Allow fluentbit forwarding - #870
Merged
Merged
Conversation
Collaborator
Author
|
/gcbrun |
Collaborator
Author
|
/gcbrun |
Collaborator
Author
|
/gcbrun |
atulpatildbz
added a commit
to GoogleCloudPlatform/key-protection-module
that referenced
this pull request
Jul 20, 2026
tail KPS services journal and forward the logs to the workload VM's Fluent Bit, which relays them onward. ### Key Changes: * **Fluent Bit Configuration (`fluent-bit-kps.conf`)**: * Tails `keymanager.service` (agent container stdout) and `attestation.service`. * Explicitly filters and tags logs with their respective `service.name` (`key_protection_service` and `attestation_service`). * Forwards logs to the workload VM at `192.168.100.2:24224`. * Uses `storage.type memrb` (Memory Ring Buffer) with a 32MB limit per input. If the receiver is unreachable, Fluent Bit drops the oldest logs instead of pausing, preventing backpressure from stalling the KPS services. * **Service Management (`entrypoint.sh`)**: * Uses a custom `fluent-bit-kps.service` instead of the base image's unit (which relies on metadata the VM cannot reach). * Starts the relay *after* the KPS units so a failing relay cannot stop the KPS from serving keys. * If the relay fails to start, the entrypoint logs a non-fatal `ERROR` and continues execution without crashing the VM. * **CI Validation**: * Added an `image-config` CI job to validate the Fluent Bit config (`fluent-bit --dry-run`) and systemd units (`systemd-analyze verify`). This ensures typos or invalid properties are caught, as both tools can otherwise exit `0` on invalid configs. corresponding changes on workload VM are here: google/go-tpm-tools#870
Collaborator
Author
|
/gcbrun |
atulpatildbz
approved these changes
Jul 23, 2026
atulpatildbz
left a comment
atulpatildbz
left a comment
Collaborator
There was a problem hiding this comment.
Thanks for taking up this implementation
mayafleischer
force-pushed
the
telemtry-updates
branch
from
July 23, 2026 20:32
6009029 to
8752dce
Compare
mayafleischer
force-pushed
the
telemtry-updates
branch
from
July 27, 2026 16:36
9b5a136 to
c0326e9
Compare
Collaborator
Author
|
/gcbrun |
jkl73
approved these changes
Jul 29, 2026
Collaborator
Author
|
/gcbrun |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Create a dedicated fluent-bit config file to accept forwarded logs and enable additional collection and filtration.
Key changes:
[new] bc-fluent-bit.config:
Collect and filter kernel, network logs and WSD
Configure fluent-bit forward receiver
bc-entrypoint.sh
Update
iptablesfirewall rules to allow incoming TCP port 24224 traffic exclusively from the KPS vm.Update to use newly created config file
Additional filtering logic is expected to be added.
See GoogleCloudPlatform/key-protection-module#64 for corresponding KPS VM change.