Skip to content

Commit 8977ca6

Browse files
mattia-eleuterimattia-eleuteri
committed
fix(monitoring): allow-list kubernetes_ fields instead of block-listing
The nest/lift promotes the entire `kubernetes` map to top-level `kubernetes_*`, so removing only `kubernetes_host` left other infra fields tenant-visible (docker_id, container_image, annotations, pod_id, container_hash, ...) and would silently leak any field a future fluent-bit version adds. `_stream_fields` in the VictoriaLogs output only sets the stream labels, not a stored-field projection, so it does not limit what tenants can see. Keep only kubernetes_pod_name, kubernetes_namespace_name and kubernetes_container_name (the fields the OUTPUT actually uses), and drop every other kubernetes_* field via Remove_wildcard. Scoped to the kubernetes_ prefix so merged application log fields (Merge_Log On) are untouched. Signed-off-by: mattia-eleuteri <[email protected]>
1 parent 61fb19d commit 8977ca6

1 file changed

Lines changed: 13 additions & 1 deletion

File tree

‎packages/system/monitoring-agents/values.yaml‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -426,7 +426,19 @@ fluent-bit:
426426
[FILTER]
427427
Name modify
428428
Match kube.*
429-
Remove kubernetes_host
429+
Rename kubernetes_pod_name keep_kubernetes_pod_name
430+
Rename kubernetes_namespace_name keep_kubernetes_namespace_name
431+
Rename kubernetes_container_name keep_kubernetes_container_name
432+
[FILTER]
433+
Name modify
434+
Match kube.*
435+
Remove_wildcard kubernetes_
436+
[FILTER]
437+
Name modify
438+
Match kube.*
439+
Rename keep_kubernetes_pod_name kubernetes_pod_name
440+
Rename keep_kubernetes_namespace_name kubernetes_namespace_name
441+
Rename keep_kubernetes_container_name kubernetes_container_name
430442
scrapeRules:
431443
etcd:
432444
enabled: false

0 commit comments

Comments
 (0)