diff --git a/stable/fluent-bit/Chart.yaml b/stable/fluent-bit/Chart.yaml index 157757752f..9b344d6cbd 100755 --- a/stable/fluent-bit/Chart.yaml +++ b/stable/fluent-bit/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: fluent-bit -version: 2.8.3 +version: 2.8.4 appVersion: 1.3.2 description: Fast and Lightweight Log/Data Forwarder for Linux, BSD and OSX keywords: diff --git a/stable/fluent-bit/README.md b/stable/fluent-bit/README.md index 9941497944..4abd7d1cd0 100644 --- a/stable/fluent-bit/README.md +++ b/stable/fluent-bit/README.md @@ -88,7 +88,15 @@ The following table lists the configurable parameters of the Fluent-Bit chart an | `parsers.json` | List of json parsers | `NULL` | | `parsers.logfmt` | List of logfmt parsers | `NULL` | | **General** | -| `annotations` | Optional deamonset set annotations | `NULL` | +| `annotations` | Optional deamonset set annotations | `NULL` | +| `audit.enable` | Enable collection of audit logs | `false` | +| `audit.input.memBufLimit` | Specify Mem_Buf_Limit in tail input | `35mb` | +| `audit.input.parser` | Specify Parser in tail input | `docker` | +| `audit.input.path` | Specify log file(s) through the use of common wildcards | `/var/log/kube-apiserver-audit.log` | +| `audit.input.bufferChunkSize` | Specify Buffer_Chunk_Size in tail | `2MB` | +| `audit.input.bufferMaxSize` | Specify Buffer_Max_Size in tail | `10MB` | +| `audit.input.skipLongLines` | Specify Skip_Long_Lines in tail | `On` | +| `audit.input.key` | Specify Key in tail | `kubernetes-audit` | | `podAnnotations` | Optional pod annotations | `NULL` | | `podLabels` | Optional pod labels | `NULL` | | `fullConfigMap` | User has provided entire config (parsers + system) | `false` | diff --git a/stable/fluent-bit/templates/config.yaml b/stable/fluent-bit/templates/config.yaml index 47f8df2147..cf28dff047 100644 --- a/stable/fluent-bit/templates/config.yaml +++ b/stable/fluent-bit/templates/config.yaml @@ -53,6 +53,22 @@ data: {{- end }} {{ .Values.extraEntries.input | indent 8 }} +{{- if .Values.audit.enable }} + [INPUT] + Name tail + Path {{ .Values.audit.input.path }} + Parser {{ .Values.audit.input.parser }} + DB /var/log/audit.db + Tag audit.* + Refresh_Interval 5 + Mem_Buf_Limit {{ .Values.audit.input.memBufLimit }} + Buffer_Chunk_Size {{ .Values.audit.input.bufferChunkSize }} + Buffer_Max_Size {{ .Values.audit.input.bufferMaxSize }} + Skip_Long_Lines {{ .Values.audit.input.skipLongLines}} + Key {{ .Values.audit.input.key}} +{{ .Values.extraEntries.audit | indent 8 }} +{{- end }} + fluent-bit-filter.conf: | [FILTER] Name kubernetes diff --git a/stable/fluent-bit/values.yaml b/stable/fluent-bit/values.yaml index 79ecf88fb5..ea0f854d30 100644 --- a/stable/fluent-bit/values.yaml +++ b/stable/fluent-bit/values.yaml @@ -162,6 +162,8 @@ rawConfig: |- # extraEntries: input: |- +# # >=1 additional Key/Value entrie(s) for existing Input section + audit: |- # # >=1 additional Key/Value entrie(s) for existing Input section filter: |- # # >=1 additional Key/Value entrie(s) for existing Filter section @@ -236,6 +238,17 @@ input: stripUnderscores: false tag: host.* +audit: + enable: false + input: + memBufLimit: 35MB + parser: docker + path: /var/log/kube-apiserver-audit.log + bufferChunkSize: 2MB + bufferMaxSize: 10MB + skipLongLines: On + key: kubernetes-audit + filter: kubeURL: https://kubernetes.default.svc:443 kubeCAFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt