GiovanniColonni commented 1 month ago

Bug Report

I created a OpenSearch cluster in DO to forward logs from my app. The error i have is the following: Error: Error updating app (xxxxxx-xxxx-xxxx-xxxx-xxxxxxxx): PUT https://api.digitalocean.com/v2/apps/xxxxxx-xxxx-xxxx-xxxx-xxxxxxxx: 400 (request "xxxxxx-xxxx-xxxx-xxxx-xxxxxxxx") error validating app spec field "services.log_destinations.open_search.cluster_name": service "app-name" log destination "app-name" log destination "app-name-opensearch" trusted sources firewall rules found for cluster db-opensearch-logs. Please disable Trusted Sources for the cluster and try again. If i disable the Trusted Sources and I open the cluster to any connection then this process works, but otherwise no.

Describe the bug

When attempting to forward logs from an app to a DigitalOcean OpenSearch cluster, the process fails if the Trusted Sources firewall rules are enabled. Disabling the Trusted Sources and allowing connections from all IPs makes the operation succeed. This behavior suggests that the Trusted Sources configuration conflicts with the app's logging destination validation process.

Affected Resource(s)

digitalocean_opensearch_cluster
digitalocean_app_log_destination
app platform

Expected Behavior

The application should successfully forward logs to the OpenSearch cluster while having Trusted Sources enabled for security purposes.

Actual Behavior

An error is thrown, preventing the app from forwarding logs to the OpenSearch cluster when Trusted Sources are enabled. The only workaround is to open the cluster to all connections, which compromises security.

Steps to Reproduce

Create an OpenSearch cluster on DigitalOcean with Trusted Sources enabled.
Set up an app in DigitalOcean that forwards logs to this OpenSearch cluster.
Attempt to update or deploy the app with log forwarding configured.
Encounter the error related to trusted sources firewall rules.
Disable Trusted Sources and try again, which succeeds.

Terraform Configuration Files The log destination: log_destination { name = "app-${var.ENVIRONMENT}-opensearch" open_search { cluster_name = "db-app-opensearch-logs" index_name = "app-${var.ENVIRONMENT}-logs" basic_auth { user="user" } } }

andrewsomething commented 1 month ago

Hi @GiovanniColonni,

This is currently a known product limitation.

Log forwarding does not support sending logs to DigitalOcean Managed OpenSearch clusters with trusted sources enabled. To send logs to a managed OpenSearch cluster, disable trusted sources.

https://docs.digitalocean.com/products/app-platform/how-to/forward-logs/

I'll pass on the feedback relevant teams internally.