Vector v0.47 in CLO 6.0

Dockerfile.macos-dev

@@ -0,0 +1,51 @@
+# Dev Dockerfile for building on Apple Silicon Macs.
+#
+# The original Dockerfile compiles Go inside the container, which requires
+# QEMU amd64 emulation on ARM Macs. QEMU crashes with segfaults during
+# `go mod download` (network syscall emulation issue). This Dockerfile skips
+# the in-container Go build and instead expects pre-built binaries at
+# bin/cluster-logging-operator and bin/must-gather, cross-compiled natively
+# on the host.
+#
+# Usage:
+#   GOOS=linux GOARCH=amd64 make build
+#   podman build -t $(IMAGE_TAG) . -f Dockerfile.macos-dev
+
+FROM registry.access.redhat.com/ubi9/ubi:latest AS packages
+
+RUN mkdir -p /mnt/rootfs && \
+    dnf install -y --installroot=/mnt/rootfs \
+      --releasever=9 \
+      --setopt=install_weak_deps=false \
+      --nodocs \
+      openssl-libs \
+      ca-certificates \
+      rsync \
+      file \
+      xz && \
+    dnf --installroot=/mnt/rootfs clean all && \
+    mkdir -p /mnt/rootfs/tmp/ocp-clo && \
+    chmod og+w /mnt/rootfs/tmp/ocp-clo
+
+FROM --platform=linux/amd64 registry.access.redhat.com/ubi9/ubi-micro
+
+COPY --from=packages /mnt/rootfs/ /
+COPY bin/cluster-logging-operator /usr/bin/
+COPY bin/must-gather /usr/bin/
+
+RUN ln -s /usr/bin/must-gather /usr/bin/gather
+
+USER 1000
+WORKDIR /usr/bin
+CMD ["/usr/bin/cluster-logging-operator"]
+
+LABEL \
+        io.k8s.display-name="Cluster Logging Operator" \
+        io.k8s.description="This is a component of OpenShift Container Platform that manages the lifecycle of the Aggregated logging stack." \
+        io.openshift.tags="openshift,logging" \
+        com.redhat.delivery.appregistry="false" \
+        maintainer="AOS Logging <team-logging@redhat.com>" \
+        License="Apache-2.0" \
+        name="openshift-logging/cluster-logging-rhel9-operator" \
+        com.redhat.component="cluster-logging-operator-container" \
+        io.openshift.maintainer.product="OpenShift Container Platform"

Makefile

@@ -46,7 +46,7 @@ export LOGGING_VERSION?=6.0
 export VERSION=$(LOGGING_VERSION).0
 export NAMESPACE?=openshift-logging
 
-IMAGE_LOGGING_VECTOR?=quay.io/openshift-logging/vector:v0.37.1
+IMAGE_LOGGING_VECTOR?=quay.io/openshift-logging/vector:v0.47.0
 IMAGE_LOGFILEMETRICEXPORTER?=quay.io/openshift-logging/log-file-metric-exporter:6.0
 IMAGE_LOGGING_EVENTROUTER?=quay.io/openshift-logging/eventrouter:0.3
 endif # ifdef OVERLAY
@@ -173,10 +173,16 @@ clean:
 spotless: clean
 	go clean -cache -testcache
 
+ifeq ($(shell uname -sm),Darwin arm64)
+DOCKERFILE?=Dockerfile.macos-dev
+else
+DOCKERFILE?=Dockerfile
+endif
+
 .PHONY: image
 image: .target/image
-.target/image: .target $(GEN_TIMESTAMP) $(shell find must-gather version bundle .bingo api internal -type f 2>/dev/null) Dockerfile  go.mod go.sum
-	podman build -t $(IMAGE_TAG) . -f Dockerfile
+.target/image: .target $(GEN_TIMESTAMP) $(shell find must-gather version bundle .bingo api internal -type f 2>/dev/null) $(DOCKERFILE)  go.mod go.sum
+	podman build -t $(IMAGE_TAG) . -f $(DOCKERFILE)
 	touch $@
 
 # Notes:

bundle/image-references

@@ -6,7 +6,7 @@ spec:
   - name: vector-rhel9
     from:
       kind: DockerImage
-      name: quay.io/openshift-logging/vector:v0.37.1
+      name: quay.io/openshift-logging/vector:v0.47.0
   - name: log-file-metric-exporter-rhel9
     from:
       kind: DockerImage

bundle/manifests/cluster-logging.clusterserviceversion.yaml

@@ -82,7 +82,7 @@ metadata:
     categories: OpenShift Optional, Logging & Tracing
     certified: "false"
     containerImage: quay.io/openshift-logging/cluster-logging-operator:latest
-    createdAt: "2026-02-05T14:25:39Z"
+    createdAt: "2026-09-04T15:15:04Z"
     description: The Red Hat OpenShift Logging Operator for OCP provides a means for
       configuring and managing log collection and forwarding.
     features.operators.openshift.io/cnf: "false"
@@ -2000,7 +2000,7 @@ spec:
                 - name: OPERATOR_NAME
                   value: cluster-logging-operator
                 - name: RELATED_IMAGE_VECTOR
-                  value: quay.io/openshift-logging/vector:v0.37.1
+                  value: quay.io/openshift-logging/vector:v0.47.0
                 - name: RELATED_IMAGE_LOG_FILE_METRIC_EXPORTER
                   value: quay.io/openshift-logging/log-file-metric-exporter:6.0
                 image: quay.io/openshift-logging/cluster-logging-operator:latest
@@ -2047,7 +2047,7 @@ spec:
   provider:
     name: Red Hat
   relatedImages:
-  - image: quay.io/openshift-logging/vector:v0.37.1
+  - image: quay.io/openshift-logging/vector:v0.47.0
     name: vector
   - image: quay.io/openshift-logging/log-file-metric-exporter:6.0
     name: log-file-metric-exporter

config/manager/manager.yaml

@@ -46,6 +46,6 @@ spec:
           - name: OPERATOR_NAME
             value: "cluster-logging-operator"
           - name: RELATED_IMAGE_VECTOR
-            value: quay.io/openshift-logging/vector:v0.37.1
+            value: quay.io/openshift-logging/vector:v0.47.0
           - name: RELATED_IMAGE_LOG_FILE_METRIC_EXPORTER
             value: quay.io/openshift-logging/log-file-metric-exporter:6.0

config/overlays/stable/deployment_patch.yaml

@@ -15,7 +15,7 @@ spec:
           env:
             # EDIT HERE: change the 'value' fields to the related images you want to use.
             - name: RELATED_IMAGE_VECTOR
-              value: quay.io/openshift-logging/vector:v0.37.1
+              value: quay.io/openshift-logging/vector:v0.47.0
             - name: RELATED_IMAGE_FLUENTD
               value: quay.io/openshift-logging/fluentd:5.9.0
             - name: RELATED_IMAGE_LOG_FILE_METRIC_EXPORTER

hack/deploy-image.sh

@@ -1,18 +1,35 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 set -euo pipefail
 
 echo "Setting up port-forwarding to remote registry ..."
-coproc oc -n openshift-image-registry port-forward service/image-registry 5000:5000
+coproc oc -n openshift-image-registry port-forward --address 0.0.0.0 service/image-registry 5000:5000
 trap "kill -15 $COPROC_PID" EXIT
 read PORT_FORWARD_STDOUT <&"${COPROC[0]}"
 if [[ "$PORT_FORWARD_STDOUT" =~ ^Forwarding.*5000$ ]] ; then
+    # On macOS, podman runs in a VM and can't reach host's 127.0.0.1.
+    # Use host.containers.internal to reach the host from the VM.
+    if [[ "$(uname -s)" == "Darwin" ]]; then
+        REGISTRY_HOST="host.containers.internal"
+    else
+        REGISTRY_HOST="127.0.0.1"
+    fi
+
     user=$(oc whoami | sed s/://)
+    token=$(oc whoami -t)
     echo "Login to registry..."
-    podman login --tls-verify=false -u ${user} -p $(oc whoami -t) 127.0.0.1:5000
+    podman login --tls-verify=false -u ${user} -p ${token} 127.0.0.1:5000
+    if [[ "$(uname -s)" == "Darwin" ]]; then
+        # Copy auth entry so push inside the VM can authenticate via host.containers.internal
+        AUTH_FILE="${XDG_RUNTIME_DIR:-${HOME}/.config}/containers/auth.json"
+        if [[ -f "${AUTH_FILE}" ]]; then
+            jq '.auths["host.containers.internal:5000"] = .auths["127.0.0.1:5000"]' "${AUTH_FILE}" > "${AUTH_FILE}.tmp" && mv "${AUTH_FILE}.tmp" "${AUTH_FILE}"
+        fi
+    fi
 
-    echo "Pushing image ${IMAGE_TAG} ..."
-    if podman push --tls-verify=false ${IMAGE_TAG} ; then
+    PUSH_TAG="${IMAGE_TAG/127.0.0.1/${REGISTRY_HOST}}"
+    echo "Pushing image ${IMAGE_TAG} to ${PUSH_TAG} ..."
+    if podman push --tls-verify=false ${IMAGE_TAG} ${PUSH_TAG} ; then
         oc -n openshift get imagestreams | grep cluster-logging-operator
     fi
 else

hack/generate-bundle.sh

@@ -1,4 +1,4 @@
-#!/usr/bin/bash
+#!/usr/bin/env bash
 
 source .bingo/variables.env
 

hack/get-openshift-client.sh

@@ -1,4 +1,4 @@
-#!/usr/bin/bash
+#!/usr/bin/env bash
 # Download latest release of openshift-client, intended for use by ../Makefile
 
 set -e

hack/revert-bundle.sh

@@ -1,4 +1,4 @@
-#!/usr/bin/bash
+#!/usr/bin/env bash
 
 git diff --no-ext-diff --quiet -I'^    createdAt: ' bundle/manifests/cluster-logging.clusterserviceversion.yaml
 if ((! $?)) ; then

hack/run-linter

@@ -1,4 +1,4 @@
-#!/usr/bin/sh
+#!/usr/bin/env bash
 
 set -euo pipefail
 

internal/cmd/functional-benchmarker/config/options.go

@@ -17,7 +17,7 @@ import (
 
 const (
 	LogStressorImage = "quay.io/openshift-logging/cluster-logging-load-client:0.2"
-	imageVector      = "quay.io/openshift-logging/vector:v0.37.1"
+	imageVector      = "quay.io/openshift-logging/vector:v0.47.0"
 )
 
 type Options struct {

internal/generator/vector/conf/complex.toml

@@ -6,8 +6,8 @@ enabled = true
 
 # Load sensitive data from files
 [secret.kubernetes_secret]
-type = "file"
-base_path = "/var/run/ocp-collector/secrets"
+type = "directory"
+path = "/var/run/ocp-collector/secrets"
 
 [sources.internal_metrics]
 type = "internal_metrics"

internal/generator/vector/conf/complex_http_receiver.toml

@@ -6,8 +6,8 @@ enabled = true
 
 # Load sensitive data from files
 [secret.kubernetes_secret]
-type = "file"
-base_path = "/var/run/ocp-collector/secrets"
+type = "directory"
+path = "/var/run/ocp-collector/secrets"
 
 [sources.internal_metrics]
 type = "internal_metrics"

internal/generator/vector/conf/container.toml

@@ -6,8 +6,8 @@ enabled = true
 
 # Load sensitive data from files
 [secret.kubernetes_secret]
-type = "file"
-base_path = "/var/run/ocp-collector/secrets"
+type = "directory"
+path = "/var/run/ocp-collector/secrets"
 
 [sources.internal_metrics]
 type = "internal_metrics"

internal/generator/vector/conf/global_test.go

@@ -21,8 +21,8 @@ enabled = true
 
 # Load sensitive data from files
 [secret.kubernetes_secret]
-type = "file"
-base_path = "/var/run/ocp-collector/secrets"
+type = "directory"
+path = "/var/run/ocp-collector/secrets"
 `,
 			).To(EqualConfigFrom(Global(constants.OpenshiftNS, "my-forwarder")))
 		})
@@ -37,8 +37,8 @@ enabled = true
 
 # Load sensitive data from files
 [secret.kubernetes_secret]
-type = "file"
-base_path = "/var/run/ocp-collector/secrets"
+type = "directory"
+path = "/var/run/ocp-collector/secrets"
 `,
 			).To(EqualConfigFrom(Global(constants.OpenshiftNS, constants.SingletonName)))
 

internal/generator/vector/output/common/secret.go

@@ -20,8 +20,8 @@ func (sec VectorSecret) Template() string {
 	return `{{define "` + sec.Name() + `" -}}
 # {{.Desc}}
 [secret.{{.ComponentID}}]
-type = "file"
-base_path = "{{.BasePath}}"
+type = "directory"
+path = "{{.BasePath}}"
 {{end}}`
 }
 

internal/generator/vector/output/kafka/kafka_tuning.toml

@@ -24,4 +24,4 @@ max_bytes = 10000000
 [sinks.kafka_receiver.buffer]
 type = "disk"
 when_full = "block"
-max_size = 268435488
+max_size = 268435488

internal/generator/vector/output/syslog/rfc3164_with_defaults.toml

@@ -7,13 +7,18 @@ if .log_type == "infrastructure" && .log_source == "node" {
    ._syslog.proc_id = to_string!(.systemd.t.PID || "")
 }
 if .log_source == "container" {
-   	._syslog.tag = join!([.kubernetes.namespace_name, .kubernetes.pod_name, .kubernetes.container_name], "")
-   	#Remove non-alphanumeric characters
-   	._syslog.tag = replace(._syslog.tag, r'[^a-zA-Z0-9]', "")
-	#Truncate the sanitized tag to 32 characters
-	._syslog.tag = truncate(._syslog.tag, 32)
-   	._syslog.severity = .level
-   	._syslog.facility = "user"
+   	._syslog.tag, err = join([.kubernetes.namespace_name, .kubernetes.pod_name, .kubernetes.container_name], "")
+   	if err != null {
+   	   log("K8s metadata (namespace, pod, or container) missing; syslog.tag set to empty", level: "error")
+  	   ._syslog.tag = ""
+    } else {
+       #Remove non-alphanumeric characters
+       ._syslog.tag = replace(._syslog.tag, r'[^a-zA-Z0-9]', "")
+       #Truncate the sanitized tag to 32 characters
+       ._syslog.tag = truncate(._syslog.tag, 32)
+    }
+    ._syslog.severity = .level
+    ._syslog.facility = "user"
 }
 if .log_type == "audit" {
    ._syslog.tag = .log_source

internal/generator/vector/output/syslog/syslog.go

@@ -40,15 +40,25 @@ const (
 	nodeProcIdRFC5424 = `._syslog.proc_id = to_string!(.systemd.t.PID || "-")`
 
 	// Default values for Syslog fields for application logType and infrastructure logType if source 'container'
-	containerAppName  = `._syslog.app_name = join!([.kubernetes.namespace_name, .kubernetes.pod_name, .kubernetes.container_name], "_")`
+	containerAppName = `._syslog.app_name, err = join([.kubernetes.namespace_name, .kubernetes.pod_name, .kubernetes.container_name], "_")
+if err != null {
+  log("K8s metadata (namespace, pod, or container) missing; syslog.appname set to '-'", level: "error")
+  ._syslog.app_name = "-"
+}
+`
 	containerFacility = `._syslog.facility = "user"`
 	containerSeverity = `._syslog.severity = .level`
 	containerProcId   = `._syslog.proc_id = to_string!(.kubernetes.pod_id || "-")`
-	containerTag      = `._syslog.tag = join!([.kubernetes.namespace_name, .kubernetes.pod_name, .kubernetes.container_name], "")
-#Remove non-alphanumeric characters
-._syslog.tag = replace(._syslog.tag, r'[^a-zA-Z0-9]', "")
-#Truncate the sanitized tag to 32 characters
-._syslog.tag = truncate(._syslog.tag, 32)
+	containerTag      = `._syslog.tag, err = join([.kubernetes.namespace_name, .kubernetes.pod_name, .kubernetes.container_name], "")
+if err != null {
+  log("K8s metadata (namespace, pod, or container) missing; syslog.tag set to empty", level: "error")
+  ._syslog.tag = ""
+} else {
+  #Remove non-alphanumeric characters
+  ._syslog.tag = replace(._syslog.tag, r'[^a-zA-Z0-9]', "")
+  #Truncate the sanitized tag to 32 characters
+  ._syslog.tag = truncate(._syslog.tag, 32)
+}
 `
 
 	// Default values for Syslog fields for audit logType
@@ -85,6 +95,9 @@ type = "socket"
 inputs = {{.Inputs}}
 address = "{{.Address}}"
 mode = "{{.Mode}}"
+{{if eq .Mode "tcp"}}
+keepalive.time_secs = 60
+{{end}}
 {{end}}`
 }
 

internal/generator/vector/output/syslog/tcp_with_defaults.toml

@@ -8,7 +8,11 @@ if .log_type == "infrastructure" && .log_source == "node" {
     ._syslog.proc_id = to_string!(.systemd.t.PID || "-")
 }
 if .log_source == "container" {
-   ._syslog.app_name = join!([.kubernetes.namespace_name, .kubernetes.pod_name, .kubernetes.container_name], "_")
+   ._syslog.app_name, err = join([.kubernetes.namespace_name, .kubernetes.pod_name, .kubernetes.container_name], "_")
+   if err != null {
+     log("K8s metadata (namespace, pod, or container) missing; syslog.appname set to '-'", level: "error")
+  	 ._syslog.app_name = "-"
+   }
    ._syslog.proc_id = to_string!(.kubernetes.pod_id || "-")
    ._syslog.severity = .level
    ._syslog.facility = "user"
@@ -26,6 +30,7 @@ type = "socket"
 inputs = ["example_parse_encoding"]
 address = "logserver:514"
 mode = "tcp"
+keepalive.time_secs = 60
 
 [sinks.example.encoding]
 codec = "syslog"

internal/generator/vector/output/syslog/tcp_with_tuning.toml

@@ -9,7 +9,11 @@ if .log_type == "infrastructure" && .log_source == "node" {
     ._syslog.proc_id = to_string!(.systemd.t.PID || "-")
 }
 if .log_source == "container" {
-   ._syslog.app_name = join!([.kubernetes.namespace_name, .kubernetes.pod_name, .kubernetes.container_name], "_")
+   ._syslog.app_name, err = join([.kubernetes.namespace_name, .kubernetes.pod_name, .kubernetes.container_name], "_")
+   if err != null {
+     log("K8s metadata (namespace, pod, or container) missing; syslog.appname set to '-'", level: "error")
+  	 ._syslog.app_name = "-"
+   }
    ._syslog.proc_id = to_string!(.kubernetes.pod_id || "-")
    ._syslog.severity = .level
    ._syslog.facility = "user"
@@ -27,6 +31,7 @@ type = "socket"
 inputs = ["example_parse_encoding"]
 address = "logserver:514"
 mode = "tcp"
+keepalive.time_secs = 60
 
 [sinks.example.encoding]
 codec = "syslog"

internal/generator/vector/output/syslog/tls_with_field_references.toml

@@ -21,6 +21,7 @@ type = "socket"
 inputs = ["example_parse_encoding"]
 address = "logserver:6514"
 mode = "tcp"
+keepalive.time_secs = 60
 
 [sinks.example.encoding]
 codec = "syslog"