aws / aws/firelens-datajet

Try to remove tls.verify false in Fluent Bit configs

Open
#79 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
EJS
Stars
7
Forks
14
PR merge metrics
No merged PRs in 30d

Description

Currently we have `tls.verify false` in FLB configs, which will probably eventually get us a security warning.

As part of this change I tried to change it to true, but this didn't work: https://github.com/aws/firelens-datajet/pull/78

Mountebank works building cert at container build time.

Trying to get Fluent Bit to use the cert does not:

[2023/06/22 22:45:59] [error] [tls] crt_file '/cert/mb-csr.pem' 336445449: error:0909006C:PEM routines:get_name:no start line
Despite this error it is formatted properly:

bash-5.2# cat mb-csr.pem
-----BEGIN CERTIFICATE REQUEST-----
So we will keep tls.verify false for now.

The internet suggests that some newline formatting might be the problem, since everything is on linux and there's a single newline between the header and the actual cert, I think that can't be the issue.

Contributor guide

Open the contributing guide

Research direction

Start by inspecting the Fluent Bit configuration and the failed pull request #78, then trace how Mountebank builds and exposes `/cert/mb-csr.pem`. Reproduce the Fluent Bit TLS error and verify the certificate material being provided. Done means `tls.verify true` works without the PEM error and the insecure setting can be removed.

Written by the indexing model from the issue text.

Assessment

Domain
observability-sre, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.