Repository navigation
bug: ClusterRole custom rules are lost when changes made to configuration #1614
Description
Describe the issue
We are seeing an issue where, after making changes to the configuration (eg altering a ClusterFilter), the additional rules in FluentBit object we set with rbacRules are being removed from the generated ClusterRole.
To Reproduce
- Set up a logging pipeline with
rbacRules(egeventspermissions used bykubernetesEvents) includingClusterFilter - Check the generated role, it should include those custom rules
- Change the
ClusterFiltereg adding/removing a rule - Check the generated role, it should be missing those custom rules
- Change the
FluentBitobject in some way (eg edit annotation) - Check the generated role, it should again include those custom rules
Expected behavior
ClusterRole should not change when altering filters
Your Environment
- Fluent Operator version: 3.2.0
- Container Runtime: Docker 24.0.9
- Operating system: Ubuntu 22.04.5 LTS
- Kernel version: 5.15.0-131-genericHow did you install fluent operator?
Helm chart
Additional context
Example config (cut down for brevity):
apiVersion: fluentbit.fluent.io/v1alpha2
kind: FluentBit
spec:
rbacRules:
- apiGroups:
- ''
resources:
- events
verbs:
- watch
- list
---
apiVersion: fluentbit.fluent.io/v1alpha2
kind: ClusterInput
spec:
alias: system-events
kubernetesEvents:
db: /fluent-bit/tail/system-events-pos.db
kubeCAFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
kubeTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
kubeURL: https://kubernetes.default.svc:443
tag: kube-events
---
apiVersion: fluentbit.fluent.io/v1alpha2
kind: ClusterFilter
spec:
filters:
- nest:
addPrefix: involvedObject_
nestedUnder: involvedObject
operation: lift
match: kube-events
---
apiVersion: fluentbit.fluent.io/v1alpha2
kind: ClusterOutput
spec:
alias: tahi-logs-k8s
es:
bufferSize: 10M
generateID: true
host: ${elastic-log-endpoint}
httpPassword:
valueFrom:
secretKeyRef:
key: elastic-password
name: fluent-elastic-credentials
httpUser:
valueFrom:
secretKeyRef:
key: elastic-username
name: fluent-elastic-credentials
index: tahi-logs-k8s
port: 9200
matchRegex: (?:kube)\.(.*)|kube-events
Activity