From 728a368f7d6609cdf573b47c2d006e480b9ca534 Mon Sep 17 00:00:00 2001 From: Endre Czirbesz Date: Tue, 13 Aug 2019 08:36:00 +0100 Subject: [PATCH] [stable/fluent-bit] Adding ES auth secret (#14849) Signed-off-by: Endre Czirbesz --- stable/fluent-bit/Chart.yaml | 2 +- stable/fluent-bit/README.md | 6 +++++- stable/fluent-bit/templates/config.yaml | 4 ++++ stable/fluent-bit/templates/daemonset.yaml | 18 ++++++++++++++---- stable/fluent-bit/templates/secret.yaml | 2 ++ 5 files changed, 26 insertions(+), 6 deletions(-) diff --git a/stable/fluent-bit/Chart.yaml b/stable/fluent-bit/Chart.yaml index 9fbd091856..a7c12b2ce8 100755 --- a/stable/fluent-bit/Chart.yaml +++ b/stable/fluent-bit/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: fluent-bit -version: 2.4.4 +version: 2.5.0 appVersion: 1.2.2 description: Fast and Lightweight Log/Data Forwarder for Linux, BSD and OSX keywords: diff --git a/stable/fluent-bit/README.md b/stable/fluent-bit/README.md index d057a716f7..bd893e2a2e 100644 --- a/stable/fluent-bit/README.md +++ b/stable/fluent-bit/README.md @@ -47,9 +47,13 @@ The following table lists the configurable parameters of the Fluent-Bit chart an | `backend.es.logstash_prefix` | Index Prefix. If Logstash_Prefix is equals to 'mydata' your index will become 'mydata-YYYY.MM.DD'. | `kubernetes_cluster` | | `backend.es.replace_dots` | Enable/Disable Replace_Dots option. | `On` | | `backend.es.http_user` | Optional username credential for Elastic X-Pack access. | `` | -| `backend.es.http_passwd:` | Password for user defined in HTTP_User. | `` | +| `backend.es.http_passwd` | Password for user defined in HTTP_User. | `` | +| `backend.es.http_passwd_secret` | Secret name for password for user defined in HTTP_User. | `` | +| `backend.es.http_passwd_secret_key` | Secret key for password for user defined in HTTP_User. | `` | | `backend.es.tls` | Enable or disable TLS support | `off` | | `backend.es.tls_verify` | Force certificate validation | `on` | +| `backend.es.tls_secret` | Existing secret storing TLS CA certificate for the Elastic instance. Specify if tls: on. Overrides `backend.es.tls_ca` | `` | +| `backend.es.tls_secret_ca_key` | Existing secret key storing TLS CA certificate for the Elastic instance. Specify if tls: on. | `` | | `backend.es.tls_ca` | TLS CA certificate for the Elastic instance (in PEM format). Specify if tls: on. | `` | | `backend.es.tls_debug` | Set TLS debug verbosity level. It accept the following values: 0-4 | `1` | | **HTTP Backend** | diff --git a/stable/fluent-bit/templates/config.yaml b/stable/fluent-bit/templates/config.yaml index 518fd46d07..69b46f32dd 100644 --- a/stable/fluent-bit/templates/config.yaml +++ b/stable/fluent-bit/templates/config.yaml @@ -111,7 +111,11 @@ data: {{- end }} {{- if .Values.backend.es.http_user }} HTTP_User {{ .Values.backend.es.http_user }} +{{- if .Values.backend.es.http_passwd }} HTTP_Passwd {{ .Values.backend.es.http_passwd }} +{{- else }} + HTTP_Passwd ${HTTP_PASSWORD} +{{- end }} {{- end }} {{if eq .Values.backend.es.tls "on" }} tls {{ .Values.backend.es.tls }} diff --git a/stable/fluent-bit/templates/daemonset.yaml b/stable/fluent-bit/templates/daemonset.yaml index 7d8e543318..773c511de0 100644 --- a/stable/fluent-bit/templates/daemonset.yaml +++ b/stable/fluent-bit/templates/daemonset.yaml @@ -43,7 +43,17 @@ spec: image: "{{ .Values.image.fluent_bit.repository }}:{{ .Values.image.fluent_bit.tag }}" imagePullPolicy: "{{ .Values.image.pullPolicy }}" env: +{{- if .Values.backend.es.http_passwd_secret }} + - name: HTTP_PASSWORD + valueFrom: + secretKeyRef: + name: {{ .Values.backend.es.http_passwd_secret }} + key: {{ .Values.backend.es.http_passwd_secret_key }} +{{- end }} +{{- /* Only render empty array when no HTTP_PASSWORD */ -}} +{{- if or .Values.env (not .Values.backend.es.http_passwd_secret) }} {{ toYaml .Values.env | indent 10 }} +{{- end }} resources: {{ toYaml .Values.resources | indent 10 }} {{- if or .Values.metrics.enabled .Values.extraPorts }} @@ -98,10 +108,10 @@ spec: subPath: parsers.conf {{- end }} {{- end }} -{{- if .Values.backend.es.tls_ca }} +{{- if or .Values.backend.es.tls_ca .Values.backend.es.tls_secret }} - name: es-tls-secret mountPath: /secure/es-tls-ca.crt - subPath: es-tls-ca.crt + subPath: {{ .Values.backend.es.tls_secret_ca_key | default "es-tls-ca.crt" | quote }} {{- end }} {{- if .Values.trackOffsets }} - name: tail-db @@ -141,10 +151,10 @@ spec: path: /etc/machine-id type: File {{- end }} -{{- if .Values.backend.es.tls_ca }} +{{- if or .Values.backend.es.tls_ca .Values.backend.es.tls_secret }} - name: es-tls-secret secret: - secretName: "{{ template "fluent-bit.fullname" . }}-es-tls-secret" + secretName: {{ .Values.backend.es.tls_secret | default ( print ( include "fluent-bit.fullname" . ) "-es-tls-secret" ) | quote }} {{- end }} {{- if .Values.trackOffsets }} - name: tail-db diff --git a/stable/fluent-bit/templates/secret.yaml b/stable/fluent-bit/templates/secret.yaml index 999c2dac81..d08aebf8af 100644 --- a/stable/fluent-bit/templates/secret.yaml +++ b/stable/fluent-bit/templates/secret.yaml @@ -1,3 +1,4 @@ +{{- if not .Values.backend.es.tls_secret }} apiVersion: v1 kind: Secret metadata: @@ -10,3 +11,4 @@ metadata: type: Opaque data: es-tls-ca.crt: {{ .Values.backend.es.tls_ca | b64enc | quote }} +{{- end }}