Uploaded image for project: 'OpenShift Logging'
  1. OpenShift Logging
  2. LOG-4012

[fluentd] [LokiStack] Collector should comply with the tlsSecurityProfile config set globally when using LokiStack as the default log store.

XMLWordPrintable

    • False
    • None
    • False
    • NEW
    • OBSDA-160 - Comply with OCP cluster-wide cryptographic policies
    • NEW
    • Log Collection - Sprint 235

      Description of problem:

      When using LokiStack as the default log store, fluentd collector should use the tlsSecurityProfile config set globally  in apiserver/cluster configuration for Loki sink. The TLS profile config when using the default LokiStack as the log store shouldn't require enabling the feature gate since we are setting the profile on the log store server side without any feature gate. 

      Version-Release number of selected component (if applicable):

      cluster-logging.v5.7.0

      loki-operator.v5.7.0

      How reproducible:

      Always

      Steps to Reproduce:

      *Set any TLS profile in the global apiserver/cluster configuration. By default if no profile is set, intermediate profile must be used by Cluster Logging.

      *Create a LokiStack instance.

      *Create a ClusterLogging instance with fluentd as collector and using the LokiStack instance as the default log store.

      apiVersion: "logging.openshift.io/v1"
      kind: "ClusterLogging"
      metadata:
        name: "instance"
        namespace: openshift-logging
      spec:
        managementState: "Managed"
        logStore:
          type: "lokistack"
          lokistack:
            name: lokistack-instance
        collection:
          type: "fluentd"
       

      *Extract and check the vector config, the cipher and min TLS version is set according to the TLS profile for the prometheus sink only.

       

      Additional info:

      When using LokiStack as the log storage, we are complying with the global TLS profile which dosn't require any feature gate. https://issues.redhat.com/browse/LOG-895 

       

              jcantril@redhat.com Jeffrey Cantrill
              rhn-support-ikanse Ishwar Kanse
              Ishwar Kanse Ishwar Kanse
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: