Skip to content

Commit 2554ff0

Browse files
wenchajunwenchajun
authored
Merge pull request #1603 from matelang/syslog-input-tls
adding support for Syslog over TLS
2 parents 9cae34b + 172f70f commit 2554ff0

File tree

7 files changed

+296
-1
lines changed

7 files changed

+296
-1
lines changed

‎apis/fluentbit/v1alpha2/plugins/input/syslog.go‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,13 +41,15 @@ type Syslog struct {
4141
ReceiveBufferSize string `json:"receiveBufferSize,omitempty"`
4242
// Specify the key where the source address will be injected.
4343
SourceAddressKey string `json:"sourceAddressKey,omitempty"`
44+
// Specify TLS connector options.
45+
*plugins.TLS `json:"tls,omitempty"`
4446
}
4547

4648
func (_ *Syslog) Name() string {
4749
return "syslog"
4850
}
4951

50-
func (s *Syslog) Params(_ plugins.SecretLoader) (*params.KVs, error) {
52+
func (s *Syslog) Params(sl plugins.SecretLoader) (*params.KVs, error) {
5153
kvs := params.NewKVs()
5254

5355
if s.Mode != "" {
@@ -80,6 +82,13 @@ func (s *Syslog) Params(_ plugins.SecretLoader) (*params.KVs, error) {
8082
if s.SourceAddressKey != "" {
8183
kvs.Insert("Source_Address_Key", s.SourceAddressKey)
8284
}
85+
if s.TLS != nil {
86+
tls, err := s.TLS.Params(sl)
87+
if err != nil {
88+
return nil, err
89+
}
90+
kvs.Merge(tls)
91+
}
8392

8493
return kvs, nil
8594
}

‎apis/fluentbit/v1alpha2/plugins/input/zz_generated.deepcopy.go‎

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎charts/fluent-operator/charts/fluent-bit-crds/crds/fluentbit.fluent.io_clusterinputs.yaml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -580,6 +580,76 @@ spec:
580580
description: Specify the key where the source address will be
581581
injected.
582582
type: string
583+
tls:
584+
description: Specify TLS connector options.
585+
properties:
586+
caFile:
587+
description: Absolute path to CA certificate file
588+
type: string
589+
caPath:
590+
description: Absolute path to scan for certificate files
591+
type: string
592+
crtFile:
593+
description: Absolute path to Certificate file
594+
type: string
595+
debug:
596+
description: |-
597+
Set TLS debug verbosity level.
598+
It accept the following values: 0 (No debug), 1 (Error), 2 (State change), 3 (Informational) and 4 Verbose
599+
enum:
600+
- 0
601+
- 1
602+
- 2
603+
- 3
604+
- 4
605+
format: int32
606+
type: integer
607+
keyFile:
608+
description: Absolute path to private Key file
609+
type: string
610+
keyPassword:
611+
description: Optional password for tls.key_file file
612+
properties:
613+
valueFrom:
614+
description: ValueSource defines how to find a value's
615+
key.
616+
properties:
617+
secretKeyRef:
618+
description: Selects a key of a secret in the pod's
619+
namespace
620+
properties:
621+
key:
622+
description: The key of the secret to select from. Must
623+
be a valid secret key.
624+
type: string
625+
name:
626+
default: ""
627+
description: |-
628+
Name of the referent.
629+
This field is effectively required, but due to backwards compatibility is
630+
allowed to be empty. Instances of this type with an empty value here are
631+
almost certainly wrong.
632+
TODO: Add other useful fields. apiVersion, kind, uid?
633+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
634+
TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
635+
type: string
636+
optional:
637+
description: Specify whether the Secret or its
638+
key must be defined
639+
type: boolean
640+
required:
641+
- key
642+
type: object
643+
x-kubernetes-map-type: atomic
644+
type: object
645+
type: object
646+
verify:
647+
description: Force certificate validation
648+
type: boolean
649+
vhost:
650+
description: Hostname to be used for TLS SNI extension
651+
type: string
652+
type: object
583653
unixPerm:
584654
description: 'If Mode is set to unix_tcp or unix_udp, set the
585655
permission of the Unix socket file, default: 0644'

‎config/crd/bases/fluentbit.fluent.io_clusterinputs.yaml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -580,6 +580,76 @@ spec:
580580
description: Specify the key where the source address will be
581581
injected.
582582
type: string
583+
tls:
584+
description: Specify TLS connector options.
585+
properties:
586+
caFile:
587+
description: Absolute path to CA certificate file
588+
type: string
589+
caPath:
590+
description: Absolute path to scan for certificate files
591+
type: string
592+
crtFile:
593+
description: Absolute path to Certificate file
594+
type: string
595+
debug:
596+
description: |-
597+
Set TLS debug verbosity level.
598+
It accept the following values: 0 (No debug), 1 (Error), 2 (State change), 3 (Informational) and 4 Verbose
599+
enum:
600+
- 0
601+
- 1
602+
- 2
603+
- 3
604+
- 4
605+
format: int32
606+
type: integer
607+
keyFile:
608+
description: Absolute path to private Key file
609+
type: string
610+
keyPassword:
611+
description: Optional password for tls.key_file file
612+
properties:
613+
valueFrom:
614+
description: ValueSource defines how to find a value's
615+
key.
616+
properties:
617+
secretKeyRef:
618+
description: Selects a key of a secret in the pod's
619+
namespace
620+
properties:
621+
key:
622+
description: The key of the secret to select from. Must
623+
be a valid secret key.
624+
type: string
625+
name:
626+
default: ""
627+
description: |-
628+
Name of the referent.
629+
This field is effectively required, but due to backwards compatibility is
630+
allowed to be empty. Instances of this type with an empty value here are
631+
almost certainly wrong.
632+
TODO: Add other useful fields. apiVersion, kind, uid?
633+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
634+
TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
635+
type: string
636+
optional:
637+
description: Specify whether the Secret or its
638+
key must be defined
639+
type: boolean
640+
required:
641+
- key
642+
type: object
643+
x-kubernetes-map-type: atomic
644+
type: object
645+
type: object
646+
verify:
647+
description: Force certificate validation
648+
type: boolean
649+
vhost:
650+
description: Hostname to be used for TLS SNI extension
651+
type: string
652+
type: object
583653
unixPerm:
584654
description: 'If Mode is set to unix_tcp or unix_udp, set the
585655
permission of the Unix socket file, default: 0644'

‎docs/plugins/fluentbit/input/syslog.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,4 @@ Syslog input plugins allows to collect Syslog messages through a Unix socket ser
1515
| bufferMaxSize | Specify the maximum buffer size to receive a Syslog message. If not set, the default size will be the value of Buffer_Chunk_Size. | string |
1616
| receiveBufferSize | Specify the maximum socket receive buffer size. If not set, the default value is OS-dependant, but generally too low to accept thousands of syslog messages per second without loss on udp or unix_udp sockets. Note that on Linux the value is capped by sysctl net.core.rmem_max. | string |
1717
| sourceAddressKey | Specify the key where the source address will be injected. | string |
18+
| tls | Specify TLS connector options. | *[plugins.TLS](../tls.md) |

‎manifests/setup/fluent-operator-crd.yaml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2709,6 +2709,76 @@ spec:
27092709
description: Specify the key where the source address will be
27102710
injected.
27112711
type: string
2712+
tls:
2713+
description: Specify TLS connector options.
2714+
properties:
2715+
caFile:
2716+
description: Absolute path to CA certificate file
2717+
type: string
2718+
caPath:
2719+
description: Absolute path to scan for certificate files
2720+
type: string
2721+
crtFile:
2722+
description: Absolute path to Certificate file
2723+
type: string
2724+
debug:
2725+
description: |-
2726+
Set TLS debug verbosity level.
2727+
It accept the following values: 0 (No debug), 1 (Error), 2 (State change), 3 (Informational) and 4 Verbose
2728+
enum:
2729+
- 0
2730+
- 1
2731+
- 2
2732+
- 3
2733+
- 4
2734+
format: int32
2735+
type: integer
2736+
keyFile:
2737+
description: Absolute path to private Key file
2738+
type: string
2739+
keyPassword:
2740+
description: Optional password for tls.key_file file
2741+
properties:
2742+
valueFrom:
2743+
description: ValueSource defines how to find a value's
2744+
key.
2745+
properties:
2746+
secretKeyRef:
2747+
description: Selects a key of a secret in the pod's
2748+
namespace
2749+
properties:
2750+
key:
2751+
description: The key of the secret to select from. Must
2752+
be a valid secret key.
2753+
type: string
2754+
name:
2755+
default: ""
2756+
description: |-
2757+
Name of the referent.
2758+
This field is effectively required, but due to backwards compatibility is
2759+
allowed to be empty. Instances of this type with an empty value here are
2760+
almost certainly wrong.
2761+
TODO: Add other useful fields. apiVersion, kind, uid?
2762+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
2763+
TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
2764+
type: string
2765+
optional:
2766+
description: Specify whether the Secret or its
2767+
key must be defined
2768+
type: boolean
2769+
required:
2770+
- key
2771+
type: object
2772+
x-kubernetes-map-type: atomic
2773+
type: object
2774+
type: object
2775+
verify:
2776+
description: Force certificate validation
2777+
type: boolean
2778+
vhost:
2779+
description: Hostname to be used for TLS SNI extension
2780+
type: string
2781+
type: object
27122782
unixPerm:
27132783
description: 'If Mode is set to unix_tcp or unix_udp, set the
27142784
permission of the Unix socket file, default: 0644'

‎manifests/setup/setup.yaml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2709,6 +2709,76 @@ spec:
27092709
description: Specify the key where the source address will be
27102710
injected.
27112711
type: string
2712+
tls:
2713+
description: Specify TLS connector options.
2714+
properties:
2715+
caFile:
2716+
description: Absolute path to CA certificate file
2717+
type: string
2718+
caPath:
2719+
description: Absolute path to scan for certificate files
2720+
type: string
2721+
crtFile:
2722+
description: Absolute path to Certificate file
2723+
type: string
2724+
debug:
2725+
description: |-
2726+
Set TLS debug verbosity level.
2727+
It accept the following values: 0 (No debug), 1 (Error), 2 (State change), 3 (Informational) and 4 Verbose
2728+
enum:
2729+
- 0
2730+
- 1
2731+
- 2
2732+
- 3
2733+
- 4
2734+
format: int32
2735+
type: integer
2736+
keyFile:
2737+
description: Absolute path to private Key file
2738+
type: string
2739+
keyPassword:
2740+
description: Optional password for tls.key_file file
2741+
properties:
2742+
valueFrom:
2743+
description: ValueSource defines how to find a value's
2744+
key.
2745+
properties:
2746+
secretKeyRef:
2747+
description: Selects a key of a secret in the pod's
2748+
namespace
2749+
properties:
2750+
key:
2751+
description: The key of the secret to select from. Must
2752+
be a valid secret key.
2753+
type: string
2754+
name:
2755+
default: ""
2756+
description: |-
2757+
Name of the referent.
2758+
This field is effectively required, but due to backwards compatibility is
2759+
allowed to be empty. Instances of this type with an empty value here are
2760+
almost certainly wrong.
2761+
TODO: Add other useful fields. apiVersion, kind, uid?
2762+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
2763+
TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
2764+
type: string
2765+
optional:
2766+
description: Specify whether the Secret or its
2767+
key must be defined
2768+
type: boolean
2769+
required:
2770+
- key
2771+
type: object
2772+
x-kubernetes-map-type: atomic
2773+
type: object
2774+
type: object
2775+
verify:
2776+
description: Force certificate validation
2777+
type: boolean
2778+
vhost:
2779+
description: Hostname to be used for TLS SNI extension
2780+
type: string
2781+
type: object
27122782
unixPerm:
27132783
description: 'If Mode is set to unix_tcp or unix_udp, set the
27142784
permission of the Unix socket file, default: 0644'

0 commit comments

Comments
 (0)