rancher-logging-exitlisted

Migrate off the Rancher-bundled `rancher-logging` chart (cattle-logging-system, rancher/mirrored-kube-logging-* images) to the upstream kube-logging logging-operator ≥6.7.0 — air-gap-first. Rancher 2.11 through 2.15-dev all bundle a frozen operator 4.10.0 that is inside the affected range of CVE-2026-54680 (CVSS 9.9 config-injection RCE, no SUSE fix) — so the exit is security-urgent. Covers the maintainer-endorsed helm-release-secret strategy (near-zero gap; NOT `helm uninstall rancher-logging-crd`, which cascade-deletes every CR and the data plane), CR compatibility 4.10→6.7 (silent field pruning), server-side CRD apply (828KB CRDs), buffer-PVC preservation, air-gap image/chart mirroring, rollback, and stale-CRD debris cleanup.
air-gapped/skills · ★ 5 · DevOps & Infrastructure · score 78

Install: claude install-skill air-gapped/skills

# rancher-logging-exit — Rancher-bundled → upstream logging-operator Migration reference, verified 2026-07-22. Target: **upstream ≥6.7.0** (6.6.0 fixes the CVE but breaks newline-containing passwords, #2254 — 6.7.0 has the corrected fix). Version matrix authority: `k8s-components-checker` `references/compat/rancher-logging.md`. Day-2 configuration of the migrated pipeline: the **logging-operator** skill. ## Why migrate (the honest urgency statement) - **Frozen**: every Rancher minor 2.11 → 2.14 (and 2.15-dev) ships the same upstream base **operator 4.10.0** (Oct 2024) — only `-rancher.N` chart respins. The `-rancher.N` fork is **chart-level only** (rancher/ob-team-charts); the operator image is a stock upstream mirror. "Wait for Rancher" has been dead for 20+ months of releases. - **CVE-2026-54680** (GHSA-mjqf-28ph-426h, CVSS 9.9): operator ≤6.5.2 renders CRD/secret values into fluent.conf unescaped — a newline in a Flow/Output field or referenced Secret injects arbitrary fluentd directives (`<match **> @type exec` ⇒ RCE in the aggregator). 4.10.0 is affected; the fix exists only on the 6.x line; **no SUSE fix exists as of 2026-07-22** (verified: SUSE CVE page 404, NVD reserved, Rancher advisories silent, no ob-team-charts logging commits post-CVE) and none CAN ship as a chart respin. - **Who can trigger it**: the chart aggregates a `logging-admin` ClusterRole (verbs `*` on flows/outputs) into the k8s `admin` role ⇒ **any Rancher project-owner**. Bl