "error", err.Error())
 		return nil, err
 	}
 
@@ -977,8 +983,12 @@ func (s *ControllerService) RequestLease(
 	ctx context.Context,
 	req *pb.RequestLeaseRequest,
 ) (*pb.RequestLeaseResponse, error) {
+	ctx = logContext(ctx)
+	logger := log.FromContext(ctx)
+
 	client, err := s.authenticateClient(ctx)
 	if err != nil {
+		logger.Info("client authentication failed", "error", err.Error())
 		return nil, err
 	}
 
@@ -1031,8 +1041,12 @@ func (s *ControllerService) ReleaseLease(
 	ctx context.Context,
 	req *pb.ReleaseLeaseRequest,
 ) (*pb.ReleaseLeaseResponse, error) {
+	ctx = logContext(ctx)
+	logger := log.FromContext(ctx)
+
 	jclient, err := s.authenticateClient(ctx)
 	if err != nil {
+		logger.Info("client authentication failed", "error", err.Error())
 		return nil, err
 	}
 
@@ -1062,8 +1076,12 @@ func (s *ControllerService) ListLeases(
 	ctx context.Context,
 	req *pb.ListLeasesRequest,
 ) (*pb.ListLeasesResponse, error) {
+	ctx = logContext(ctx)
+	logger := log.FromContext(ctx)
+
 	jclient, err := s.authenticateClient(ctx)
 	if err != nil {
+		logger.Info("client authentication failed", "error", err.Error())
 		return nil, err
 	}
 

controller/internal/service/router_service.go

@@ -71,7 +71,7 @@ func (s *RouterService) authenticate(ctx context.Context) (string, error) {
 	)
 
 	if err != nil || !parsed.Valid {
-		return "", status.Errorf(codes.InvalidArgument, "invalid jwt token")
+		return "", status.Errorf(codes.Unauthenticated, "invalid jwt token")
 	}
 
 	return parsed.Claims.GetSubject()
@@ -83,7 +83,7 @@ func (s *RouterService) Stream(stream pb.RouterService_StreamServer) error {
 
 	streamName, err := s.authenticate(ctx)
 	if err != nil {
-		logger.Error(err, "failed to authenticate")
+		logger.Info("router authentication failed", "error", err.Error())
 		return err
 	}
 

python/packages/jumpstarter/jumpstarter/exporter/auth.py

@@ -25,6 +25,10 @@ async def intercept_service(self, continuation, handler_call_details):
         provided = metadata.get(PASSPHRASE_METADATA_KEY)
 
         if provided is None or not hmac.compare_digest(provided, self._passphrase):
+            logger.warning(
+                "authentication failed: invalid or missing passphrase for method %s",
+                handler_call_details.method,
+            )
             # Resolve the real handler to preserve the RPC type, then reject
             handler = await continuation(handler_call_details)
             if handler is None: