diff --git a/pkg/enterprise/render/logcollector/daemonset.go b/pkg/enterprise/render/logcollector/daemonset.go index d2c8edb07f..a4e1ac2152 100644 --- a/pkg/enterprise/render/logcollector/daemonset.go +++ b/pkg/enterprise/render/logcollector/daemonset.go @@ -254,9 +254,19 @@ func (c *fluentBitComponent) metricsService() *corev1.Service { } } +// fluent-bit's listeners default to 0.0.0.0, which an IPv6-only pod can't be +// reached on. Binding the pod IP covers either family without guessing it from +// the IP pools (empty under non-Calico CNIs), and avoids "::", which fails +// where IPv6 is disabled and is v6-only on Windows. +const fluentBitListenAddress = "${POD_IP}" + +// podIPEnvVar feeds fluentBitListenAddress. +var podIPEnvVar = corev1.EnvVar{Name: "POD_IP", ValueFrom: &corev1.EnvVarSource{FieldRef: &corev1.ObjectFieldSelector{FieldPath: "status.podIP"}}} + func (c *fluentBitComponent) envvars() []corev1.EnvVar { envs := []corev1.EnvVar{ {Name: "NODENAME", ValueFrom: &corev1.EnvVarSource{FieldRef: &corev1.ObjectFieldSelector{FieldPath: "spec.nodeName"}}}, + podIPEnvVar, } // Additional stores are Linux-only (the Windows pipeline ships to Linseed // only, matching the fluentd Windows variant), so their credentials are too. diff --git a/pkg/enterprise/render/logcollector/eks_log_forwarder.go b/pkg/enterprise/render/logcollector/eks_log_forwarder.go index 2f3917efbd..fa17e7ad62 100644 --- a/pkg/enterprise/render/logcollector/eks_log_forwarder.go +++ b/pkg/enterprise/render/logcollector/eks_log_forwarder.go @@ -63,6 +63,7 @@ func (c *fluentBitComponent) renderEKSFluentBitConf() string { "flush": 5, "log_level": "info", "http_server": true, + "http_listen": fluentBitListenAddress, "http_port": FluentBitMetricsPort, "health_check": true, // Load the custom in_eks Go plugin shipped in the image. Without @@ -104,6 +105,7 @@ func (c *fluentBitComponent) eksLogForwarderDeployment() *appsv1.Deployment { envVars := []corev1.EnvVar{ {Name: "LOG_LEVEL", Value: "info"}, + podIPEnvVar, // CloudWatch config, credentials — consumed by the in_eks input plugin // (fluent-bit/plugins/in_eks/pkg/config) and the AWS SDK credential chain. {Name: "EKS_CLOUDWATCH_LOG_GROUP", Value: c.cfg.EKSConfig.GroupName}, diff --git a/pkg/enterprise/render/logcollector/fluentbit_test.go b/pkg/enterprise/render/logcollector/fluentbit_test.go index 0ab4cab61c..9fe266f8f6 100644 --- a/pkg/enterprise/render/logcollector/fluentbit_test.go +++ b/pkg/enterprise/render/logcollector/fluentbit_test.go @@ -191,6 +191,15 @@ var _ = Describe("Tigera Secure Fluent Bit rendering tests", func() { }, }, )) + // The rendered listeners bind ${POD_IP} so IPv6-only pods are reachable. + Expect(envs).Should(ContainElement( + corev1.EnvVar{ + Name: "POD_IP", + ValueFrom: &corev1.EnvVarSource{ + FieldRef: &corev1.ObjectFieldSelector{FieldPath: "status.podIP"}, + }, + }, + )) // Linseed/TLS config is now in the ConfigMap, not env vars. Expect(envs).ShouldNot(ContainElements( @@ -1100,6 +1109,7 @@ var _ = Describe("Tigera Secure Fluent Bit rendering tests", func() { expectedEnvVars := []corev1.EnvVar{ {Name: "LOG_LEVEL", Value: "info", ValueFrom: nil}, + {Name: "POD_IP", ValueFrom: &corev1.EnvVarSource{FieldRef: &corev1.ObjectFieldSelector{FieldPath: "status.podIP"}}}, {Name: "EKS_CLOUDWATCH_LOG_GROUP", Value: "dummy-eks-cluster-cloudwatch-log-group"}, {Name: "AWS_REGION", Value: "us-west-1", ValueFrom: nil}, { diff --git a/pkg/enterprise/render/logcollector/pipeline.go b/pkg/enterprise/render/logcollector/pipeline.go index ede87a7381..0a5f6fb5d2 100644 --- a/pkg/enterprise/render/logcollector/pipeline.go +++ b/pkg/enterprise/render/logcollector/pipeline.go @@ -39,6 +39,7 @@ func (c *fluentBitComponent) renderFluentBitConf() string { "flush": 5, "log_level": "info", "http_server": true, + "http_listen": fluentBitListenAddress, "http_port": FluentBitMetricsPort, // Enable the /api/v1/health endpoint the readiness probe hits // (without this it returns 404 and pods never become Ready). @@ -116,7 +117,7 @@ func (c *fluentBitComponent) addInputs(cfg *fluentBitConfig) { if c.cfg.NonClusterHost != nil && c.osType == rmeta.OSTypeLinux { cfg.Pipeline.Inputs = append(cfg.Pipeline.Inputs, map[string]interface{}{ "name": "http", - "listen": "0.0.0.0", + "listen": fluentBitListenAddress, "port": FluentBitInputPort, // fluentd's http source accepted bodies up to `body_size_limit // 100m`; in_http instead rejects anything over buffer_max_size diff --git a/pkg/enterprise/render/logcollector/testdata/rendered-configs/eks-log-stream-prefix.yaml b/pkg/enterprise/render/logcollector/testdata/rendered-configs/eks-log-stream-prefix.yaml index 8f210d34d6..e9f482fa49 100644 --- a/pkg/enterprise/render/logcollector/testdata/rendered-configs/eks-log-stream-prefix.yaml +++ b/pkg/enterprise/render/logcollector/testdata/rendered-configs/eks-log-stream-prefix.yaml @@ -2,6 +2,7 @@ "service": { "flush": 5, "health_check": true, + "http_listen": "${POD_IP}", "http_port": 2020, "http_server": true, "log_level": "info", diff --git a/pkg/enterprise/render/logcollector/testdata/rendered-configs/eks.yaml b/pkg/enterprise/render/logcollector/testdata/rendered-configs/eks.yaml index 8f210d34d6..e9f482fa49 100644 --- a/pkg/enterprise/render/logcollector/testdata/rendered-configs/eks.yaml +++ b/pkg/enterprise/render/logcollector/testdata/rendered-configs/eks.yaml @@ -2,6 +2,7 @@ "service": { "flush": 5, "health_check": true, + "http_listen": "${POD_IP}", "http_port": 2020, "http_server": true, "log_level": "info", diff --git a/pkg/enterprise/render/logcollector/testdata/rendered-configs/linseed-nch.yaml b/pkg/enterprise/render/logcollector/testdata/rendered-configs/linseed-nch.yaml index c1db8b8717..8eeca25203 100644 --- a/pkg/enterprise/render/logcollector/testdata/rendered-configs/linseed-nch.yaml +++ b/pkg/enterprise/render/logcollector/testdata/rendered-configs/linseed-nch.yaml @@ -2,6 +2,7 @@ "service": { "flush": 5, "health_check": true, + "http_listen": "${POD_IP}", "http_port": 2020, "http_server": true, "log_level": "info", @@ -180,7 +181,7 @@ { "buffer_chunk_size": "5M", "buffer_max_size": "100M", - "listen": "0.0.0.0", + "listen": "${POD_IP}", "name": "http", "port": 9880, "storage.type": "filesystem", diff --git a/pkg/enterprise/render/logcollector/testdata/rendered-configs/linseed.yaml b/pkg/enterprise/render/logcollector/testdata/rendered-configs/linseed.yaml index e1b535535a..011744b5e2 100644 --- a/pkg/enterprise/render/logcollector/testdata/rendered-configs/linseed.yaml +++ b/pkg/enterprise/render/logcollector/testdata/rendered-configs/linseed.yaml @@ -2,6 +2,7 @@ "service": { "flush": 5, "health_check": true, + "http_listen": "${POD_IP}", "http_port": 2020, "http_server": true, "log_level": "info", diff --git a/pkg/enterprise/render/logcollector/testdata/rendered-configs/s3-non-cluster-only.yaml b/pkg/enterprise/render/logcollector/testdata/rendered-configs/s3-non-cluster-only.yaml index f78657c6f5..af8c930486 100644 --- a/pkg/enterprise/render/logcollector/testdata/rendered-configs/s3-non-cluster-only.yaml +++ b/pkg/enterprise/render/logcollector/testdata/rendered-configs/s3-non-cluster-only.yaml @@ -2,6 +2,7 @@ "service": { "flush": 5, "health_check": true, + "http_listen": "${POD_IP}", "http_port": 2020, "http_server": true, "log_level": "info", diff --git a/pkg/enterprise/render/logcollector/testdata/rendered-configs/s3.yaml b/pkg/enterprise/render/logcollector/testdata/rendered-configs/s3.yaml index fa8a245021..8416945e77 100644 --- a/pkg/enterprise/render/logcollector/testdata/rendered-configs/s3.yaml +++ b/pkg/enterprise/render/logcollector/testdata/rendered-configs/s3.yaml @@ -2,6 +2,7 @@ "service": { "flush": 5, "health_check": true, + "http_listen": "${POD_IP}", "http_port": 2020, "http_server": true, "log_level": "info", diff --git a/pkg/enterprise/render/logcollector/testdata/rendered-configs/splunk-http.yaml b/pkg/enterprise/render/logcollector/testdata/rendered-configs/splunk-http.yaml index d24ab82306..208cfb219d 100644 --- a/pkg/enterprise/render/logcollector/testdata/rendered-configs/splunk-http.yaml +++ b/pkg/enterprise/render/logcollector/testdata/rendered-configs/splunk-http.yaml @@ -2,6 +2,7 @@ "service": { "flush": 5, "health_check": true, + "http_listen": "${POD_IP}", "http_port": 2020, "http_server": true, "log_level": "info", diff --git a/pkg/enterprise/render/logcollector/testdata/rendered-configs/splunk-https.yaml b/pkg/enterprise/render/logcollector/testdata/rendered-configs/splunk-https.yaml index bd3fbf73c0..6ea327ffbc 100644 --- a/pkg/enterprise/render/logcollector/testdata/rendered-configs/splunk-https.yaml +++ b/pkg/enterprise/render/logcollector/testdata/rendered-configs/splunk-https.yaml @@ -2,6 +2,7 @@ "service": { "flush": 5, "health_check": true, + "http_listen": "${POD_IP}", "http_port": 2020, "http_server": true, "log_level": "info", diff --git a/pkg/enterprise/render/logcollector/testdata/rendered-configs/splunk-non-cluster-only.yaml b/pkg/enterprise/render/logcollector/testdata/rendered-configs/splunk-non-cluster-only.yaml index 9bb4c64b25..b6dbd69044 100644 --- a/pkg/enterprise/render/logcollector/testdata/rendered-configs/splunk-non-cluster-only.yaml +++ b/pkg/enterprise/render/logcollector/testdata/rendered-configs/splunk-non-cluster-only.yaml @@ -2,6 +2,7 @@ "service": { "flush": 5, "health_check": true, + "http_listen": "${POD_IP}", "http_port": 2020, "http_server": true, "log_level": "info", diff --git a/pkg/enterprise/render/logcollector/testdata/rendered-configs/syslog-and-s3-non-cluster-only.yaml b/pkg/enterprise/render/logcollector/testdata/rendered-configs/syslog-and-s3-non-cluster-only.yaml index 7676640b7b..ecdf9bd2bf 100644 --- a/pkg/enterprise/render/logcollector/testdata/rendered-configs/syslog-and-s3-non-cluster-only.yaml +++ b/pkg/enterprise/render/logcollector/testdata/rendered-configs/syslog-and-s3-non-cluster-only.yaml @@ -2,6 +2,7 @@ "service": { "flush": 5, "health_check": true, + "http_listen": "${POD_IP}", "http_port": 2020, "http_server": true, "log_level": "info", diff --git a/pkg/enterprise/render/logcollector/testdata/rendered-configs/syslog-and-s3.yaml b/pkg/enterprise/render/logcollector/testdata/rendered-configs/syslog-and-s3.yaml index f62287d01b..1e5d56de3a 100644 --- a/pkg/enterprise/render/logcollector/testdata/rendered-configs/syslog-and-s3.yaml +++ b/pkg/enterprise/render/logcollector/testdata/rendered-configs/syslog-and-s3.yaml @@ -2,6 +2,7 @@ "service": { "flush": 5, "health_check": true, + "http_listen": "${POD_IP}", "http_port": 2020, "http_server": true, "log_level": "info", diff --git a/pkg/enterprise/render/logcollector/testdata/rendered-configs/syslog-no-tls.yaml b/pkg/enterprise/render/logcollector/testdata/rendered-configs/syslog-no-tls.yaml index 431ec75f02..62200a2e4e 100644 --- a/pkg/enterprise/render/logcollector/testdata/rendered-configs/syslog-no-tls.yaml +++ b/pkg/enterprise/render/logcollector/testdata/rendered-configs/syslog-no-tls.yaml @@ -2,6 +2,7 @@ "service": { "flush": 5, "health_check": true, + "http_listen": "${POD_IP}", "http_port": 2020, "http_server": true, "log_level": "info", diff --git a/pkg/enterprise/render/logcollector/testdata/rendered-configs/syslog-tls-all-log-types-non-cluster-only.yaml b/pkg/enterprise/render/logcollector/testdata/rendered-configs/syslog-tls-all-log-types-non-cluster-only.yaml index 64ff84022f..feefbc0730 100644 --- a/pkg/enterprise/render/logcollector/testdata/rendered-configs/syslog-tls-all-log-types-non-cluster-only.yaml +++ b/pkg/enterprise/render/logcollector/testdata/rendered-configs/syslog-tls-all-log-types-non-cluster-only.yaml @@ -2,6 +2,7 @@ "service": { "flush": 5, "health_check": true, + "http_listen": "${POD_IP}", "http_port": 2020, "http_server": true, "log_level": "info", diff --git a/pkg/enterprise/render/logcollector/testdata/rendered-configs/syslog-tls-all-log-types.yaml b/pkg/enterprise/render/logcollector/testdata/rendered-configs/syslog-tls-all-log-types.yaml index a7d8e308fb..6a35d14dff 100644 --- a/pkg/enterprise/render/logcollector/testdata/rendered-configs/syslog-tls-all-log-types.yaml +++ b/pkg/enterprise/render/logcollector/testdata/rendered-configs/syslog-tls-all-log-types.yaml @@ -2,6 +2,7 @@ "service": { "flush": 5, "health_check": true, + "http_listen": "${POD_IP}", "http_port": 2020, "http_server": true, "log_level": "info", diff --git a/pkg/enterprise/render/logcollector/testdata/rendered-configs/syslog-tls-non-cluster-only.yaml b/pkg/enterprise/render/logcollector/testdata/rendered-configs/syslog-tls-non-cluster-only.yaml index b3fc3db66b..cb5e6d92fa 100644 --- a/pkg/enterprise/render/logcollector/testdata/rendered-configs/syslog-tls-non-cluster-only.yaml +++ b/pkg/enterprise/render/logcollector/testdata/rendered-configs/syslog-tls-non-cluster-only.yaml @@ -2,6 +2,7 @@ "service": { "flush": 5, "health_check": true, + "http_listen": "${POD_IP}", "http_port": 2020, "http_server": true, "log_level": "info", diff --git a/pkg/enterprise/render/logcollector/testdata/rendered-configs/syslog-tls.yaml b/pkg/enterprise/render/logcollector/testdata/rendered-configs/syslog-tls.yaml index e7543d96f6..f3769d919e 100644 --- a/pkg/enterprise/render/logcollector/testdata/rendered-configs/syslog-tls.yaml +++ b/pkg/enterprise/render/logcollector/testdata/rendered-configs/syslog-tls.yaml @@ -2,6 +2,7 @@ "service": { "flush": 5, "health_check": true, + "http_listen": "${POD_IP}", "http_port": 2020, "http_server": true, "log_level": "info", diff --git a/pkg/enterprise/render/logcollector/testdata/rendered-configs/windows.yaml b/pkg/enterprise/render/logcollector/testdata/rendered-configs/windows.yaml index efe3403407..8b6a7c15ec 100644 --- a/pkg/enterprise/render/logcollector/testdata/rendered-configs/windows.yaml +++ b/pkg/enterprise/render/logcollector/testdata/rendered-configs/windows.yaml @@ -2,6 +2,7 @@ "service": { "flush": 5, "health_check": true, + "http_listen": "${POD_IP}", "http_port": 2020, "http_server": true, "log_level": "info",