Logfile Tailer Webhook - Image Repostiroy

[Eldaroth]

Hi,
I am trying to implement the webhook for tailing logfiles according to https://kube-logging.dev/docs/configuration/extensions/tailer-webhook/. On our Kubernetes Cluster we are not able to pull images from public repositories, instead we have to use our internal private repository.

Now with everything else in the logging operator this was configurable, i.e. in the Logging CRD. However, I can't find any documentation or whatsoever, if this is also possible for the webhook. Currently the operator deploys the sidecar, but it tries to pull the image from ghcr.io for the fluent-bit sidecar container. Is there an option or env variable which can be put to tell the operator, from where it should pull the sidecar image from?

I only found configuration options by env variables for the webhook port (see https://github.com/kube-logging/logging-operator/blob/master/main.go#L155), but nothing for setting a custom repository or image.

Thanks in advance for any support!

[pratikrath126]

Hey! I couldn’t find a Helm/CRD option for the tailer webhook sidecar image either. Looking at the code, the sidecar image comes from config.TailerWebhook.FluentBitImage (see pkg/webhook/podhandler/helpers.go) and the default is hardcoded in pkg/sdk/extensions/extensionsconfig/config.go:

TailerWebhook = TailerWebhookConfig{
FluentBitImage: "ghcr.io/fluent/fluent-bit:4.2.2",
...
}

I couldn’t spot any env var or flag wired to override that value (the env vars I see are for webhook port/certs). So right now it looks like there’s no supported knob to point the webhook sidecar to a private registry.

If you need this today, options would be:

• use a registry mirror for ghcr.io at the cluster level, or
• patch the operator (add an env var, e.g. TAILER_WEBHOOK_IMAGE, and wire it into extensionsconfig.TailerWebhook.FluentBitImage), then build your own image.

If I missed something, happy to be corrected — but I think it’s just not configurable yet.

[Eldaroth]

Hi @pratikrath126,
Thanks for taking a look into this!
Yeah after looking a bit deeper into the code yesterday I found the same snippets of code and concluded as well that the image is hardcoded.

With my limited coding skills I might be able to add a trigger via ENV variable similar to how the port is configured, might open a PR for this. Although I would much more prefer that the webhook honors the repository/image set in either the Logging or FluentbitAgent CRD to keep it consistent.

Thanks for suggesting some alternative options though, much appreciated! I might try out the mirror, because patching and building the operator myself entails some additional maintenance effort until the operator is fixed upstream. I might be able to do something with a Kyverno Mutating Webhook as well to replace the image when the container is deployed.