aws / aws/eks-charts

aws-for-fluent-bit does not update cloudwatch retention log.

Open
#1,084 2 comments 2 reactions 0 assignees View on GitHub
bug
Dominant language
Mustache
Stars
1.3k
Forks
1.1k
Avg merge
22m
Merged PRs (30d)
5

Description

**Describe the bug**
aws-for-fluent-bit does not update cloudwatch retention log in existing cloudwatch log groups

**Steps to reproduce**
1 - Deploy helm chart of aws-for-fluent-bit
2 - Deploy an example application
3 - Check the CloudWatch log group retention of application
4 - Change Helm Value **cloudWatchLogs.logRetentionDays**
5 - Observe the CloudWatch log group retention of application

**Expected outcome**
Change the retention of CloudWatch Log group created by fluent-bit

**Environment**
DEV/TEST (For now)

* Chart name: aws-for-fluent-bit
* Chart version: 0.1.32
* Kubernetes version: 1.27
* Using EKS (yes/no), if so version? Yes, eks.15

**Additional Context**:

**HELM VALUES**:

```
cloudWatchLogs:
enabled:true
region: ${aws_region}
logGroupName: ${log_group_name}
logRetentionDays: ${log_retention_days}
logGroupTemplate: /aws/eks/fluentbit-cloudwatch/workload/$kubernetes['namespace_name']
logFormat: JSON
```

**IAM POLICY USED BY IRSA**:
```
data "aws_iam_policy_document" "irsa" {
statement {
sid = "PutLogEvents"
effect = "Allow"
resources = ["arn:${var.addon_context.aws_partition_id}:logs:${var.addon_context.aws_region_name}:${var.addon_context.aws_caller_identity_account_id}:log-group:*:log-stream:*"]
actions = ["logs:PutLogEvents"]
}

statement {
sid = "CreateCWLogs"
effect = "Allow"
resources = ["arn:${var.addon_context.aws_partition_id}:logs:${var.addon_context.aws_region_name}:${var.addon_context.aws_caller_identity_account_id}:log-group:*"]
actions = [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:DescribeLogGroups",
"logs:DescribeLogStreams",
"logs:PutRetentionPolicy",
"logs:DeleteLogGroup",
"logs:DeleteRetentionPolicy"
]
}
}
```

Contributor guide

Open the contributing guide

Research direction

No repository file or test is named. Start with the aws-for-fluent-bit Helm chart values and rendered configuration for cloudWatchLogs.logRetentionDays, then check how existing CloudWatch log groups are handled during a Helm upgrade. Done means changing the value updates retention for existing groups, with the documented IAM permissions still sufficient.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, helm, kubernetes
Domain
cloud, devops, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.