fluent-plugin-kubernetes_metadata_filter 2.1.5 → 2.1.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 375c81d10e8289931076d5897cc16a5469ab46c4
-  data.tar.gz: 820c9cd521aeb1bc0732fd26b1ad0bf1a2f596bf
+SHA256:
+  metadata.gz: 4a83bf6d7f3f2f80e380d89a9aa78024c706a4312b971d8d53ffe79a67bdb322
+  data.tar.gz: 241adc577d1c9eb2bdb97ef2a7d7ef6511cbbe836e15b91301f04657e4345feb
 SHA512:
-  metadata.gz: 405b343bfd0db4636663b87a46841786f2c369f9f3d2847e722b867a36b6698c5662bb2815b732547e09b79368864ad27c8c49fcad91af691f05b46eded95d10
-  data.tar.gz: d3e25d492f9e2ba6311f03d0e83a12e96da0ee487075c079dc09eee75b11326a2497cccf7c5f9a3c2fd84346d4fedc3ed43d3b0684a16547bfcba36346b60063
+  metadata.gz: 2e3923244e262befe237d2f35cc8f54788558e22ff53cec53bd4edd044931ea35682bee853eda5775254df44026cfdedd16bda247aee2b2f443b1cb73e853514
+  data.tar.gz: bda740f2a37e0a2510277b84c32e469360b8652327d47b994b464942ab17e246b6eda6f16ad43c4b65b806b8928188886524684ae37199abf9cd58edab84445b

data/README.md

@@ -54,6 +54,9 @@ when true (default: `true`)
 * `orphaned_namespace_name` - The namespace to associate with records where the namespace can not be determined (default: `.orphaned`)
 * `orphaned_namespace_id` - The namespace id to associate with records where the namespace can not be determined (default: `orphaned`)
 * `lookup_from_k8s_field` - If the field `kubernetes` is present, lookup the metadata from the given subfields such as `kubernetes.namespace_name`, `kubernetes.pod_name`, etc.  This allows you to avoid having to pass in metadata to lookup in an explicitly formatted tag name or in an explicitly formatted `CONTAINER_NAME` value.  For example, set `kubernetes.namespace_name`, `kubernetes.pod_name`, `kubernetes.container_name`, and `docker.id` in the record, and the filter will fill in the rest. (default: `true`)
+* `ssl_partial_chain` - if `ca_file` is for an intermediate CA, or otherwise we do not have the root CA and want
+  to trust the intermediate CA certs we do have, set this to `true` - this corresponds to
+  the `openssl s_client -partial_chain` flag and `X509_V_FLAG_PARTIAL_CHAIN` (default: `false`)
 
 **NOTE:** As of the release 2.1.x of this plugin, it no longer supports parsing the source message into JSON and attaching it to the
 payload.  The following configuration options are removed:

data/fluent-plugin-kubernetes_metadata_filter.gemspec

@@ -4,7 +4,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 
 Gem::Specification.new do |gem|
   gem.name          = "fluent-plugin-kubernetes_metadata_filter"
-  gem.version       = "2.1.5"
+  gem.version       = "2.1.6"
   gem.authors       = ["Jimmi Dyson"]
   gem.email         = ["jimmidyson@gmail.com"]
   gem.description   = %q{Filter plugin to add Kubernetes metadata}

data/lib/fluent/plugin/filter_kubernetes_metadata.rb

@@ -72,6 +72,10 @@ module Fluent::Plugin
     config_param :orphaned_namespace_name, :string, default: '.orphaned'
     config_param :orphaned_namespace_id, :string, default: 'orphaned'
     config_param :lookup_from_k8s_field, :bool, default: true
+    # if `ca_file` is for an intermediate CA, or otherwise we do not have the root CA and want
+    # to trust the intermediate CA certs we do have, set this to `true` - this corresponds to
+    # the openssl s_client -partial_chain flag and X509_V_FLAG_PARTIAL_CHAIN
+    config_param :ssl_partial_chain, :bool, default: false
 
     def fetch_pod_metadata(namespace_name, pod_name)
       log.trace("fetching pod metadata: #{namespace_name}/#{pod_name}") if log.trace?
@@ -219,6 +223,21 @@ module Fluent::Plugin
             verify_ssl:  @verify_ssl ? OpenSSL::SSL::VERIFY_PEER : OpenSSL::SSL::VERIFY_NONE
         }
 
+        if @ssl_partial_chain
+          # taken from the ssl.rb OpenSSL::SSL::SSLContext code for DEFAULT_CERT_STORE
+          require 'openssl'
+          ssl_store = OpenSSL::X509::Store.new
+          ssl_store.set_default_paths
+          if defined? OpenSSL::X509::V_FLAG_PARTIAL_CHAIN
+            flagval = OpenSSL::X509::V_FLAG_PARTIAL_CHAIN
+          else
+            # this version of ruby does not define OpenSSL::X509::V_FLAG_PARTIAL_CHAIN
+            flagval = 0x80000
+          end
+          ssl_store.flags = OpenSSL::X509::V_FLAG_CRL_CHECK_ALL | flagval
+          ssl_options[:cert_store] = ssl_store
+        end
+
         auth_options = {}
 
         if @bearer_token_file.present?

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: fluent-plugin-kubernetes_metadata_filter
 version: !ruby/object:Gem::Version
-  version: 2.1.5
+  version: 2.1.6
 platform: ruby
 authors:
 - Jimmi Dyson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-11-19 00:00:00.000000000 Z
+date: 2018-12-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: fluentd
@@ -256,7 +256,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.12
+rubygems_version: 2.7.6
 signing_key: 
 specification_version: 4
 summary: Fluentd filter plugin to add Kubernetes metadata