[stable/fluent-bit] Adding ES auth secret (#14849)

Signed-off-by: Endre Czirbesz <endre.czirbesz@rungway.com>

stable/fluent-bit/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
 name: fluent-bit
-version: 2.4.4
+version: 2.5.0
 appVersion: 1.2.2
 description: Fast and Lightweight Log/Data Forwarder for Linux, BSD and OSX
 keywords:

stable/fluent-bit/README.md

@@ -47,9 +47,13 @@ The following table lists the configurable parameters of the Fluent-Bit chart an
 | `backend.es.logstash_prefix`  | Index Prefix. If Logstash_Prefix is equals to 'mydata' your index will become 'mydata-YYYY.MM.DD'. | `kubernetes_cluster` |
 | `backend.es.replace_dots`     | Enable/Disable Replace_Dots option. | `On` |
 | `backend.es.http_user`        | Optional username credential for Elastic X-Pack access. | `` |
-| `backend.es.http_passwd:`     | Password for user defined in HTTP_User. | `` |
+| `backend.es.http_passwd`      | Password for user defined in HTTP_User. | `` |
+| `backend.es.http_passwd_secret`     | Secret name for password for user defined in HTTP_User. | `` |
+| `backend.es.http_passwd_secret_key` | Secret key for password for user defined in HTTP_User. | `` |
 | `backend.es.tls`              | Enable or disable TLS support | `off` |
 | `backend.es.tls_verify`       | Force certificate validation  | `on` |
+| `backend.es.tls_secret`        | Existing secret storing TLS CA certificate for the Elastic instance. Specify if tls: on. Overrides `backend.es.tls_ca` | `` |
+| `backend.es.tls_secret_ca_key` | Existing secret key storing TLS CA certificate for the Elastic instance. Specify if tls: on.                           | `` |
 | `backend.es.tls_ca`           | TLS CA certificate for the Elastic instance (in PEM format). Specify if tls: on. | `` |
 | `backend.es.tls_debug`        | Set TLS debug verbosity level. It accept the following values: 0-4 | `1` |
 | **HTTP Backend**              |

stable/fluent-bit/templates/config.yaml

@@ -111,7 +111,11 @@ data:
 {{- end }}
 {{- if .Values.backend.es.http_user }}
         HTTP_User {{ .Values.backend.es.http_user }}
+{{- if .Values.backend.es.http_passwd }}
         HTTP_Passwd {{ .Values.backend.es.http_passwd }}
+{{- else }}
+        HTTP_Passwd ${HTTP_PASSWORD}
+{{- end }}
 {{- end }}
 {{if eq .Values.backend.es.tls "on" }}
         tls {{ .Values.backend.es.tls }}

stable/fluent-bit/templates/daemonset.yaml

@@ -43,7 +43,17 @@ spec:
         image: "{{ .Values.image.fluent_bit.repository }}:{{ .Values.image.fluent_bit.tag }}"
         imagePullPolicy: "{{ .Values.image.pullPolicy }}"
         env:
+{{- if .Values.backend.es.http_passwd_secret }}
+          - name: HTTP_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: {{ .Values.backend.es.http_passwd_secret }}
+                key: {{ .Values.backend.es.http_passwd_secret_key }}
+{{- end }}
+{{- /* Only render empty array when no HTTP_PASSWORD */ -}}
+{{- if or .Values.env (not .Values.backend.es.http_passwd_secret) }}
 {{ toYaml .Values.env | indent 10 }}
+{{- end }}
         resources:
 {{ toYaml .Values.resources | indent 10 }}
 {{- if or .Values.metrics.enabled .Values.extraPorts }}
@@ -98,10 +108,10 @@ spec:
           subPath: parsers.conf
 {{- end }}
 {{- end }}
-{{- if .Values.backend.es.tls_ca }}
+{{- if or .Values.backend.es.tls_ca .Values.backend.es.tls_secret }}
         - name: es-tls-secret
           mountPath: /secure/es-tls-ca.crt
-          subPath: es-tls-ca.crt
+          subPath: {{ .Values.backend.es.tls_secret_ca_key | default "es-tls-ca.crt" | quote }}
 {{- end }}
 {{- if .Values.trackOffsets }}
         - name: tail-db
@@ -141,10 +151,10 @@ spec:
           path: /etc/machine-id
           type: File
     {{- end }}
-{{- if .Values.backend.es.tls_ca }}
+{{- if or .Values.backend.es.tls_ca .Values.backend.es.tls_secret }}
       - name: es-tls-secret
         secret:
-          secretName: "{{ template "fluent-bit.fullname" . }}-es-tls-secret"
+          secretName: {{ .Values.backend.es.tls_secret | default ( print ( include "fluent-bit.fullname" . ) "-es-tls-secret" ) | quote }}
 {{- end }}
 {{- if .Values.trackOffsets }}
       - name: tail-db

stable/fluent-bit/templates/secret.yaml

@@ -1,3 +1,4 @@
+{{- if not .Values.backend.es.tls_secret }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -10,3 +11,4 @@ metadata:
 type: Opaque
 data:
   es-tls-ca.crt: {{ .Values.backend.es.tls_ca | b64enc | quote }}
+{{- end }}