Merge pull request #1555 from xperimental/vector-loki-collector-ca

[release-5.4] LOG-2786: Use service CA when using default token in vector Loki output
openshift · Jul 11, 2022 · e1053c3 · e1053c3
2 parents 9fb0fff + 35bf3ff
commit e1053c3
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 0 deletions.
diff --git a/internal/generator/vector/output/loki/loki.go b/internal/generator/vector/output/loki/loki.go
@@ -206,6 +206,17 @@ func TLSConf(o logging.OutputSpec, secret *corev1.Secret) []Element {
 		if !hasTLS {
 			return []Element{}
 		}
+	} else if secret != nil {
+		// Set CA from logcollector ServiceAccount for internal Loki
+		return []Element{
+			security.TLSConf{
+				Desc:        "TLS Config",
+				ComponentID: strings.ToLower(vectorhelpers.Replacer.Replace(o.Name)),
+			},
+			CAFile{
+				CAFilePath: `"/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt"`,
+			},
+		}
 	}
 	return conf
 }

diff --git a/internal/generator/vector/output/loki/loki_conf_test.go b/internal/generator/vector/output/loki/loki_conf_test.go
@@ -269,6 +269,9 @@ kubernetes_namespace_name = "{{kubernetes.pod_namespace}}"
 kubernetes_pod_name = "{{kubernetes.pod_name}}"
 log_type = "{{log_type}}"
 
+# TLS Config
+[sinks.loki_receiver.tls]
+ca_file = "/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt"
 # Bearer Auth Config
 [sinks.loki_receiver.auth]
 strategy = "bearer"