Loading...

XML

Word

Printable

Type: Bug
Resolution: Done
Priority: Critical
Fix Version/s: Logging 5.6.7
Affects Version/s: Logging 5.5.5, Logging 5.6.0, Logging 5.7.0
Component/s: Log Collection
Labels:
- devel_ack+

Blocked:
False
Blocked Reason:
None
Ready:
False
Docs QE Status:
NEW
QE Status:
VERIFIED
Release Note Text:

Hide
Before this update, CLO API require a certificate to be provided through K8s Secret if the tls.insecureSkipVerify option is set to true. With these changes, CLO API will no longer require a certificate to be provided through K8s Secret if the tls.insecureSkipVerify option is set to true. The following configuration will be added to the Vector config:
tls.verify_certificate = false
tls.verify_hostname = false

Show
Before this update, CLO API require a certificate to be provided through K8s Secret if the tls.insecureSkipVerify option is set to true. With these changes, CLO API will no longer require a certificate to be provided through K8s Secret if the tls.insecureSkipVerify option is set to true. The following configuration will be added to the Vector config: tls.verify_certificate = false tls.verify_hostname = false
Release Note Type:
Bug Fix
Intelligence Requested:
Market:

Severity:
Critical
Customer Impact:

Customer Escalated

SFDC Cases Links:
SFDC Cases Counter:
SFDC Cases Open:

Description of problem:

When tls.insecureSkipVerify=true is configured in ClusterLogForwarder, the cluster-logging-operator should set tls.verify_hostname=false and tls.verify_certificate=false.

And it seems the "Bearer Auth Config" section is added uselessly.

How reproducible:

Always

Steps to Reproduce:

deploy a loki service and expose via edge route( By the way: The certificate used by edge route is signed by kube-root-ca）.

git clone https://gitlab.cee.redhat.com/aosqe/aosqe-tools.git

sh aosqe-tools/logging/log_template/loki/01_deploy-loki.sh

Forward log to loki using insecure https.

#!/usr/bin/env bash
namespace=${1:-loki-aosqe}
route_name=${2:-loki-server}



loki_route=$(oc get route ${route_name} -n ${namespace} -o json |jq '.spec.host' -r)
cat <<EOF | oc create -f -
apiVersion: logging.openshift.io/v1
kind: ClusterLogForwarder
metadata:
  name: instance
  namespace: openshift-logging
spec:
  outputs:
  - name: loki-route
    type: loki
    url: https://${loki_route}
    tls:
      insecureSkipVerify: true
  pipelines:
    - name: app-to-loki
      inputRefs:
      - application
      - infrastructure
      - audit
      outputRefs:
      - loki-route
EOF

check the vector.toml...

Actual results:

[sinks.loki_route]
 ......
 ......
[sinks.loki_route.tls]
enabled = true
ca_file = "/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt"
# Bearer Auth Config
[sinks.loki_route.auth]
strategy = "bearer"
token = "xxxxx"

Expected results:

1)verify_certificate = false and verify_hostname =false

2)drop Bearer Auth Config section.

[sinks.loki_route.tls]
enabled = true
ca_file = "/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt"
verify_certificate = false
verify_hostname =false
 
# Bearer Auth Config
#[sinks.loki_route.auth]
#strategy = "bearer"
#token = "xxxxx