You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Fluent Bit provides integrated support for _Transport Layer Security_\(TLS\) and it predecessor _Secure Sockets Layer_\(SSL\) respectively. In this section we will refer as TLS only for both implementations.
4
+
Fluent Bit provides integrated support for Transport Layer Security (TLS) and
5
+
its predecessor Secure Sockets Layer (SSL). This section refers only
6
+
to TLS for both implementations.
5
7
6
-
Both input and output plugins that perform Network I/O can optionally enable TLS and configure the behavior. The following table describes the properties available:
8
+
Both input and output plugins that perform Network I/O can optionally enable TLS and
9
+
configure the behavior. The following table describes the properties available:
7
10
8
11
| Property | Description | Default |
9
12
| :--- | :--- | :--- |
10
-
| tls | enable or disable TLS support | Off |
11
-
| tls.verify | force certificate validation | On |
12
-
| tls.verify\_hostname | force TLS verification of hostnames | Off |
13
-
| tls.debug | Set TLS debug verbosity level. It accept the following values: 0 \(No debug\), 1 \(Error\), 2 \(State change\), 3 \(Informational\) and 4 Verbose | 1 |
14
-
| tls.ca\_file | absolute path to CA certificate file ||
15
-
| tls.ca\_path | absolute path to scan for certificate files ||
16
-
| tls.crt\_file | absolute path to Certificate file ||
17
-
| tls.key\_file | absolute path to private Key file ||
18
-
| tls.key\_passwd | optional password for tls.key\_file file ||
19
-
| tls.vhost | hostname to be used for TLS SNI extension ||
20
-
21
-
*Note : in order to use TLS on input plugins the user is expected to provide both a certificate and private key*
22
-
23
-
The listed properties can be enabled in the configuration file, specifically on each output plugin section or directly through the command line.
13
+
|`tls`| Enable or disable TLS support. |`Off`|
14
+
|`tls.verify`| Force certificate validation. |`On`|
15
+
|`tls.verify_hostname`| Force TLS verification of host names. |`Off`|
16
+
|`tls.debug`| Set TLS debug verbosity level. Accepted values: `0` (No debug), `1` (Error), `2` (State change), `3` (Informational) and `4`. (Verbose) |`1`|
17
+
|`tls.ca_file`| Absolute path to CA certificate file. |_none_|
18
+
|`tls.ca_path`| Absolute path to scan for certificate files. |_none_|
19
+
|`tls.crt_file`| Absolute path to Certificate file. |_none_|
20
+
|`tls.key_file`| Absolute path to private Key file. |_none_|
21
+
|`tls.key_passwd`| Optional password for `tls.key_file` file. |_none_|
22
+
|`tls.vhost`| Hostname to be used for TLS SNI extension. |_none_|
23
+
24
+
To use TLS on input plugins, you must provide both a certificate and a
25
+
private key.
26
+
27
+
The listed properties can be enabled in the configuration file, specifically in each
28
+
output plugin section or directly through the command line.
24
29
25
30
The following **output** plugins can take advantage of the TLS feature:
By default HTTP input plugin uses plain TCP, enabling TLS from the command line can be done with:
81
86
82
-
```text
87
+
By default, the HTTP input plugin uses plain TCP. Run the following command to enable
88
+
TLS:
89
+
90
+
```bash
83
91
./bin/fluent-bit -i http \
84
92
-p port=9999 \
85
93
-p tls=on \
@@ -90,11 +98,12 @@ By default HTTP input plugin uses plain TCP, enabling TLS from the command line
90
98
-m '*'
91
99
```
92
100
93
-
In the command line above, the two properties _tls_ and _tls.verify_ where enabled for demonstration purposes \(we strongly suggest always keep verification ON\).
101
+
In the previous command, the two properties `tls` and `tls.verify` are set
102
+
for demonstration purposes. Always enable verification in production environments.
94
103
95
104
The same behavior can be accomplished using a configuration file:
96
105
97
-
```text
106
+
```python
98
107
[INPUT]
99
108
name http
100
109
port 9999
@@ -110,20 +119,22 @@ The same behavior can be accomplished using a configuration file:
110
119
111
120
## Example: enable TLS on HTTP output
112
121
113
-
By default HTTP output plugin uses plain TCP, enabling TLS from the command line can be done with:
122
+
By default, the HTTP output plugin uses plain TCP. Run the following command to enable
123
+
TLS:
114
124
115
-
```text
116
-
$ fluent-bit -i cpu -t cpu -o http://192.168.2.3:80/something \
125
+
```bash
126
+
fluent-bit -i cpu -t cpu -o http://192.168.2.3:80/something \
117
127
-p tls=on \
118
128
-p tls.verify=off \
119
129
-m '*'
120
130
```
121
131
122
-
In the command line above, the two properties _tls_ and _tls.verify_ where enabled for demonstration purposes \(we strongly suggest always keep verification ON\).
132
+
In the previous command, the properties `tls` and `tls.verify` are enabled
133
+
for demonstration purposes. Always enable verification in production environments.
123
134
124
135
The same behavior can be accomplished using a configuration file:
125
136
126
-
```text
137
+
```python
127
138
[INPUT]
128
139
Name cpu
129
140
Tag cpu
@@ -140,11 +151,14 @@ The same behavior can be accomplished using a configuration file:
140
151
141
152
## Tips and Tricks
142
153
143
-
### Generate your own self signed certificates for testing purposes.
154
+
### Generate a self signed certificates for testing purposes
144
155
145
-
This will generate a 4096 bit RSA key pair and a certificate that is signed using SHA-256 with the expiration date set to 30 days in the future, `test.host.net` set as common name and since we opted out of `DES` the private key will be stored in plain text.
156
+
The following command generates a 4096 bit RSA key pair and a certificate that's signed
157
+
using `SHA-256` with the expiration date set to 30 days in the future. In this example,
158
+
`test.host.net` is set as the common name. This example opts out of `DES`, so the
159
+
private key is stored in plain text.
146
160
147
-
```
161
+
```bash
148
162
openssl req -x509 \
149
163
-newkey rsa:4096 \
150
164
-sha256 \
@@ -156,9 +170,12 @@ openssl req -x509 \
156
170
157
171
### Connect to virtual servers using TLS
158
172
159
-
Fluent Bit supports [TLS server name indication](https://en.wikipedia.org/wiki/Server_Name_Indication). If you are serving multiple hostnames on a single IP address \(a.k.a. virtual hosting\), you can make use of `tls.vhost` to connect to a specific hostname.
173
+
Fluent Bit supports
174
+
[TLS server name indication](https://en.wikipedia.org/wiki/Server_Name_Indication).
175
+
If you are serving multiple host names on a single IP address (for example, using
176
+
virtual hosting), you can make use of `tls.vhost` to connect to a specific hostname.
160
177
161
-
```text
178
+
```python
162
179
[INPUT]
163
180
Name cpu
164
181
Tag cpu
@@ -174,22 +191,23 @@ Fluent Bit supports [TLS server name indication](https://en.wikipedia.org/wiki/S
174
191
tls.vhost fluent.example.com
175
192
```
176
193
177
-
### Verify subjectAltName
194
+
### Verify `subjectAltName`
178
195
179
-
By default, TLS verification of hostnames is not done automatically.
180
-
As an example, we can extract the X509v3 Subject Alternative Name from a certificate:
196
+
By default, TLS verification of host names isn't done automatically.
197
+
As an example, you can extract the X509v3 Subject Alternative Name from a certificate:
181
198
182
-
```
199
+
```text
183
200
X509v3 Subject Alternative Name:
184
201
DNS:my.fluent-aggregator.net
185
202
```
186
203
187
-
As you can see, this certificate covers only `my.fluent-aggregator.net` so if we use a different hostname it should fail.
188
-
189
-
To fully verify the alternative name and demonstrate the failure we enable `tls.verify_hostname`:
204
+
This certificate covers only `my.fluent-aggregator.net` so if you use a different
205
+
hostname it should fail.
190
206
207
+
To fully verify the alternative name and demonstrate the failure, enable
208
+
`tls.verify_hostname`:
191
209
192
-
```text
210
+
```python
193
211
[INPUT]
194
212
Name cpu
195
213
Tag cpu
@@ -205,9 +223,9 @@ To fully verify the alternative name and demonstrate the failure we enable `tls.
205
223
tls.ca_file /path/to/fluent-x509v3-alt-name.crt
206
224
```
207
225
208
-
This outgoing connect will be failed and disconnected:
0 commit comments