Uploaded image for project: 'OpenShift Logging'
  1. OpenShift Logging
  2. LOG-3533

tls.cert, tls.key and passphrase are not passed to the fluentd configuration when forwarding logs using syslog over TLS

XMLWordPrintable

    • False
    • None
    • False
    • NEW
    • VERIFIED
    • Before this update, TLS credentials for a syslog output supplied using a ClusterLogForwarder were not passed on to fluentd, resulting in errors during forwarding. With this update, the fluentd configuration is created correctly.
    • Hide

      Deploy RHOL

      $ oc get csv -n openshift-logging
      NAME                           DISPLAY                            VERSION   REPLACES   PHASE
      cluster-logging.5.4.3          Red Hat OpenShift Logging          5.4.3                Succeeded
      elasticsearch-operator.5.4.3   OpenShift Elasticsearch Operator   5.4.3                Succeeded
       

      Create a secret containing `ca-bundle.crt`, `tls.crt` and `tls.key` for being used later in the clusterLogForwarder for sending to syslog:

      $ oc get secret syslog -o yaml 
      apiVersion: v1
      data:
        ca-bundle.crt: xxxxx
        tls.crt: xxxxx
        tls.key: xxxxx
      kind: Secret
      metadata:
        creationTimestamp: "2022-07-20T15:01:27Z"
        name: syslog
        namespace: openshift-logging
        resourceVersion: "7350054"
        uid: 5a4f01b3-e6f8-4f55-a284-9976217810a6
      type: Opaque

      Configure clusterLogForwarder for sending logs to rsyslog using tls 

      $ cat clusterlogforwarder.yaml
      apiVersion: logging.openshift.io/v1
      kind: ClusterLogForwarder
      metadata:
        labels:
          app.kubernetes.io/instance: logging
        name: instance
        namespace: openshift-logging
      spec:
        outputs:
          - name: syslog
            secret:
              name: syslog
            syslog:
              addLogSource: true
              facility: syslog
              rfc: RFC3164
              severity: informational
            type: syslog
            url: 'tls://localhost:514'
        pipelines:
          - inputRefs:
              - application
            name: application-logs
            outputRefs:
              - syslog
       $ oc create -f clusterlogforwarder.yaml

      Check the fluentd configuration generated that it only contains the `ca-bundle.crt` and not the `tls.key` and `tls.crt`:

      $ oc get cm collector -o json |jq '.data."fluent.conf"' -r
      ...
        <match journal.** system.var.log**>
          @type remote_syslog
          @id syslog_journal
          host localhost
          port 514
          rfc rfc3164
          facility syslog
          severity informational
          program ${$.systemd.u.SYSLOG_IDENTIFIER}
          protocol tcp
          packet_size 4096
          hostname "#{ENV['NODE_NAME']}"
          tls true
          ca_file '/var/run/ocp-collector/secrets/syslog/ca-bundle.crt'
          timeout 60
          timeout_exception true
          keep_alive true
          keep_alive_idle 75
          keep_alive_cnt 9
          keep_alive_intvl 7200
          <format>
            @type json
          </format>
          <buffer $.systemd.u.SYSLOG_IDENTIFIER>
            @type file
            path '/var/lib/fluentd/syslog_journal'
            flush_mode interval
            flush_interval 1s
            flush_thread_count 2
            retry_type exponential_backoff
            retry_wait 1s
            retry_max_interval 60s
            retry_timeout 60m
            queued_chunks_limit_size "#{ENV['BUFFER_QUEUE_LIMIT'] || '32'}"
            total_limit_size "#{ENV['TOTAL_LIMIT_SIZE_PER_BUFFER'] || '8589934592'}"
            chunk_limit_size "#{ENV['BUFFER_SIZE_LIMIT'] || '8m'}"
            overflow_action block
            disable_chunk_backup true
          </buffer>
        </match>  <match **>
          @type remote_syslog
          @id syslog
          host localhost
          port 514
          rfc rfc3164
          facility syslog
          severity informational
          protocol tcp
          packet_size 4096
          hostname "#{ENV['NODE_NAME']}"
          tls true
          ca_file '/var/run/ocp-collector/secrets/syslog/ca-bundle.crt'
          timeout 60
          timeout_exception true
          keep_alive true
          keep_alive_idle 75
          keep_alive_cnt 9
          keep_alive_intvl 7200
          <format>
            @type json
          </format>
          <buffer>
            @type file
            path '/var/lib/fluentd/syslog'
            flush_mode interval
            flush_interval 1s
            flush_thread_count 2
            retry_type exponential_backoff
            retry_wait 1s
            retry_max_interval 60s
            retry_timeout 60m
            queued_chunks_limit_size "#{ENV['BUFFER_QUEUE_LIMIT'] || '32'}"
            total_limit_size "#{ENV['TOTAL_LIMIT_SIZE_PER_BUFFER'] || '8589934592'}"
            chunk_limit_size "#{ENV['BUFFER_SIZE_LIMIT'] || '8m'}"
            overflow_action block
            disable_chunk_backup true
          </buffer>
        </match>
      </label>
      ....
      Show
      Deploy RHOL $ oc get csv -n openshift-logging NAME                           DISPLAY                            VERSION   REPLACES   PHASE cluster-logging.5.4.3          Red Hat OpenShift Logging          5.4.3                Succeeded elasticsearch- operator .5.4.3   OpenShift Elasticsearch Operator   5.4.3                Succeeded Create a secret containing `ca-bundle.crt`, `tls.crt` and `tls.key` for being used later in the clusterLogForwarder for sending to syslog: $ oc get secret syslog -o yaml  apiVersion: v1 data:   ca-bundle.crt: xxxxx   tls.crt: xxxxx   tls.key: xxxxx kind: Secret metadata:   creationTimestamp: "2022-07-20T15:01:27Z"   name: syslog   namespace: openshift-logging   resourceVersion: "7350054"   uid: 5a4f01b3-e6f8-4f55-a284-9976217810a6 type: Opaque Configure clusterLogForwarder for sending logs to rsyslog using tls   $ cat clusterlogforwarder.yaml apiVersion: logging.openshift.io/v1 kind: ClusterLogForwarder metadata:   labels:     app.kubernetes.io/instance: logging   name: instance   namespace: openshift-logging spec:   outputs:     - name: syslog       secret:         name: syslog       syslog:         addLogSource: true         facility: syslog         rfc: RFC3164         severity: informational       type: syslog       url: 'tls: //localhost:514'   pipelines:     - inputRefs:         - application       name: application-logs       outputRefs:         - syslog $ oc create -f clusterlogforwarder.yaml Check the fluentd configuration generated that it only contains the `ca-bundle.crt` and not the `tls.key` and `tls.crt`: $ oc get cm collector -o json |jq '.data. "fluent.conf" ' -r ... <match journal.** system. var .log**>     @type remote_syslog     @id syslog_journal     host localhost     port 514     rfc rfc3164     facility syslog     severity informational     program ${$.systemd.u.SYSLOG_IDENTIFIER}     protocol tcp     packet_size 4096     hostname "#{ENV[ 'NODE_NAME' ]}"     tls true     ca_file '/ var /run/ocp-collector/secrets/syslog/ca-bundle.crt'     timeout 60     timeout_exception true     keep_alive true     keep_alive_idle 75     keep_alive_cnt 9     keep_alive_intvl 7200     <format>       @type json     </format>     <buffer $.systemd.u.SYSLOG_IDENTIFIER>       @type file       path '/ var /lib/fluentd/syslog_journal'       flush_mode interval       flush_interval 1s       flush_thread_count 2       retry_type exponential_backoff       retry_wait 1s       retry_max_interval 60s       retry_timeout 60m       queued_chunks_limit_size "#{ENV[ 'BUFFER_QUEUE_LIMIT' ] || '32' }"       total_limit_size "#{ENV[ 'TOTAL_LIMIT_SIZE_PER_BUFFER' ] || '8589934592' }"       chunk_limit_size "#{ENV[ 'BUFFER_SIZE_LIMIT' ] || '8m' }"       overflow_action block       disable_chunk_backup true     </buffer>   </match>  <match **>     @type remote_syslog     @id syslog     host localhost     port 514     rfc rfc3164     facility syslog     severity informational     protocol tcp     packet_size 4096     hostname "#{ENV[ 'NODE_NAME' ]}"     tls true     ca_file '/ var /run/ocp-collector/secrets/syslog/ca-bundle.crt'     timeout 60     timeout_exception true     keep_alive true     keep_alive_idle 75     keep_alive_cnt 9     keep_alive_intvl 7200     <format>       @type json     </format>     <buffer>       @type file       path '/ var /lib/fluentd/syslog'       flush_mode interval       flush_interval 1s       flush_thread_count 2       retry_type exponential_backoff       retry_wait 1s       retry_max_interval 60s       retry_timeout 60m       queued_chunks_limit_size "#{ENV[ 'BUFFER_QUEUE_LIMIT' ] || '32' }"       total_limit_size "#{ENV[ 'TOTAL_LIMIT_SIZE_PER_BUFFER' ] || '8589934592' }"       chunk_limit_size "#{ENV[ 'BUFFER_SIZE_LIMIT' ] || '8m' }"       overflow_action block       disable_chunk_backup true     </buffer>   </match> </label> ....

      When defined for forwarding logs using the syslog protocol with tls and the secret contains the `ca-bundle.crt`, `tls.key` and `tls.crt`, the real configuration generated for fluentd defines only `ca-bundle.crt` omitting `tls.key` and `tls.cert`.

            syedriko_sub@redhat.com Sergey Yedrikov
            rhn-support-ocasalsa Oscar Casal Sanchez
            Qiaoling Tang Qiaoling Tang
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

              Created:
              Updated:
              Resolved: