Uploaded image for project: 'OpenShift Logging'
  1. OpenShift Logging
  2. LOG-8130

Vector metrics can't be scraped by prometheus when CLF has inputs.receiver and networkpolicy ruleSet is `RestrictIngressEgress`.

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • None
    • Logging 6.4.0
    • Log Collection
    • None
    • Incidents & Support
    • False
    • Hide

      None

      Show
      None
    • False
    • NEW
    • NEW
    • Bug Fix
    • Important

      Description of problem:

      Create below CLF:

      apiVersion: observability.openshift.io/v1
      kind: ClusterLogForwarder
      metadata:
        name: http-to-http
        namespace: e2e-test-logfwdhttp-sg46r
      spec:
        collector:
          networkPolicy:
            ruleSet: RestrictIngressEgress
        inputs:
        - name: httpserver
          receiver:
            http:
              format: kubeAPIAudit
            port: 8443
            type: http
          type: receiver
        managementState: Managed
        outputs:
        - http:
            headers:
              h1: v1
              h2: v2
            method: POST
            url: https://fluentdtest.e2e-test-logfwdhttp-sg46r.svc:24224/logs/audit
          name: httpout-audit
          tls:
            ca:
              key: ca-bundle.crt
              secretName: to-fluentd-65131
            certificate:
              key: tls.crt
              secretName: to-fluentd-65131
            key:
              key: tls.key
              secretName: to-fluentd-65131
            keyPassphrase:
              key: passphrase
              secretName: to-fluentd-65131
          type: http
        pipelines:
        - inputRefs:
          - httpserver
          name: audit-logs
          outputRefs:
          - httpout-audit
        serviceAccount:
          name: clf-ij4l7i7t 

      Then log into OCP console, and go to Observe–> Targets, all collector pods' targets are down.

      NetworkPolicy:

      apiVersion: networking.k8s.io/v1
      kind: NetworkPolicy
      metadata:
        creationTimestamp: "2025-11-21T08:38:25Z"
        generation: 3
        labels:
          app.kubernetes.io/component: collector
          app.kubernetes.io/instance: http-to-http
          app.kubernetes.io/managed-by: cluster-logging-operator
          app.kubernetes.io/name: vector
          app.kubernetes.io/part-of: cluster-logging
          app.kubernetes.io/version: 6.4.0
        name: collector-http-to-http
        namespace: e2e-test-logfwdhttp-sg46r
        ownerReferences:
        - apiVersion: observability.openshift.io/v1
          controller: true
          kind: ClusterLogForwarder
          name: http-to-http
          uid: b9bfa92a-6336-4599-b73a-9b7ae1d2efce
        resourceVersion: "65295"
        uid: eb468754-428f-4609-8237-8696054978af
      spec:
        egress:
        - ports:
          - port: dns
            protocol: UDP
          - port: 6443
            protocol: TCP
          - port: 24224
            protocol: TCP
        ingress:
        - ports:
          - port: metrics
            protocol: TCP
          - port: 8443
            protocol: TCP
        podSelector:
          matchLabels:
            app.kubernetes.io/component: collector
            app.kubernetes.io/instance: http-to-http
            app.kubernetes.io/managed-by: cluster-logging-operator
            app.kubernetes.io/name: vector
            app.kubernetes.io/part-of: cluster-logging
        policyTypes:
        - Ingress
        - Egress

      Version-Release number of selected component (if applicable):

      cluster-logging.v6.4.0

      How reproducible:

      Always 

      Steps to Reproduce:

      1.  Create CLF, enable http or syslog receiver and `RestrictIngressEgress` networkpolicy
      2. Check metrics/targets in OCP Console

      Actual results:

      Vector metrics can't be scraped by prometheus when CLF has inputs.receiver and networkpolicy ruleSet is `RestrictIngressEgress`.

      Expected results:

      Metrics should be scrapped.

      Additional info:

      1. No issue when networkpolicy ruleSet is `AllowAllIngressEgress`
      2. No issue when there is no inputs.receiver in the CLF

              Unassigned Unassigned
              qitang@redhat.com Qiaoling Tang
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated: