rancher-logging-exit

Solid

Migrate off the Rancher-bundled `rancher-logging` chart (cattle-logging-system, rancher/mirrored-kube-logging-* images) to the upstream kube-logging logging-operator ≥6.7.0 — air-gap-first. Rancher 2.11 through 2.15-dev all bundle a frozen operator 4.10.0 that is inside the affected range of CVE-2026-54680 (CVSS 9.9 config-injection RCE, no SUSE fix) — so the exit is security-urgent. Covers the maintainer-endorsed helm-release-secret strategy (near-zero gap; NOT `helm uninstall rancher-logging-crd`, which cascade-deletes every CR and the data plane), CR compatibility 4.10→6.7 (silent field pruning), server-side CRD apply (828KB CRDs), buffer-PVC preservation, air-gap image/chart mirroring, rollback, and stale-CRD debris cleanup.

DevOps & Infrastructure 3 stars 1 forks Updated yesterday MIT

Install

View on GitHub

Quality Score: 79/100

Stars 20%
20
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
80
License 10%
100
Description 5%
100

Skill Content

# rancher-logging-exit — Rancher-bundled → upstream logging-operator Migration reference, verified 2026-07-22. Target: **upstream ≥6.7.0** (6.6.0 fixes the CVE but breaks newline-containing passwords, #2254 — 6.7.0 has the corrected fix). Version matrix authority: `k8s-components-checker` `references/compat/rancher-logging.md`. Day-2 configuration of the migrated pipeline: the **logging-operator** skill. ## Why migrate (the honest urgency statement) - **Frozen**: every Rancher minor 2.11 → 2.14 (and 2.15-dev) ships the same upstream base **operator 4.10.0** (Oct 2024) — only `-rancher.N` chart respins. The `-rancher.N` fork is **chart-level only** (rancher/ob-team-charts); the operator image is a stock upstream mirror. "Wait for Rancher" has been dead for 20+ months of releases. - **CVE-2026-54680** (GHSA-mjqf-28ph-426h, CVSS 9.9): operator ≤6.5.2 renders CRD/secret values into fluent.conf unescaped — a newline in a Flow/Output field or referenced Secret injects arbitrary fluentd directives (`<match **> @type exec` ⇒ RCE in the aggregator). 4.10.0 is affected; the fix exists only on the 6.x line; **no SUSE fix exists as of 2026-07-22** (verified: SUSE CVE page 404, NVD reserved, Rancher advisories silent, no ob-team-charts logging commits post-CVE) and none CAN ship as a chart respin. - **Who can trigger it**: the chart aggregates a `logging-admin` ClusterRole (verbs `*` on flows/outputs) into the k8s `admin` role ⇒ **any Rancher project-owner**. Bl...

Details

Author
air-gapped
Repository
air-gapped/skills
Created
3 months ago
Last Updated
yesterday
Language
Python
License
MIT

Integrates with

Bundled in these plugins

Similar Skills

Semantically similar based on skill content — not just same category

AI & Automation Solid

rancher-upgrade

Plan and sequence COMMUNITY-edition Rancher upgrades across air-gapped multi-cluster fleets — a management/"hosting" Rancher cluster plus the downstream RKE2/K3s clusters it provisions. Covers the community release model (2.11→2.14, community-vs-Prime cadence, EOL), the Kontainer Driver Metadata (KDM) matrix deciding which downstream k8s minors each Rancher version can manage (and the stranding risk when a host-Rancher bump outruns its sub-clusters), cross-cluster upgrade ordering, the embedded-CAPI→Rancher-Turtles migration, Fleet coupling, cert-manager/Helm/backup prerequisites, backup- restore-operator + etcd rollback, and the air-gapped upgrade procedure (which images/charts/KDM to mirror). Assumes the Helm-on-Kubernetes install. Community editions only; Prime content excluded. Companion to k8s-components-checker, which owns the management-cluster k8s compatibility verdict; this skill owns the upgrade methodology and downstream coordination.

3 Updated yesterday
air-gapped
DevOps & Infrastructure Solid

logging-operator

Configure and operate the kube-logging logging-operator (formerly Banzai Cloud) on Kubernetes — the CRD-driven log pipeline: Fluent Bit collector → fluentd or syslog-ng aggregator → outputs. Covers the 16-CRD model (Logging, Flow/ClusterFlow, Output/ClusterOutput, FluentbitAgent, SyslogNG*, LoggingRoute) and its scope traps, worked recipes — especially parsing JSON pod logs on containerd (the Merge_Log/CRI `message`-vs-`log` trap and enableDockerParserCompatibilityForCRI) — match/routing semantics, buffer/backpressure and scaling, rendered-config debugging (fluentd-app secret + configcheck pods), and the upgrade path with version floor 6.7.0 (CVE-2026-54680 config-injection RCE).

3 Updated yesterday
air-gapped
DevOps & Infrastructure Solid

harvester-upgrade

Plan and run a controlled, COMMUNITY-edition Harvester HCI upgrade off an EOL line up to latest stable — the no-skip minor ladder (1.5→1.6→1.7→1.8; embedded RKE2/KubeVirt/Longhorn/SLE-Micro ride along), gated at each hop on first upgrading the EXTERNAL Rancher + a matching Harvester UI-extension (1.6↔Rancher 2.12, 1.7↔2.13, 1.8↔2.14). Covers air-gapped version detection, why node-upgrade order is NOT operator-choosable (forced serial; the pause knob is v1.7.0+ only) and how to protect VM-hosted control planes anyway via anti-affinity spread + N+1 live-migration, making self-managed RKE2 guests Harvester-aware (cloud-provider, CSI, qemu-guest-agent), per-hop breaking changes (wicked→NetworkManager, Intel NIC rename, DHCP IP churn), the enforced pre-flight health gates, and the no-downgrade backup/rollback reality. Companion to k8s-components-checker and rancher-upgrade.

3 Updated yesterday
air-gapped