Address CVEs in logan fluentd container image (#141)

* address CVEs in logan fluentd container image

Author: paliwalparitosh

.gitignore

@@ -74,4 +74,6 @@ releases/
 .vscode
 
 # debug files
-tf-debug/
+tf-debug/
+/.codex
+/.idea/

CHANGELOG.md

@@ -1,5 +1,10 @@
 # Change Log
 
+# 2026-04-29
+### Changed
+- Fluentd collector container image has been updated to version 1.7.5 having Oracle Linux Base Image Updates and dependency gem updates.
+  - Similar updates to build files (Dockerfile, Gemfile) that helps building custom container image.
+
 # 2026-02-17
 ### Changed
 - Fluentd collector container image has been updated to version 1.7.4 having OS and discovery gem update

charts/logan/Chart.yaml

@@ -5,7 +5,7 @@ apiVersion: v2
 name: oci-onm-logan
 description: Charts for sending Kubernetes platform logs, compute logs, and Kubernetes Objects information to OCI Log Analytics.
 type: application
-version: 4.2.0
+version: 4.2.1
 appVersion: "3.0.0"
 
 dependencies:

charts/logan/values.yaml

@@ -53,7 +53,7 @@ image:
    # Image pull secrets for. Secret must be in the namespace defined by namespace
    imagePullSecrets:
    # -- Replace this value with actual docker image url
-   url: container-registry.oracle.com/oci_observability_management/oci-la-fluentd-collector:1.7.4
+   url: container-registry.oracle.com/oci_observability_management/oci-la-fluentd-collector:1.7.5
    # -- Image pull policy
    imagePullPolicy: Always
 

charts/oci-onm/Chart.yaml

@@ -18,7 +18,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 4.2.0
+version: 4.2.1
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
@@ -32,7 +32,7 @@ dependencies:
   repository: "file://../common"
   condition: oci-onm-common.enabled
 - name: oci-onm-logan
-  version: "4.2.0"
+  version: "4.2.1"
   repository: "file://../logan"
   condition: oci-onm-logan.enabled
 - name: oci-onm-mgmt-agent

charts/oci-onm/values.yaml

@@ -31,7 +31,7 @@ oci-onm-logan:
   kubernetesClusterID: "{{ .Values.global.kubernetesClusterID }}"
   kubernetesClusterName: "{{ .Values.global.kubernetesClusterName }}"
   image:
-    url: container-registry.oracle.com/oci_observability_management/oci-la-fluentd-collector:1.7.4
+    url: container-registry.oracle.com/oci_observability_management/oci-la-fluentd-collector:1.7.5
   # Go to OCI Log Analytics Administration, click Service Details, and note the namespace value.
   ociLANamespace:
   # OCI Log Analytics Default Log Group OCID

logan/docker-images/v1.0/oraclelinux/8-slim/Dockerfile

@@ -20,8 +20,9 @@ ENV FLUENTD_DISABLE_BUNDLER_INJECTION 1
 COPY Gemfile* /fluentd/
 COPY tcpconnect.* /fluentd/
 
-# Install ruby, ruby-libs along with rubygems and bundler.
-RUN microdnf -y module enable ruby:3.3 \
+# Apply current Oracle Linux security errata before layering runtime dependencies.
+RUN microdnf -y update --setopt=install_weak_deps=0 --nodocs \
+ && microdnf -y module enable ruby:3.3 \
 # Install ruby and ruby-libs, disabling week dependencies
  && microdnf -y install --setopt=install_weak_deps=0 --nodocs ruby ruby-libs \
 # Install rubygems (it's dependencies rubygem-openssl rubygem-psych), disabling week dependencies
@@ -63,8 +64,9 @@ ENV GEM_HOME /fluentd/vendor/bundle/ruby/3.3
 # skip runtime bundler installation
 ENV FLUENTD_DISABLE_BUNDLER_INJECTION 1
 
-# Install ruby, ruby-libs along with rubygems and bundler.
-RUN microdnf -y module enable ruby:3.3 \
+# Apply current Oracle Linux security errata before installing runtime packages.
+RUN microdnf -y update --setopt=install_weak_deps=0 --nodocs \
+ && microdnf -y module enable ruby:3.3 \
 # Install ruby and ruby-libs, disabling week dependencies
  && microdnf -y install --setopt=install_weak_deps=0 --nodocs ruby ruby-libs \ 
 # Install rubygems (it's dependencies rubygem-openssl rubygem-psych), disabling week dependencies

logan/docker-images/v1.0/oraclelinux/8-slim/Gemfile

@@ -15,4 +15,4 @@ gem "oci-logging-analytics-kubernetes-discovery", "1.3.0"
 gem "fluent-plugin-record-modifier", "2.2.0"
 gem "fluent-plugin-cloudwatch-logs", "0.14.3"
 gem "fluent-plugin-s3", "1.7.2"
-gem "rexml", "3.4.0"
+gem "rexml", "3.4.4"

logan/docker-images/v1.0/oraclelinux/8-slim/Gemfile.lock

@@ -1,23 +1,26 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    addressable (2.8.7)
-      public_suffix (>= 2.0.2, < 7.0)
+    addressable (2.9.0)
+      public_suffix (>= 2.0.2, < 8.0)
     aws-eventstream (1.3.0)
-    aws-partitions (1.958.0)
+    aws-partitions (1.1239.0)
     aws-sdk-cloudwatchlogs (1.87.0)
       aws-sdk-core (~> 3, >= 3.201.0)
       aws-sigv4 (~> 1.5)
-    aws-sdk-core (3.201.3)
+    aws-sdk-core (3.244.0)
       aws-eventstream (~> 1, >= 1.3.0)
-      aws-partitions (~> 1, >= 1.651.0)
-      aws-sigv4 (~> 1.8)
+      aws-partitions (~> 1, >= 1.992.0)
+      aws-sigv4 (~> 1.9)
+      base64
+      bigdecimal
       jmespath (~> 1, >= 1.6.1)
+      logger
     aws-sdk-kms (1.88.0)
       aws-sdk-core (~> 3, >= 3.201.0)
       aws-sigv4 (~> 1.5)
-    aws-sdk-s3 (1.156.0)
-      aws-sdk-core (~> 3, >= 3.201.0)
+    aws-sdk-s3 (1.219.0)
+      aws-sdk-core (~> 3, >= 3.244.0)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.5)
     aws-sdk-sqs (1.80.0)
@@ -107,7 +110,7 @@ GEM
     llhttp-ffi (0.5.0)
       ffi-compiler (~> 1.0)
       rake (~> 13.0)
-    logger (1.6.1)
+    logger (1.7.0)
     lru_redux (1.1.0)
     mime-types (3.5.2)
       mime-types-data (~> 3.2015)
@@ -141,7 +144,7 @@ GEM
       http-cookie (>= 1.0.2, < 2.0)
       mime-types (>= 1.16, < 4.0)
       netrc (~> 0.8)
-    rexml (3.4.0)
+    rexml (3.4.4)
     rubyzip (2.3.2)
     serverengine (2.3.2)
       sigdump (~> 0.2.2)
@@ -171,7 +174,7 @@ DEPENDENCIES
   json (= 2.7.2)
   oci-logging-analytics-kubernetes-discovery (= 1.0.2)
   oj (= 3.16.4)
-  rexml (= 3.4.0)
+  rexml (= 3.4.4)
 
 BUNDLED WITH
    2.5.16