aws-for-fluent-bit does not update cloudwatch retention log.
- Dominant language
- Mustache
- Stars
- 1.3k
- Forks
- 1.1k
- Avg merge
- 22m
- Merged PRs (30d)
- 5
Description
**Describe the bug**
aws-for-fluent-bit does not update cloudwatch retention log in existing cloudwatch log groups
**Steps to reproduce**
1 - Deploy helm chart of aws-for-fluent-bit
2 - Deploy an example application
3 - Check the CloudWatch log group retention of application
4 - Change Helm Value **cloudWatchLogs.logRetentionDays**
5 - Observe the CloudWatch log group retention of application
**Expected outcome**
Change the retention of CloudWatch Log group created by fluent-bit
**Environment**
DEV/TEST (For now)
* Chart name: aws-for-fluent-bit
* Chart version: 0.1.32
* Kubernetes version: 1.27
* Using EKS (yes/no), if so version? Yes, eks.15
**Additional Context**:
**HELM VALUES**:
```
cloudWatchLogs:
enabled:true
region: ${aws_region}
logGroupName: ${log_group_name}
logRetentionDays: ${log_retention_days}
logGroupTemplate: /aws/eks/fluentbit-cloudwatch/workload/$kubernetes['namespace_name']
logFormat: JSON
```
**IAM POLICY USED BY IRSA**:
```
data "aws_iam_policy_document" "irsa" {
statement {
sid = "PutLogEvents"
effect = "Allow"
resources = ["arn:${var.addon_context.aws_partition_id}:logs:${var.addon_context.aws_region_name}:${var.addon_context.aws_caller_identity_account_id}:log-group:*:log-stream:*"]
actions = ["logs:PutLogEvents"]
}
statement {
sid = "CreateCWLogs"
effect = "Allow"
resources = ["arn:${var.addon_context.aws_partition_id}:logs:${var.addon_context.aws_region_name}:${var.addon_context.aws_caller_identity_account_id}:log-group:*"]
actions = [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:DescribeLogGroups",
"logs:DescribeLogStreams",
"logs:PutRetentionPolicy",
"logs:DeleteLogGroup",
"logs:DeleteRetentionPolicy"
]
}
}
```
Contributor guide
Research direction
No repository file or test is named. Start with the aws-for-fluent-bit Helm chart values and rendered configuration for cloudWatchLogs.logRetentionDays, then check how existing CloudWatch log groups are handled during a Helm upgrade. Done means changing the value updates retention for existing groups, with the documented IAM permissions still sufficient.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, helm, kubernetes
- Domain
- cloud, devops, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100