kube-fluentd-operator.yaml

package:
  name: kube-fluentd-operator
  version: 1.18.2
  epoch: 19
  description: Auto-configuration of Fluentd daemon-set based on Kubernetes metadata
  copyright:
    - license: MIT
  resources:
    cpu: 16
    memory: 16Gi
  dependencies:
    runtime:
      - busybox
      - jemalloc
      - libsystemd
      - ruby-3.2
      - ruby3.2-bundler

environment:
  contents:
    packages:
      - bash
      - build-base
      - busybox
      - bzip2
      - ca-certificates-bundle
      - gdbm
      - gdbm-dev
      - git
      - gmp-dev
      - go
      - gpg
      - libedit
      - libedit-dev
      - libffi-dev
      - openssf-compiler-options
      - openssl-dev
      - ruby-3.2
      - ruby-3.2-dev
      - ruby3.2-bundler
      - wget
      - zlib-dev

# https://github.com/GoogleCloudPlatform/fluent-plugin-google-cloud/commit/53d481a6f417e9d039cae717eab4773ab754738e
vars:
  FLUENT_PLUGIN_GOOGLE_CLOUD_COMMIT: "53d481a6f417e9d039cae717eab4773ab754738e"

pipeline:
  - uses: git-checkout
    with:
      repository: https://github.com/vmware/kube-fluentd-operator
      tag: v${{package.version}}
      expected-commit: 20e6130591ab07d1c73fcc892a4f9146c5a26b25

  - uses: go/bump
    with:
      deps: google.golang.org/protobuf@v1.33.0 golang.org/x/net@v0.23.0
      modroot: image

  - uses: go/bump
    with:
      deps: google.golang.org/protobuf@v1.33.0 golang.org/x/net@v0.23.0 golang.org/x/crypto@v0.31.0
      modroot: config-reloader

  - runs: |
      echo 'gem: --no-rdoc --no-ri' >> ~/.gemrc

      cd image
      GEM_DIR=${{targets.destdir}}$(ruby -e 'puts Gem.default_dir')
      mkdir -p ${GEM_DIR}
      bundle config set --local path ${GEM_DIR}
      bundle config set --local without 'development test'

      # Bump activemodel to mitigate CVE-2023-38037
      echo "gem 'activemodel', '7.0.7.2'" >> Gemfile
      # Bump json-jwt to mitigate GHSA-c8v6-786g-vjx6
      echo "gem 'json-jwt', '1.15.3.1'" >> Gemfile
      # bump google-protobuf to mitigate GHSA-735f-pc8j-v9w8
      echo "gem 'google-protobuf', '3.25.5'" >> Gemfile
      # bump webrick to mitigate GHSA-6f62-3596-g6w7
      echo "gem 'webrick', '1.8.2'" >> Gemfile
      # Bump rack to mitigate GHSA-xj5v-6v4g-jfw6
      bundle update rack
      bundle install

      mkdir -p ${{targets.destdir}}/etc/fluent/plugin
      mv ./plugins/* ${{targets.destdir}}/etc/fluent/plugin

      cd ..
      git clone https://github.com/GoogleCloudPlatform/fluent-plugin-google-cloud.git
      cd fluent-plugin-google-cloud
      git checkout ${{vars.FLUENT_PLUGIN_GOOGLE_CLOUD_COMMIT}}

      # Remediate GHSA-p25m-jpj4-qcrr CVE in the grpc. GHSA-p25m-jpj4-qcrr is fixed in grpc >=1.53.2 but 1.58.3 is
      # the first version that has precompiled binaries for both x86_64 and aarch64. Compilation issues on aarch64
      # prompted this change. It will result in faster builds too.
      sed -e "s/'grpc', '1.53.0'/'grpc', '1.58.3'/g" -i fluent-plugin-google-cloud.gemspec

      # Moving to grpc 1.58.3 causes a dependency resolution issue as grpc >= 1.55.0, < 1.59.0 requires
      # google-protobuf ~> 3.23 but fluent-plugin-google-cloud had pinned google-protobuf to version 3.22.1.
      # Bumping google-protobuf to 3.23 solves this.
      sed -e "s/'google-protobuf', '3.22.1'/'google-protobuf', '3.25.5'/g" -i fluent-plugin-google-cloud.gemspec

      bundle config set --local path ${GEM_DIR}
      bundle config set --local without 'development test'
      bundle install

      # remove cache to avoid including it in the package
      rm -rf ${{targets.destdir}}/$(ruby -e "puts File.join(Gem.default_dir, 'ruby', RbConfig::CONFIG['ruby_version'])")/cache

  - uses: strip

  - runs: |
      # makefile has moved to the root of the repo without any changes
      # This may break in future versions TODO : Remove this when the makefile works again from root of repo
      cp Makefile ./config-reloader

      mkdir -p ${{targets.destdir}}/usr/bin
      cd config-reloader

      make build VERSION=${{package.version}}
      mv config-reloader ${{targets.destdir}}/usr/bin/
      mv ./templates ${{targets.destdir}}/etc/fluent/

subpackages:
  - name: kube-fluentd-operator-oci-entrypoint
    description: Entrypoint for using kube-fluentd-operator
    dependencies:
      runtime:
        - bash
    pipeline:
      - runs: |
          cd image
          mkdir -p ${{targets.subpkgdir}}/var/lib/kube-fluentd-operator/initdb
          cp entrypoint.sh ${{targets.subpkgdir}}/var/lib/kube-fluentd-operator/initdb/
          chmod +x ${{targets.subpkgdir}}/var/lib/kube-fluentd-operator/initdb/entrypoint.sh

  - name: kube-fluentd-operator-default-config
    description: Default configuration for kube-fluentd-operator
    pipeline:
      - runs: |
          cd image
          mkdir -p ${{targets.subpkgdir}}/etc/fluent
          cp failsafe.conf ${{targets.subpkgdir}}/etc/fluent/fluent.conf

  - name: kube-fluentd-operator-compat
    pipeline:
      - runs: |
          mkdir -p ${{targets.subpkgdir}}/fluentd/etc
          mkdir -p ${{targets.subpkgdir}}/bin
          mkdir -p ${{targets.subpkgdir}}/usr/local/bundle/bin
          mkdir -p ${{targets.subpkgdir}}/usr/lib/gem

          ln -sf /var/lib/kube-fluentd-operator/initdb/entrypoint.sh ${{targets.subpkgdir}}/fluentd/entrypoint.sh
          ln -sf /etc/fluent/fluent.conf ${{targets.subpkgdir}}/fluentd/failsafe.conf
          ln -sf /etc/fluent/plugin ${{targets.subpkgdir}}/fluentd/plugins
          ln -sf /etc/fluent/plugin ${{targets.subpkgdir}}/fluentd/log
          ln -sf /etc/fluent/templates ${{targets.subpkgdir}}/templates
          ln -sf /usr/bin/config-reloader ${{targets.subpkgdir}}/bin/config-reloader
          ln -sf $(ruby -e "puts File.join(Gem.default_dir, 'ruby', RbConfig::CONFIG['ruby_version'], 'bin', 'fluentd')") ${{targets.subpkgdir}}/usr/local/bundle/bin/fluentd

          # this should probably live in the ruby-3.2 package but not sure if we need to do it in a way that multiple ruby versions can coexist
          # TODO JR to followup
          ln -sf $(ruby -e "puts File.join(Gem.default_dir, 'ruby', RbConfig::CONFIG['ruby_version'])") ${{targets.subpkgdir}}/usr/lib/gem/home

test:
  environment:
    contents:
      packages:
        - kube-fluentd-operator-compat
        - kube-fluentd-operator-default-config
        - kube-fluentd-operator-oci-entrypoint
  pipeline:
    - runs: |
        export PATH="$PATH:/usr/lib/gem/home/bin/"
        export GEM_PATH="/usr/lib/gem/home"

        # Check if Fluentd is installed
        fluentd -help

        # Configure Fluentd to capture logs in a file
        mkdir -p /var/log/fluentd
        fluentd -s conf
        cat << EOF > conf/fluent.conf
        <source>
          @type forward
          @id forward_input
        </source>
        <match debug.**>
          @type file
          path /var/log/fluentd/debug
          append true
          format json
          buffer_path /var/log/fluentd/debug.*
        </match>
        EOF

        # Start Fluentd in daemon mode
        fluentd -c conf/fluent.conf &
        sleep 2

        # Send a test message to Fluentd
        echo '{"json":"Test message"}' | fluent-cat debug.test

        # Check if the test message is successfully logged
        if grep -q "Test message" /var/log/fluentd/debug*.log; then
          echo "Test message found in the log file."
        else
          echo "Test message not found in the log file."
          exit 1
        fi
        config-reloader --version
        config-reloader --help

update:
  enabled: true
  github:
    identifier: vmware/kube-fluentd-operator
    strip-prefix: v