Hi folks I have a question about the fluent operator and how it does multi-tenancy with fluent bit. Is there a way to do namespaced configs such that each namespace can be associated with a separate IAM role and separate AWS accounts?

Ultimately its about output, and yes you can configure output with roles of your like to ship log to your desired sink.

For fluent operator, there doesn't seem to be a namespaced level Input? There only seems to be ClusterInput. Would I have to filter on namespace, tag it and then set up the output for whatever account is associated with the namespace?

normally input can be same for all and then you use parsers to parse it accordingly or filter accordingly and namespace level output. I have recently faced simillar issue where i can only do things at input level like multilineparser 😞

So the expected pattern for what I would want is ClusterInput, Filters in different namespaces to attach different tags for different namespaces, and then a ClusterOutput to match the namespace tags to a destination

for multitenancy you could

/var/log/containers/*.log

at clusterInput layer and let individual namespace filter/parse & output accordingly

is there an example of how to do that? do the individual namespace CRDs automatically grab the logs relevant to their namespace?

just use a clusterInput and then multiple namespaced outputs to determine where the logs go?

I thought i said same above, (parser/filter is if its necessary)

Yes you did say the same, I'm just repeating to make sure I understand