From e5218e12501f50cd1e1880758346745313a11b1b Mon Sep 17 00:00:00 2001 From: ramisettyhp Date: Thu, 11 Jun 2026 12:26:46 +0530 Subject: [PATCH 1/4] JOBS-2480: bump fluentd sidecar image to 4.20 (Helm values + CHANGELOG) Pairs with the Echo base Dockerfile change (PR #91). Merge only after fluentd:4.20 is promoted to releases-docker.jfrog.io (JOBS-2478). --- CHANGELOG.md | 5 +++++ helm/artifactory-ha-values.yaml | 2 +- helm/artifactory-values.yaml | 2 +- helm/xray-values.yaml | 2 +- 4 files changed, 8 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ffd99a8..e2bf9d0 100755 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,11 @@ All changes to the log analytics integration will be documented in this file. +## [1.0.16] - June 2026 + +* Fluentd sidecar image bumped to 4.20: migrated to Echo secure base (fluentd 1.19.2, Debian 13), remediating Critical/High CVEs in 4.19 (JOBS-2475) +* Pinned fluent-plugin-jfrog-metrics ~> 0.2.17 + ## [1.0.15] - April 2026 * Fix incorrect field name in access-security-audit log parsing: renamed `token_id` capture group to `trace_id` to match the actual log format documented at https://docs.jfrog.com/administration/docs/audit-trail-log (JOBS-2031) diff --git a/helm/artifactory-ha-values.yaml b/helm/artifactory-ha-values.yaml index 20ffeeb..ab4f1a7 100644 --- a/helm/artifactory-ha-values.yaml +++ b/helm/artifactory-ha-values.yaml @@ -18,7 +18,7 @@ artifactory: name: volume customSidecarContainers: | - name: "artifactory-fluentd-sidecar" - image: "releases-docker.jfrog.io/fluentd:4.19" + image: "releases-docker.jfrog.io/fluentd:4.20" imagePullPolicy: "IfNotPresent" volumeMounts: - mountPath: "{{ .Values.artifactory.persistence.mountPath }}" diff --git a/helm/artifactory-values.yaml b/helm/artifactory-values.yaml index 91ac97d..e867939 100644 --- a/helm/artifactory-values.yaml +++ b/helm/artifactory-values.yaml @@ -18,7 +18,7 @@ artifactory: name: artifactory-volume customSidecarContainers: | - name: "artifactory-fluentd-sidecar" - image: "releases-docker.jfrog.io/fluentd:4.19" + image: "releases-docker.jfrog.io/fluentd:4.20" imagePullPolicy: "IfNotPresent" volumeMounts: - mountPath: "{{ .Values.artifactory.persistence.mountPath }}" diff --git a/helm/xray-values.yaml b/helm/xray-values.yaml index d9bd5f9..9359b9e 100644 --- a/helm/xray-values.yaml +++ b/helm/xray-values.yaml @@ -19,7 +19,7 @@ common: name: data-volume customSidecarContainers: | - name: "xray-platform-fluentd-sidecar" - image: "releases-docker.jfrog.io/fluentd:4.19" + image: "releases-docker.jfrog.io/fluentd:4.20" imagePullPolicy: "IfNotPresent" volumeMounts: - mountPath: "{{ .Values.xray.persistence.mountPath }}" From f8114d3cbdf1ea4eeefea09c3dc306a3c152e583 Mon Sep 17 00:00:00 2001 From: ramisettyhp Date: Thu, 11 Jun 2026 16:45:11 +0530 Subject: [PATCH 2/4] JOBS-2480: migrate docker-build Dockerfile to Echo secure base Mirror the datadog JOBS-2475 migration on the standalone build-your-own-image path so it matches the CHANGELOG 1.0.16 entry: - bitnami/fluentd:1.18.0 -> reg.echohq.com/fluentd:1.19.2 (fluentd 1.19.2) - consolidate plugin installs into one layer; pin fluent-plugin-jfrog-metrics ~> 0.2.17 - apt: --no-install-recommends + clean lists - write config to /fluentd/etc/fluent.conf and rely on the base image entrypoint (tini -- /bin/entrypoint.sh fluentd) - run as USER fluent (uid 999) instead of bitnami uid 1001 Remediates the Critical/High CVEs for customers who build the splunk sidecar image directly. K8s users already get Echo via the shared 4.20 image referenced by the Helm values. --- docker-build/Dockerfile | 33 ++++++++++++++++----------------- 1 file changed, 16 insertions(+), 17 deletions(-) diff --git a/docker-build/Dockerfile b/docker-build/Dockerfile index f57990c..c6719cc 100644 --- a/docker-build/Dockerfile +++ b/docker-build/Dockerfile @@ -1,5 +1,5 @@ -# Dockerfile for bitnami/fluentd sidecar image with all the necessary plugins for our log analytic providers -FROM bitnami/fluentd:1.18.0 +# Dockerfile for fluentd sidecar image with all the necessary plugins for our log analytic providers +FROM reg.echohq.com/fluentd:1.19.2 LABEL maintainer="Partner Engineering " ## Build time Arguments, short circuit them to ENV Variables so they are available at run time also @@ -13,23 +13,22 @@ ENV TGT_PLATFORM=$TARGET USER root -## Install JFrog Plugins -RUN fluent-gem install fluent-plugin-concat -RUN fluent-gem install fluent-plugin-splunk-hec -RUN fluent-gem install fluent-plugin-jfrog-siem -RUN fluent-gem install fluent-plugin-jfrog-metrics -RUN fluent-gem install fluent-plugin-jfrog-send-metrics - # Install prerequisites -RUN apt-get update && apt-get install -y curl -CMD /bin/bash +RUN apt-get update && \ + apt-get install -y --no-install-recommends curl && \ + rm -rf /var/lib/apt/lists/* -## Download Config Files -RUN if [ "$SRC_PLATFORM" = "JFRT" ] ; then echo "Downloading the fluentd config file for $SRC_PLATFORM and $TGT_PLATFORM "; curl https://raw.githubusercontent.com/jfrog/log-analytics-splunk/master/fluent.conf.rt -o /opt/bitnami/fluentd/conf/fluentd.conf; else echo "Not Downloading"; fi -RUN if [ "$SRC_PLATFORM" = "JFXRAY" ] ; then echo "Downloading the fluentd config file for $SRC_PLATFORM and $TGT_PLATFORM "; curl https://raw.githubusercontent.com/jfrog/log-analytics-splunk/master/fluent.conf.xray -o /opt/bitnami/fluentd/conf/fluentd.conf; else echo "Not Downloading"; fi +## Install JFrog Plugins +RUN fluent-gem install fluent-plugin-concat && \ + fluent-gem install fluent-plugin-splunk-hec && \ + fluent-gem install fluent-plugin-jfrog-siem && \ + fluent-gem install fluent-plugin-jfrog-metrics -v '~> 0.2.17' && \ + fluent-gem install fluent-plugin-jfrog-send-metrics -ENTRYPOINT if [ "$TGT_PLATFORM" = "SPLUNK" ] ; then cat /opt/bitnami/fluentd/conf/fluentd.conf; fluentd -v -c /opt/bitnami/fluentd/conf/fluentd.conf; fi +## Download Config Files +RUN if [ "$SRC_PLATFORM" = "JFRT" ] ; then curl -fsSL https://raw.githubusercontent.com/jfrog/log-analytics-splunk/master/fluent.conf.rt -o /fluentd/etc/fluent.conf; fi +RUN if [ "$SRC_PLATFORM" = "JFXRAY" ] ; then curl -fsSL https://raw.githubusercontent.com/jfrog/log-analytics-splunk/master/fluent.conf.xray -o /fluentd/etc/fluent.conf; fi -USER 1001 +USER fluent -STOPSIGNAL SIGTERM \ No newline at end of file +STOPSIGNAL SIGTERM From 7781dedfe608c9f1d386037704bd6433b2c58180 Mon Sep 17 00:00:00 2001 From: ramisettyhp Date: Fri, 12 Jun 2026 11:46:40 +0530 Subject: [PATCH 3/4] JOBS-2480: remove fluent-plugin-jfrog-metrics version pin (install latest) The Echo migration pinned fluent-plugin-jfrog-metrics to '~> 0.2.17', but the other plugins in this image and the shared buildx image install it unpinned. The config only requires >= 0.2.16, and 0.2.17 is currently the latest release, so dropping the cap installs the same version today while no longer blocking future updates. --- docker-build/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker-build/Dockerfile b/docker-build/Dockerfile index c6719cc..0b2c604 100644 --- a/docker-build/Dockerfile +++ b/docker-build/Dockerfile @@ -22,7 +22,7 @@ RUN apt-get update && \ RUN fluent-gem install fluent-plugin-concat && \ fluent-gem install fluent-plugin-splunk-hec && \ fluent-gem install fluent-plugin-jfrog-siem && \ - fluent-gem install fluent-plugin-jfrog-metrics -v '~> 0.2.17' && \ + fluent-gem install fluent-plugin-jfrog-metrics && \ fluent-gem install fluent-plugin-jfrog-send-metrics ## Download Config Files From b393d05cdd250263ffccb0c5ddf55833ca64986f Mon Sep 17 00:00:00 2001 From: ramisettyhp Date: Fri, 12 Jun 2026 12:38:08 +0530 Subject: [PATCH 4/4] JOBS-2480: scope PR to Helm 4.20 bump (move Dockerfile change to #91) The Echo base Dockerfile migration belongs in the Dockerfile-only PR #91 (JOBS-2477); keeping it here too duplicated the change. Restore docker-build/Dockerfile to master so this PR only bumps the Helm sidecar image 4.19 -> 4.20 (+ CHANGELOG). Also drop the now-inaccurate "pinned ~> 0.2.17" CHANGELOG line (the pin was removed in #91). --- CHANGELOG.md | 1 - docker-build/Dockerfile | 33 +++++++++++++++++---------------- 2 files changed, 17 insertions(+), 17 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e2bf9d0..eab06a3 100755 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,7 +5,6 @@ All changes to the log analytics integration will be documented in this file. ## [1.0.16] - June 2026 * Fluentd sidecar image bumped to 4.20: migrated to Echo secure base (fluentd 1.19.2, Debian 13), remediating Critical/High CVEs in 4.19 (JOBS-2475) -* Pinned fluent-plugin-jfrog-metrics ~> 0.2.17 ## [1.0.15] - April 2026 diff --git a/docker-build/Dockerfile b/docker-build/Dockerfile index 0b2c604..f57990c 100644 --- a/docker-build/Dockerfile +++ b/docker-build/Dockerfile @@ -1,5 +1,5 @@ -# Dockerfile for fluentd sidecar image with all the necessary plugins for our log analytic providers -FROM reg.echohq.com/fluentd:1.19.2 +# Dockerfile for bitnami/fluentd sidecar image with all the necessary plugins for our log analytic providers +FROM bitnami/fluentd:1.18.0 LABEL maintainer="Partner Engineering " ## Build time Arguments, short circuit them to ENV Variables so they are available at run time also @@ -13,22 +13,23 @@ ENV TGT_PLATFORM=$TARGET USER root -# Install prerequisites -RUN apt-get update && \ - apt-get install -y --no-install-recommends curl && \ - rm -rf /var/lib/apt/lists/* - ## Install JFrog Plugins -RUN fluent-gem install fluent-plugin-concat && \ - fluent-gem install fluent-plugin-splunk-hec && \ - fluent-gem install fluent-plugin-jfrog-siem && \ - fluent-gem install fluent-plugin-jfrog-metrics && \ - fluent-gem install fluent-plugin-jfrog-send-metrics +RUN fluent-gem install fluent-plugin-concat +RUN fluent-gem install fluent-plugin-splunk-hec +RUN fluent-gem install fluent-plugin-jfrog-siem +RUN fluent-gem install fluent-plugin-jfrog-metrics +RUN fluent-gem install fluent-plugin-jfrog-send-metrics + +# Install prerequisites +RUN apt-get update && apt-get install -y curl +CMD /bin/bash ## Download Config Files -RUN if [ "$SRC_PLATFORM" = "JFRT" ] ; then curl -fsSL https://raw.githubusercontent.com/jfrog/log-analytics-splunk/master/fluent.conf.rt -o /fluentd/etc/fluent.conf; fi -RUN if [ "$SRC_PLATFORM" = "JFXRAY" ] ; then curl -fsSL https://raw.githubusercontent.com/jfrog/log-analytics-splunk/master/fluent.conf.xray -o /fluentd/etc/fluent.conf; fi +RUN if [ "$SRC_PLATFORM" = "JFRT" ] ; then echo "Downloading the fluentd config file for $SRC_PLATFORM and $TGT_PLATFORM "; curl https://raw.githubusercontent.com/jfrog/log-analytics-splunk/master/fluent.conf.rt -o /opt/bitnami/fluentd/conf/fluentd.conf; else echo "Not Downloading"; fi +RUN if [ "$SRC_PLATFORM" = "JFXRAY" ] ; then echo "Downloading the fluentd config file for $SRC_PLATFORM and $TGT_PLATFORM "; curl https://raw.githubusercontent.com/jfrog/log-analytics-splunk/master/fluent.conf.xray -o /opt/bitnami/fluentd/conf/fluentd.conf; else echo "Not Downloading"; fi + +ENTRYPOINT if [ "$TGT_PLATFORM" = "SPLUNK" ] ; then cat /opt/bitnami/fluentd/conf/fluentd.conf; fluentd -v -c /opt/bitnami/fluentd/conf/fluentd.conf; fi -USER fluent +USER 1001 -STOPSIGNAL SIGTERM +STOPSIGNAL SIGTERM \ No newline at end of file