kube-logging / logging-operator

Logging operator for Kubernetes
https://kube-logging.dev
Apache License 2.0
1.54k stars 329 forks source link

Make File output configurable #1010

Closed xhejtman closed 1 year ago

xhejtman commented 2 years ago

Is your feature request related to a problem? Please describe. In the current logging-operator, file output is always present and possible to use. Being an admin of a cluster, I do not want users to use the file output as it stores logs into the fluend container without filtering output path, not sure if you can actually set path different to /tmp or not. I would like to make the file output optional, e.g., via values in charts. I see that I can mount PVC into /tmp but I would like to see this output completely disabled.

stale[bot] commented 1 year ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions!

aslafy-z commented 1 year ago

I'm doing this using Kyverno policies, the same thing can also be achieved with Gatekeeper or any other validation solution. I doubt we'll implement that kind of access control in the product itself. What do you think @pepov @ahma?

xhejtman commented 1 year ago

Isn't it a bit overkill, if you can do simple if in the helm chart, to not define the file item in the CRD?

pepov commented 1 year ago

@aslafy-z is right it should be handled with policy engines.

The solution @xhejtman proposed is impossible unfortunately, we cannot dynamically enable/disable CRD fields. We could in theory enable/disable the functionality behind it, but that would add a lot of complexity so please use a policy engine to achieve that.