Merge branch 'improvement/MK8S-188-make-fluent-bit-configurable' into q/133.0

bert-e · bert-e · commit 714a581ccb21 · 2026-03-20T10:09:48.000Z
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -26,9 +26,9 @@
 - Support etcd distroless images for Kubernetes 1.33+. Above etcd 3.5.21, etcd images are now distroless and upstreamed to the etcd project.
   (PR[#4740](https://github.com/scality/metalk8s/pull/4740))
 
-- Bump Fluent Bit image version to [4.2.2](https://github.com/fluent/fluent-bit/releases/tag/v4.2.2)
-  and Fluent Bit Helm chart version to [0.55.0](https://github.com/fluent/helm-charts/releases/tag/fluent-bit-0.55.0)
-  (PR[#4778](https://github.com/scality/metalk8s/pull/4778))
+- Bump Fluent Bit image version to [4.2.3](https://github.com/fluent/fluent-bit/releases/tag/v4.2.3)
+  and Fluent Bit Helm chart version to [0.56.0](https://github.com/fluent/helm-charts/releases/tag/fluent-bit-0.56.0)
+  (PR[#4812](https://github.com/scality/metalk8s/pull/4812))
 
 - Bump dex chart version to
   [0.24.0](https://github.com/dexidp/helm-charts/releases/tag/dex-0.24.0)
@@ -57,6 +57,9 @@
   and ingress-nginx controller to [v1.15.0](https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.15.0)
   (PR[#4824](https://github.com/scality/metalk8s/pull/4824))
 
+- Implement ability to add certificates to fluent-bit by mounting a fluent-bit-certs secret
+  (PR[#4812](https://github.com/scality/metalk8s/pull/4812))
+
 ### Bug Fixes
 
 - Fix a bug where part of the upgrade process would silently be skipped
diff --git a/buildchain/buildchain/salt_tree.py b/buildchain/buildchain/salt_tree.py
@@ -350,6 +350,7 @@ def _download_ui_operator_crds() -> str:
     Path("salt/metalk8s/addons/logging/fluent-bit/deployed/configmap.sls"),
     Path("salt/metalk8s/addons/logging/fluent-bit/deployed/init.sls"),
     Path("salt/metalk8s/addons/logging/fluent-bit/deployed/service-configuration.sls"),
+    Path("salt/metalk8s/addons/logging/fluent-bit/deployed/secret.sls"),
     Path("salt/metalk8s/addons/logging/loki/config/loki.yaml"),
     Path("salt/metalk8s/addons/logging/loki/deployed/files/logs.json"),
     Path("salt/metalk8s/addons/logging/loki/deployed/files/loki.json"),
diff --git a/buildchain/buildchain/versions.py b/buildchain/buildchain/versions.py
@@ -285,8 +285,8 @@ def _version_prefix(version: str, prefix: str = "v") -> str:
     ),
     Image(
         name="fluent-bit",
-        version="4.2.2",
-        digest="sha256:7d727245767ae632eb296c2ff4d206bf2e205b5f244c1f37b8fdd61f9fb33985",
+        version="4.2.3",
+        digest="sha256:a5761fa961cb22dd0875883a4d446b1acd99d4935d77358aa9f50ee177e44fe2",
     ),
     Image(
         name="cert-manager-controller",
diff --git a/charts/fluent-bit.yaml b/charts/fluent-bit.yaml
@@ -38,6 +38,10 @@ daemonSetVolumes:
 - name: runlog
   hostPath:
     path: /run/log
+# stores all needed certificates for TLS outputs
+- name: certificates
+  secret:
+    secretName: fluent-bit-certs
 
 daemonSetVolumeMounts:
 - name: run
@@ -48,6 +52,9 @@ daemonSetVolumeMounts:
 - name: runlog
   mountPath: /run/log
   readOnly: true
+- name: certificates
+  mountPath: /fluent-bit/etc/tls
+  readOnly: true
 
 serviceMonitor:
   enabled: true
@@ -57,3 +64,9 @@ serviceMonitor:
 dashboards:
   enabled: true
   deterministicUid: true
+
+env:
+  - name: NODE_NAME
+    valueFrom:
+      fieldRef:
+        fieldPath: spec.nodeName
diff --git a/charts/fluent-bit/CHANGELOG.md b/charts/fluent-bit/CHANGELOG.md
@@ -14,6 +14,18 @@
 
 ## [UNRELEASED]
 
+## [v0.56.0] - 2026-02-27
+
+### Added
+
+- VPA recommender may be specified with `.autoscaling.vpa.recommender`
+
+## [v0.55.1] - 2026-02-27
+
+### Changed
+
+- Update _Fluent Bit_ OCI image to [v4.2.3](https://github.com/fluent/fluent-bit/releases/tag/v4.2.3). ([#697](https://github.com/fluent/helm-charts/pull/697)) _@stevehipwell_
+
 ## [v0.55.0] - 2026-01-22
 
 ### Changed
@@ -35,7 +47,10 @@
 <!--
 RELEASE LINKS
 -->
+
 [UNRELEASED]: https://github.com/fluent/helm-charts/tree/main/charts/fluent-bit
+[v0.56.0]: https://github.com/fluent/helm-charts/releases/tag/fluent-bit-0.56.0
+[v0.55.1]: https://github.com/fluent/helm-charts/releases/tag/fluent-bit-0.55.1
 [v0.55.0]: https://github.com/fluent/helm-charts/releases/tag/fluent-bit-0.55.0
 [v0.54.1]: https://github.com/fluent/helm-charts/releases/tag/fluent-bit-0.54.1
 [v0.54.0]: https://github.com/fluent/helm-charts/releases/tag/fluent-bit-0.54.0
diff --git a/charts/fluent-bit/Chart.yaml b/charts/fluent-bit/Chart.yaml
@@ -1,9 +1,9 @@
 annotations:
   artifacthub.io/changes: |-
-    - kind: changed
-      description: "Update Fluent Bit OCI image to 4.2.2."
+    - kind: added
+      description: "VPA recommender may be specified with .autoscaling.vpa."
 apiVersion: v1
-appVersion: 4.2.2
+appVersion: 4.2.3
 description: Fast and lightweight log processor and forwarder for Linux, OSX and BSD
   family operating systems.
 home: https://fluentbit.io/
@@ -24,4 +24,4 @@ maintainers:
 name: fluent-bit
 sources:
 - https://github.com/fluent/fluent-bit/
-version: 0.55.0
+version: 0.56.0
diff --git a/charts/fluent-bit/README.md b/charts/fluent-bit/README.md
@@ -1,6 +1,6 @@
 # fluent-bit
 
-![Version: 0.55.0](https://img.shields.io/badge/Version-0.55.0-informational?style=flat-square) ![AppVersion: 4.2.2](https://img.shields.io/badge/AppVersion-4.2.2-informational?style=flat-square)
+![Version: 0.56.0](https://img.shields.io/badge/Version-0.56.0-informational?style=flat-square) ![AppVersion: 4.2.3](https://img.shields.io/badge/AppVersion-4.2.3-informational?style=flat-square)
 
 Fast and lightweight log processor and forwarder for Linux, OSX and BSD family operating systems.
 
@@ -26,15 +26,15 @@ Fast and lightweight log processor and forwarder for Linux, OSX and BSD family o
 To install the chart using the recommended OCI method you can use the following command.
 
 ```shell
-helm upgrade --install fluent-bit oci://ghcr.io/fluent/helm-charts/fluent-bit --version 0.55.0
+helm upgrade --install fluent-bit oci://ghcr.io/fluent/helm-charts/fluent-bit --version 0.56.0
 ```
 
 #### Verification
 
 As the OCI chart release is signed by [Cosign](https://github.com/sigstore/cosign) you can verify the chart before installing it by running the following command.
 
 ```shell
-cosign verify --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity-regexp 'https://github\.com/action-stars/helm-workflows/\.github/workflows/release\.yaml@.+' --certificate-github-workflow-repository fluent/helm-charts --certificate-github-workflow-name Release ghcr.io/fluent/helm-charts/fluent-bit:0.55.0
+cosign verify --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity-regexp 'https://github\.com/action-stars/helm-workflows/\.github/workflows/release\.yaml@.+' --certificate-github-workflow-repository fluent/helm-charts --certificate-github-workflow-name Release ghcr.io/fluent/helm-charts/fluent-bit:0.56.0
 ```
 
 ### Non-OCI Repository
@@ -43,7 +43,7 @@ Alternatively you can use the legacy non-OCI method via the following commands.
 
 ```shell
 helm repo add fluent https://fluent.github.io/helm-charts/
-helm upgrade --install fluent-bit fluent/fluent-bit --version 0.55.0
+helm upgrade --install fluent-bit fluent/fluent-bit --version 0.56.0
 ```
 
 ## Values
@@ -66,6 +66,7 @@ helm upgrade --install fluent-bit fluent/fluent-bit --version 0.55.0
 | autoscaling.vpa.enabled | bool | `false` |  |
 | autoscaling.vpa.maxAllowed | object | `{}` |  |
 | autoscaling.vpa.minAllowed | object | `{}` |  |
+| autoscaling.vpa.recommender | string | `"default"` |  |
 | autoscaling.vpa.updatePolicy.updateMode | string | `"Auto"` |  |
 | command[0] | string | `"/fluent-bit/bin/fluent-bit"` |  |
 | config.customParsers | string | `"[PARSER]\n    Name docker_no_time\n    Format json\n    Time_Keep Off\n    Time_Key time\n    Time_Format %Y-%m-%dT%H:%M:%S.%L\n"` |  |
diff --git a/charts/fluent-bit/RELEASE.md b/charts/fluent-bit/RELEASE.md
@@ -1,3 +1,3 @@
-### Changed
+### Added
 
-- Update Fluent Bit OCI image to [4.2.2](https://github.com/fluent/fluent-bit/releases/tag/v4.2.2). ([#684](https://github.com/fluent/helm-charts/pull/684)) _@stevehipwell_
+- VPA recommender may be specified with `.autoscaling.vpa.recommender`
diff --git a/charts/fluent-bit/templates/vpa.yaml b/charts/fluent-bit/templates/vpa.yaml
@@ -11,6 +11,8 @@ metadata:
     {{- toYaml . | nindent 4 }}
   {{- end }}
 spec:
+  recommenders:
+  - name: {{ .Values.autoscaling.vpa.recommender }}
   resourcePolicy:
     containerPolicies:
     - containerName: {{ .Chart.Name }}
diff --git a/charts/fluent-bit/values.yaml b/charts/fluent-bit/values.yaml
@@ -257,6 +257,9 @@ autoscaling:
     # cpu: 200m
     # memory: 100Mi
 
+    # Name of the VPA recommender that will provide recommendations for vertical scaling.
+    recommender: default
+
     updatePolicy:
       # Specifies whether recommended updates are applied when a Pod is started and whether recommended updates
       # are applied during the life of a Pod. Possible values are "Off", "Initial", "Recreate", and "Auto".
diff --git a/docs/operation/cluster_and_service_configuration.rst b/docs/operation/cluster_and_service_configuration.rst
@@ -920,6 +920,13 @@ edited as follows:
               limits:
                 memory: "4Gi"
 
+Configure Fluent-Bit with TLS outputs
+"""""""""""""""""""""""""""""""""""""
+
+When configuring Fluent-Bit to output to an endpoint using TLS or mTLS,
+it is useful to add certificates to Fluent-Bit.
+This can be done by adding the secrets to the `fluent-bit-certs` secret.
+
 .. _csc-ui-customization:
 
 Metalk8s UI Configuration Customization
diff --git a/salt/metalk8s/addons/logging/fluent-bit/deployed/chart.sls b/salt/metalk8s/addons/logging/fluent-bit/deployed/chart.sls
@@ -15,8 +15,8 @@ metadata:
     app.kubernetes.io/managed-by: salt
     app.kubernetes.io/name: fluent-bit
     app.kubernetes.io/part-of: metalk8s
-    app.kubernetes.io/version: 4.2.2
-    helm.sh/chart: fluent-bit-0.55.0
+    app.kubernetes.io/version: 4.2.3
+    helm.sh/chart: fluent-bit-0.56.0
     heritage: metalk8s
   name: fluent-bit
   namespace: metalk8s-logging
@@ -1596,9 +1596,9 @@ metadata:
     app.kubernetes.io/managed-by: salt
     app.kubernetes.io/name: fluent-bit
     app.kubernetes.io/part-of: metalk8s
-    app.kubernetes.io/version: 4.2.2
+    app.kubernetes.io/version: 4.2.3
     grafana_dashboard: '1'
-    helm.sh/chart: fluent-bit-0.55.0
+    helm.sh/chart: fluent-bit-0.56.0
     heritage: metalk8s
   name: fluent-bit-dashboard-fluent-bit
   namespace: metalk8s-logging
@@ -1611,8 +1611,8 @@ metadata:
     app.kubernetes.io/managed-by: salt
     app.kubernetes.io/name: fluent-bit
     app.kubernetes.io/part-of: metalk8s
-    app.kubernetes.io/version: 4.2.2
-    helm.sh/chart: fluent-bit-0.55.0
+    app.kubernetes.io/version: 4.2.3
+    helm.sh/chart: fluent-bit-0.56.0
     heritage: metalk8s
   name: fluent-bit
   namespace: metalk8s-logging
@@ -1635,8 +1635,8 @@ metadata:
     app.kubernetes.io/managed-by: salt
     app.kubernetes.io/name: fluent-bit
     app.kubernetes.io/part-of: metalk8s
-    app.kubernetes.io/version: 4.2.2
-    helm.sh/chart: fluent-bit-0.55.0
+    app.kubernetes.io/version: 4.2.3
+    helm.sh/chart: fluent-bit-0.56.0
     heritage: metalk8s
   name: fluent-bit
   namespace: metalk8s-logging
@@ -1657,8 +1657,8 @@ metadata:
     app.kubernetes.io/managed-by: salt
     app.kubernetes.io/name: fluent-bit
     app.kubernetes.io/part-of: metalk8s
-    app.kubernetes.io/version: 4.2.2
-    helm.sh/chart: fluent-bit-0.55.0
+    app.kubernetes.io/version: 4.2.3
+    helm.sh/chart: fluent-bit-0.56.0
     heritage: metalk8s
   name: fluent-bit
   namespace: metalk8s-logging
@@ -1681,8 +1681,8 @@ metadata:
     app.kubernetes.io/managed-by: salt
     app.kubernetes.io/name: fluent-bit
     app.kubernetes.io/part-of: metalk8s
-    app.kubernetes.io/version: 4.2.2
-    helm.sh/chart: fluent-bit-0.55.0
+    app.kubernetes.io/version: 4.2.3
+    helm.sh/chart: fluent-bit-0.56.0
     heritage: metalk8s
   name: fluent-bit
   namespace: metalk8s-logging
@@ -1708,7 +1708,12 @@ spec:
         - --config=/fluent-bit/etc/conf/fluent-bit.conf
         command:
         - /fluent-bit/bin/fluent-bit
-        image: {% endraw -%}{{ build_image_name("fluent-bit", False) }}{%- raw %}:4.2.2
+        env:
+        - name: NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        image: {% endraw -%}{{ build_image_name("fluent-bit", False) }}{%- raw %}:4.2.3
         imagePullPolicy: IfNotPresent
         livenessProbe:
           httpGet:
@@ -1735,6 +1740,9 @@ spec:
         - mountPath: /run/log
           name: runlog
           readOnly: true
+        - mountPath: /fluent-bit/etc/tls
+          name: certificates
+          readOnly: true
       dnsPolicy: ClusterFirst
       hostNetwork: false
       serviceAccountName: fluent-bit
@@ -1764,6 +1772,9 @@ spec:
       - hostPath:
           path: /run/log
         name: runlog
+      - name: certificates
+        secret:
+          secretName: fluent-bit-certs
 ---
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
@@ -1773,8 +1784,8 @@ metadata:
     app.kubernetes.io/managed-by: salt
     app.kubernetes.io/name: fluent-bit
     app.kubernetes.io/part-of: metalk8s
-    app.kubernetes.io/version: 4.2.2
-    helm.sh/chart: fluent-bit-0.55.0
+    app.kubernetes.io/version: 4.2.3
+    helm.sh/chart: fluent-bit-0.56.0
     heritage: metalk8s
     metalk8s.scality.com/monitor: ''
   name: fluent-bit
diff --git a/salt/metalk8s/addons/logging/fluent-bit/deployed/configmap.sls b/salt/metalk8s/addons/logging/fluent-bit/deployed/configmap.sls
@@ -125,6 +125,10 @@ Create fluent-bit ConfigMap:
                 Add            namespace unknown
                 Add            pod unknown
                 Add            stream unknown
+            [Filter]
+                Name           record_modifier
+                Match          audit.*
+                Record         hostname ${NODE_NAME}
             {%- for output in fluent_bit.spec.config.output %}
             [Output]
                 {%- for key, value in output.items() %}
diff --git a/salt/metalk8s/addons/logging/fluent-bit/deployed/init.sls b/salt/metalk8s/addons/logging/fluent-bit/deployed/init.sls
@@ -3,6 +3,7 @@
 include:
   - .configmap
   - .service-configuration
+  - .secret
   - .chart
 
 {%- else %}
diff --git a/salt/metalk8s/addons/logging/fluent-bit/deployed/secret.sls b/salt/metalk8s/addons/logging/fluent-bit/deployed/secret.sls
@@ -0,0 +1,28 @@
+include:
+  - ...deployed.namespace
+
+{%- set fluent_bit_certs = salt.metalk8s_kubernetes.get_object(
+        kind='Secret',
+        apiVersion='v1',
+        namespace='metalk8s-logging',
+        name='fluent-bit-certs',
+    )
+%}
+
+{%- if fluent_bit_certs is none %}
+
+Create metalk8s-fluent-bit-certs Secret:
+  metalk8s_kubernetes.object_present:
+    - manifest:
+        apiVersion: v1
+        kind: Secret
+        metadata:
+          name: fluent-bit-certs
+          namespace: metalk8s-logging
+
+{%- else %}
+
+fluent-bit-certs Secret already exists:
+  test.succeed_without_changes: []
+
+{%- endif %}
