Try to remove tls.verify false in Fluent Bit configs
- Dominant language
- EJS
- Stars
- 7
- Forks
- 14
- PR merge metrics
- No merged PRs in 30d
Description
Currently we have `tls.verify false` in FLB configs, which will probably eventually get us a security warning.
As part of this change I tried to change it to true, but this didn't work: https://github.com/aws/firelens-datajet/pull/78
Mountebank works building cert at container build time.
Trying to get Fluent Bit to use the cert does not:
[2023/06/22 22:45:59] [error] [tls] crt_file '/cert/mb-csr.pem' 336445449: error:0909006C:PEM routines:get_name:no start line
Despite this error it is formatted properly:
bash-5.2# cat mb-csr.pem
-----BEGIN CERTIFICATE REQUEST-----
So we will keep tls.verify false for now.
The internet suggests that some newline formatting might be the problem, since everything is on linux and there's a single newline between the header and the actual cert, I think that can't be the issue.
Contributor guide
Research direction
Start by inspecting the Fluent Bit configuration and the failed pull request #78, then trace how Mountebank builds and exposes `/cert/mb-csr.pem`. Reproduce the Fluent Bit TLS error and verify the certificate material being provided. Done means `tls.verify true` works without the PEM error and the insecure setting can be removed.
Written by the indexing model from the issue text.
Assessment
- Domain
- observability-sre, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100