You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Fluent Bit provides integrated support for _Transport Layer Security_\(TLS\) and it predecessor _Secure Sockets Layer_\(SSL\) respectively. In this section we will refer as TLS only for both implementations.
4
+
Fluent Bit provides integrated support for Transport Layer Security (TLS) and
5
+
it predecessors Secure Sockets Layer (SSL) respectively. This section refers only
6
+
to TLS for both implementations.
5
7
6
-
Both input and output plugins that perform Network I/O can optionally enable TLS and configure the behavior. The following table describes the properties available:
8
+
Both input and output plugins that perform Network I/O can optionally enable TLS and
9
+
configure the behavior. The following table describes the properties available:
7
10
8
11
| Property | Description | Default |
9
12
| :--- | :--- | :--- |
10
-
| tls | enable or disable TLS support | Off |
11
-
| tls.verify | force certificate validation | On |
12
-
| tls.verify\_hostname | force TLS verification of hostnames | Off |
13
-
| tls.debug | Set TLS debug verbosity level. It accept the following values: 0 \(No debug\), 1 \(Error\), 2 \(State change\), 3 \(Informational\) and 4 Verbose | 1 |
14
-
| tls.ca\_file | absolute path to CA certificate file ||
15
-
| tls.ca\_path | absolute path to scan for certificate files ||
16
-
| tls.crt\_file | absolute path to Certificate file ||
17
-
| tls.key\_file | absolute path to private Key file ||
18
-
| tls.key\_passwd | optional password for tls.key\_file file ||
19
-
| tls.vhost | hostname to be used for TLS SNI extension ||
20
-
21
-
*Note : in order to use TLS on input plugins the user is expected to provide both a certificate and private key*
22
-
23
-
The listed properties can be enabled in the configuration file, specifically on each output plugin section or directly through the command line.
13
+
|`tls`| Enable or disable TLS support |`Off`|
14
+
|`tls.verify`| Force certificate validation |`On`|
15
+
|`tls.verify_hostname`| Force TLS verification of host names |`Off`|
16
+
|`tls.debug`| Set TLS debug verbosity level. Accepted values: `0` (No debug), `1` (Error), `2` (State change), `3` (Informational) and `4` (Verbose) |`1`|
17
+
|`tls.ca_file`| Absolute path to CA certificate file |_none_|
18
+
|`tls.ca_path`| Absolute path to scan for certificate files |_none_|
19
+
|`tls.crt_file`| Absolute path to Certificate file |_none_|
20
+
|`tls.key_file`| Absolute path to private Key file |_none_|
21
+
|`tls.key_passwd`| Optional password for `tls.key_file` file |_none_|
22
+
|`tls.vhost`| Hostname to be used for TLS SNI extension |_none_|
23
+
24
+
To use TLS on input plugins, the user is expected to provide both a certificate and
25
+
private key.
26
+
27
+
The listed properties can be enabled in the configuration file, specifically in each
28
+
output plugin section or directly through the command line.
24
29
25
30
The following **output** plugins can take advantage of the TLS feature:
By default HTTP input plugin uses plain TCP, enabling TLS from the command line can be done with:
81
86
82
-
```text
87
+
By default HTTP input plugin uses plain TCP, enabling TLS from the command line can
88
+
be done using the following command:
89
+
90
+
```bash
83
91
./bin/fluent-bit -i http \
84
92
-p port=9999 \
85
93
-p tls=on \
@@ -90,11 +98,13 @@ By default HTTP input plugin uses plain TCP, enabling TLS from the command line
90
98
-m '*'
91
99
```
92
100
93
-
In the command line above, the two properties _tls_ and _tls.verify_ where enabled for demonstration purposes \(we strongly suggest always keep verification ON\).
101
+
In the previous command, the two properties `tls` and `tls.verify` are set
102
+
for demonstration purposes. It's strongly suggested to always keep verification
103
+
on.
94
104
95
105
The same behavior can be accomplished using a configuration file:
96
106
97
-
```text
107
+
```python
98
108
[INPUT]
99
109
name http
100
110
port 9999
@@ -110,20 +120,22 @@ The same behavior can be accomplished using a configuration file:
110
120
111
121
## Example: enable TLS on HTTP output
112
122
113
-
By default HTTP output plugin uses plain TCP, enabling TLS from the command line can be done with:
123
+
By default HTTP output plugin uses plain TCP, enabling TLS from the command line can
124
+
be done with:
114
125
115
-
```text
116
-
$ fluent-bit -i cpu -t cpu -o http://192.168.2.3:80/something \
126
+
```bash
127
+
fluent-bit -i cpu -t cpu -o http://192.168.2.3:80/something \
117
128
-p tls=on \
118
129
-p tls.verify=off \
119
130
-m '*'
120
131
```
121
132
122
-
In the command line above, the two properties _tls_ and _tls.verify_ where enabled for demonstration purposes \(we strongly suggest always keep verification ON\).
133
+
In the previous command, the properties `tls` and `tls.verify` are enabled
134
+
for demonstration purposes. Verification should always be on.
123
135
124
136
The same behavior can be accomplished using a configuration file:
125
137
126
-
```text
138
+
```python
127
139
[INPUT]
128
140
Name cpu
129
141
Tag cpu
@@ -140,11 +152,14 @@ The same behavior can be accomplished using a configuration file:
140
152
141
153
## Tips and Tricks
142
154
143
-
### Generate your own self signed certificates for testing purposes.
155
+
### Generate a self signed certificates for testing purposes
144
156
145
-
This will generate a 4096 bit RSA key pair and a certificate that is signed using SHA-256 with the expiration date set to 30 days in the future, `test.host.net` set as common name and since we opted out of `DES` the private key will be stored in plain text.
157
+
This will generate a 4096 bit RSA key pair and a certificate that's signed using
158
+
`SHA-256` with the expiration date set to 30 days in the future. In this example,
159
+
`test.host.net` set as common name. This example opts out of `DES`, so the private
160
+
key will be stored in plain text.
146
161
147
-
```
162
+
```bash
148
163
openssl req -x509 \
149
164
-newkey rsa:4096 \
150
165
-sha256 \
@@ -156,9 +171,12 @@ openssl req -x509 \
156
171
157
172
### Connect to virtual servers using TLS
158
173
159
-
Fluent Bit supports [TLS server name indication](https://en.wikipedia.org/wiki/Server_Name_Indication). If you are serving multiple hostnames on a single IP address \(a.k.a. virtual hosting\), you can make use of `tls.vhost` to connect to a specific hostname.
174
+
Fluent Bit supports
175
+
[TLS server name indication](https://en.wikipedia.org/wiki/Server_Name_Indication).
176
+
If you are serving multiple host names on a single IP address (for example, using
177
+
virtual hosting), you can make use of `tls.vhost` to connect to a specific hostname.
160
178
161
-
```text
179
+
```python
162
180
[INPUT]
163
181
Name cpu
164
182
Tag cpu
@@ -174,22 +192,23 @@ Fluent Bit supports [TLS server name indication](https://en.wikipedia.org/wiki/S
174
192
tls.vhost fluent.example.com
175
193
```
176
194
177
-
### Verify subjectAltName
195
+
### Verify `subjectAltName`
178
196
179
-
By default, TLS verification of hostnames is not done automatically.
180
-
As an example, we can extract the X509v3 Subject Alternative Name from a certificate:
197
+
By default, TLS verification of host names isn't done automatically.
198
+
As an example, you can extract the X509v3 Subject Alternative Name from a certificate:
181
199
182
-
```
200
+
```text
183
201
X509v3 Subject Alternative Name:
184
202
DNS:my.fluent-aggregator.net
185
203
```
186
204
187
-
As you can see, this certificate covers only `my.fluent-aggregator.net` so if we use a different hostname it should fail.
188
-
189
-
To fully verify the alternative name and demonstrate the failure we enable `tls.verify_hostname`:
205
+
This certificate covers only `my.fluent-aggregator.net` so if you use a different
206
+
hostname it should fail.
190
207
208
+
To fully verify the alternative name and demonstrate the failure, enable
209
+
`tls.verify_hostname`:
191
210
192
-
```text
211
+
```python
193
212
[INPUT]
194
213
Name cpu
195
214
Tag cpu
@@ -205,9 +224,9 @@ To fully verify the alternative name and demonstrate the failure we enable `tls.
205
224
tls.ca_file /path/to/fluent-x509v3-alt-name.crt
206
225
```
207
226
208
-
This outgoing connect will be failed and disconnected:
0 commit comments