logcollector: give fluent-bit its own trusted bundle; user CA for Splunk HEC

[hjiawei]

Description

Bug fix plus a small follow-on feature for the fluent-bit log collector, in two commits:

1. Render fluent-bit's trusted bundle under its own name (bug fix, cherry-pick candidate)

The fluentd→fluent-bit migration moved the log collector into calico-system but kept rendering its trusted bundle as tigera-ca-bundle — the same ConfigMap the core Installation controller renders there with a different certificate set. The component handler replaces ConfigMap data wholesale and flips the controllerRef on every write, so the two controllers overwrite each other and the additions only the logcollector makes (the syslog-ca user CA, BYO prometheus/linseed certs) were lost to whichever reconcile ran last. Net effect: syslog forwarding over TLS with a user-supplied CA never worked — fluent-bit failed certificate verify failed because the CA never persisted in the bundle it mounts. Pre-migration there was no collision because fluentd's bundle lived in tigera-fluentd.

The fix follows the pattern of the other components sharing calico-system (calico-manager-ca-bundle, whisker-ca-bundle, policy-recommendation-ca-bundle): a named bundle, calico-fluent-bit-ca-bundle-system-certs. Mount directory and data keys are unchanged, so the rendered fluent-bit configuration is byte-identical; only the DaemonSet volume reference changes (one DaemonSet roll on upgrade).

2. User CA for Splunk HEC + watch the CA ConfigMaps (feature)

The Splunk output already verifies https HEC endpoints against the trusted bundle, but nothing could put a private CA there — a self-hosted Splunk with a self-signed certificate was unusable since the splunk-public-certificate secret was removed (#2545). Accept one the same way syslog does: a splunk-ca ConfigMap in tigera-operator (key tls.crt), folded into fluent-bit's bundle. The controller also now watches the syslog-ca/splunk-ca ConfigMaps, so creating or rotating a CA takes effect immediately instead of waiting for an unrelated reconcile.

Testing

• New regression tests: the bundle CM name and syslog CA content, the shared tigera-ca-bundle no longer rendered by this controller, and the Splunk CA path; render suites updated to the named bundle. Rendered-config goldens are unchanged by design.
• Validated live on an Enterprise dev cluster (Linux + Windows nodes): with this change the syslog user CA persists in the mounted bundle and the calico-private TLS syslog e2e passes end to end (53s), and the Splunk e2e forwards flow logs to an https HEC endpoint serving Splunk's self-signed certificate via splunk-ca (5m10s). Companion calico-private e2e changes (Splunk TLS mode) and a docs update for splunk-ca (Update log collector docs for the fluentd to fluent-bit migration (EV-6164) docs#2815) follow.

Part of the fluent-bit migration epic (EV-6164/EV-6684).

Release Note

- Splunk HTTP Event Collector endpoints with a custom CA are supported via the splunk-ca ConfigMap.

For PR author

• Tests for change.
• If changing pkg/apis/, run make gen-files
• If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

• Milestone set according to targeted release.
• Appropriate labels:
  • kind/bug if this PR fixes a bug

🤖 Generated with Claude Code

[pasanw]

We should consider gating on whether this is an HTTPS connection (like we do above for Syslog)

[hjiawei]

Done — the CA is now loaded only for https endpoints, parsed with url.ParseEndpoint the same way the render decides TLS for the splunk output, plus a test that an http endpoint leaves the CA out of the bundle. (Syslog keeps its encryption: TLS gate since TLS-ness there is a field, not the scheme.)

[pasanw]

Two thoughts (unrelated to line)

• The release note on the PR description should not have the line about the bundle rename
• Let's make sure we track the docs changes needed for this CA feature

[hjiawei]

Both done:

• Release note trimmed to the splunk-ca line only.
• Docs for the CA feature are already written on the tigera/docs migration branch (EV-6164-fluent-bit-docs, PR Update log collector docs for the fluentd to fluent-bit migration (EV-6164) docs#2815): commit 9618b8600 adds a splunk-ca step to the Splunk archiving instructions (mirroring the syslog-ca step) and a release-notes line. That docs PR should land with this one.

[Copilot]

Pull request overview

This PR updates the LogCollector (fluent-bit) reconciliation/rendering so fluent-bit uses its own named trusted CA bundle (avoiding collisions with the shared tigera-ca-bundle in calico-system), and adds support for a user-provided CA for Splunk HEC TLS via a splunk-ca ConfigMap (plus watches for immediate reconciliation on CA rotation).

Changes:

• Switch fluent-bit to a component-specific named trusted bundle (calico-fluent-bit-ca-bundle-system-certs) instead of the shared tigera-ca-bundle.
• Add optional splunk-ca user CA support (loaded only for https Splunk endpoints) and watch syslog-ca / splunk-ca ConfigMaps for faster propagation.
• Update rendering and controller tests to validate the new bundle name and CA-injection behavior.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
pkg/render/logcollector/rendered_config_test.go	Updates rendered-config golden test setup to use a named trusted bundle for fluent-bit.
pkg/render/logcollector/logcollector.go	Introduces SplunkCAConfigMapName constant for the new user CA ConfigMap.
pkg/render/logcollector/fluentbit_test.go	Updates fluent-bit rendering tests to expect the new named bundle volume.
pkg/controller/logcollector/logcollector_controller.go	Switches to a named trusted bundle, adds watches for user CA ConfigMaps, and loads optional Splunk CA for https endpoints.
pkg/controller/logcollector/logcollector_controller_test.go	Adds regression tests verifying Splunk/syslog user CA inclusion and avoiding rendering the shared tigera-ca-bundle.