Upgrade aws-for-fluent-bit chart to v0.2.0 (upstream version to 3.2.1)

[sapphirew]

Summary

This upgrade updates the aws-for-fluent-bit Helm chart from v0.1.35 to v0.2.0, which includes AWS for Fluent Bit 3.2.1 (based on Fluent Bit 4.2.2).

Tests

Test 1: CloudWatch Logs (C Plugin)

Helm Install Command

helm install aws-for-fluent-bit stable/aws-for-fluent-bit \
  --namespace kube-system \
  --set serviceAccount.create=false \
  --set serviceAccount.name=aws-for-fluent-bit \
  --set cloudWatchLogs.enabled=true \
  --set cloudWatchLogs.region=us-west-2 \
  --set cloudWatchLogs.logGroupName=/aws/eks/fluent-bit-test/cloudwatch-logs \
  --set cloudWatchLogs.autoCreateGroup=true

Pod Status

NAME                       READY   STATUS    RESTARTS   AGE
aws-for-fluent-bit-6r4jt   1/1     Running   0          52s
aws-for-fluent-bit-sjlcx   1/1     Running   0          52s

Fluent Bit Logs

[output:cloudwatch_logs:cloudwatch_logs.0] worker #0 started
[output:cloudwatch_logs:cloudwatch_logs.0] Log Group /aws/eks/fluent-bit-test/cloudwatch-logs not found. Will attempt to create it.
[output:cloudwatch_logs:cloudwatch_logs.0] Created log group /aws/eks/fluent-bit-test/cloudwatch-logs with storage class STANDARD
[output:cloudwatch_logs:cloudwatch_logs.0] Created log stream fluentbit-kube.var.log.containers...

CloudWatch Verification

aws logs describe-log-streams --log-group-name /aws/eks/fluent-bit-test/cloudwatch-logs --region us-west-2 --limit 3

{
    "logStreams": [
        {
            "logStreamName": "fluentbit-kube.var.log.containers.aws-for-fluent-bit-6r4jt_kube-system_aws-for-fluent-bit-...",
            "creationTime": 1769047291463,
            "firstEventTimestamp": 1769047291053,
            "lastEventTimestamp": 1769047291192
        }
    ]
}

---

Test 2: CloudWatch (Go Plugin - Legacy)

Helm Upgrade Command

helm upgrade aws-for-fluent-bit stable/aws-for-fluent-bit \
  --namespace kube-system \
  --set serviceAccount.create=false \
  --set serviceAccount.name=aws-for-fluent-bit \
  --set cloudWatchLogs.enabled=false \
  --set cloudWatch.enabled=true \
  --set cloudWatch.region=us-west-2 \
  --set cloudWatch.logGroupName=/aws/eks/fluent-bit-test/cloudwatch-go \
  --set cloudWatch.autoCreateGroup=true

Fluent Bit Logs

time="2026-01-22T02:04:38Z" level=info msg="[cloudwatch 0] Created log group /aws/eks/fluent-bit-test/cloudwatch-go\n"
time="2026-01-22T02:04:38Z" level=info msg="[cloudwatch 0] Created log stream fluentbit-kube.var.log.containers... in group /aws/eks/fluent-bit-test/cloudwatch-go"

CloudWatch Verification

aws logs describe-log-streams --log-group-name /aws/eks/fluent-bit-test/cloudwatch-go --region us-west-2 --limit 2

{
    "logStreams": [
        {
            "logStreamName": "fluentbit-kube.var.log.containers.aws-for-fluent-bit-fsv4n_kube-system...",
            "creationTime": 1769047478848,
            "firstEventTimestamp": 1769047478591
        }
    ]
}

---

Test 3: Kinesis Streams (C Plugin)

Helm Upgrade Command

helm upgrade aws-for-fluent-bit stable/aws-for-fluent-bit \
  --namespace kube-system \
  --set serviceAccount.create=false \
  --set serviceAccount.name=aws-for-fluent-bit \
  --set cloudWatch.enabled=false \
  --set kinesis_streams.enabled=true \
  --set kinesis_streams.region=us-west-2 \
  --set kinesis_streams.stream=fluent-bit-test-stream

Fluent Bit Logs

[output:kinesis_streams:kinesis_streams.1] worker #0 started

Kinesis Verification

aws kinesis get-records --shard-iterator "$SHARD_ITERATOR" --region us-west-2 --limit 5 --query 'length(Records)'

5

---

Test 4: Kinesis (Go Plugin)

Helm Upgrade Command

helm upgrade aws-for-fluent-bit stable/aws-for-fluent-bit \
  --namespace kube-system \
  --set serviceAccount.create=false \
  --set serviceAccount.name=aws-for-fluent-bit \
  --set kinesis_streams.enabled=false \
  --set kinesis.enabled=true \
  --set kinesis.region=us-west-2 \
  --set kinesis.stream=fluent-bit-test-stream

Kinesis Verification

aws kinesis get-records --shard-iterator "$SHARD_ITERATOR" --region us-west-2 --limit 3

{
    "Records": [
        {
            "SequenceNumber": "49671078933949352870379830273367104338065091517155901442",
            "ApproximateArrivalTimestamp": 1769060693.6,
            "Data": "eyJfcCI6IkYiLCJrdWJlcm5ldGVzIjp7ImFubm90YXRpb25zIjp7...",
            "PartitionKey": "6Ozsv5nt"
        }
    ],
    "MillisBehindLatest": 7000
}

---

Test 5: Firehose (Go Plugin)

Prerequisites

# Create S3 bucket for Firehose destination
aws s3 mb s3://fluent-bit-test-803909145761 --region us-west-2

# Create IAM role for Firehose
aws iam create-role --role-name fluent-bit-firehose-role --assume-role-policy-document file:///tmp/firehose-role-policy.json
aws iam attach-role-policy --role-name fluent-bit-firehose-role --policy-arn arn:aws:iam::aws:policy/AmazonS3FullAccess

# Create Firehose delivery stream
aws firehose create-delivery-stream \
  --delivery-stream-name fluent-bit-test-firehose \
  --delivery-stream-type DirectPut \
  --s3-destination-configuration "RoleARN=arn:aws:iam::803909145761:role/fluent-bit-firehose-role,BucketARN=arn:aws:s3:::fluent-bit-test-803909145761,Prefix=firehose/"

Helm Upgrade Command

helm upgrade aws-for-fluent-bit stable/aws-for-fluent-bit \
  --namespace kube-system \
  --set serviceAccount.create=false \
  --set serviceAccount.name=aws-for-fluent-bit \
  --set kinesis_streams.enabled=false \
  --set firehose.enabled=true \
  --set firehose.region=us-west-2 \
  --set firehose.deliveryStream=fluent-bit-test-firehose

Fluent Bit Logs

time="2026-01-22T05:59:20Z" level=info msg="[firehose 0] plugin parameter delivery_stream = 'fluent-bit-test-firehose'"
time="2026-01-22T05:59:20Z" level=info msg="[firehose 0] plugin parameter region = 'us-west-2'"

---

Test 6: S3 (C Plugin)

Helm Upgrade Command

helm upgrade aws-for-fluent-bit stable/aws-for-fluent-bit \
  --namespace kube-system \
  --set serviceAccount.create=false \
  --set serviceAccount.name=aws-for-fluent-bit \
  --set firehose.enabled=false \
  --set s3.enabled=true \
  --set s3.region=us-west-2 \
  --set s3.bucket=fluent-bit-test-803909145761 \
  --set s3.s3KeyFormat='/s3-direct/$TAG/%Y-%m-%d/%H-%M-%S' \
  --set s3.totalFileSize=15M \
  --set s3.uploadChunkSize=6M \
  --set s3.uploadTimeout=1m

Fluent Bit Logs

[output:s3:s3.1] Using upload size 15000000 bytes
[output:s3:s3.1] initializing worker
[output:s3:s3.1] worker #0 started
[output:s3:s3.1] Running upload timer callback (cb_s3_upload)..

S3 Verification

aws s3 ls s3://fluent-bit-test-803909145761/s3-direct/ --recursive

2026-01-21 22:05:18  46199 s3-direct/kube.var.log.containers.aws-for-fluent-bit-tf8kz.../2026-01-22/06-04-16-objects1o852vs
2026-01-21 22:06:28  11625 s3-direct/kube.var.log.containers.aws-for-fluent-bit-tf8kz.../2026-01-22/06-05-17-objectTIzLi19J
2026-01-21 22:05:19   3253 s3-direct/kube.var.log.containers.aws-for-fluent-bit-tpm4p.../2026-01-22/06-04-17-objectJcK5HQS2
2026-01-21 22:05:18 108263 s3-direct/kube.var.log.containers.kube-proxy-bttt7.../2026-01-22/06-02-12-objectDMIYzNyl

---

Confirmed Fluent Bit Version

kubectl logs -n kube-system aws-for-fluent-bit-xxx | grep "version="

AWS for Fluent Bit Container Image Version 3.2.0
[fluent bit] version=4.2.2, commit=ddfef360d7, pid=1
[cmetrics] version=1.0.6
[ctraces ] version=0.6.6

---

Upgrade test

Upgrade from v0.1.35: Helm upgrade completed without errors, pods restarted with new version, log collection continued without interruption

• Verified backward compatibility: Same values.yaml structure, existing configs work

  • Installed previous version first:

[fluent bit] version=1.9.10, commit=06145a501d, pid=1

• Upgraded to v0.1.36:

Release "aws-for-fluent-bit" has been upgraded. Happy Helming!
STATUS: deployed
REVISION: 2

• Helm history showing successful upgrade:

REVISION  UPDATED                   STATUS      CHART                      APP VERSION
1         Wed Jan 21 17:26:45 2026  superseded  aws-for-fluent-bit-0.1.35  2.32.2.20240516
2         Wed Jan 21 17:29:02 2026  deployed    aws-for-fluent-bit-0.1.36  3.2.0

• Post-upgrade verification:

AWS for Fluent Bit Container Image Version 3.2.0
[fluent bit] version=4.2.2, commit=ddfef360d7, pid=1

Key version changes:

• Fluent Bit: 1.9.10 -> 4.2.2
• Base image: Amazon Linux 2 -> Amazon Linux 2023
• Image tag format: date suffix removed (2.32.2.20240516 -> 3.2.0)

Issue

Description of changes

Checklist

• Added/modified documentation as required (such as the README.md for modified charts)
• Incremented the chart version in Chart.yaml for the modified chart(s)
• Manually tested. Describe what testing was done in the testing section below
• Make sure the title of the PR is a good description that can go into the release notes

Testing

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[sapphirew]

@PettitWesley can you please review this PR? Tested on an EKS cluster. All 6 output plugins (cloudWatchLogs, cloudWatch, kinesis_streams, kinesis, firehose, s3) verified working. Fresh install and upgrade from v0.1.35 both successful. See PR description for details

[sapphirew]

Trying to tag more maintainers of this repo - @moshiaiz @dims @bryantbiggs @arditti @liubnu @BennettJames can any of you please review this PR?

[oliviassss]

Hey, is it intended that only version bump up is needed? no other configuration change?

[sapphirew]

Hey, is it intended that only version bump up is needed? no other configuration change?

Yes, most configurations are forward compatible. Some deprecate configurations are retained for ensuring backward compatibility. We are going to check with users if any additional configurations are needed in order to include them in one single release. Will hold on merging this PR until that's confirmed.

[cheeseandcereal]

should we bump the minor version sinc the major version of aws-for-fluent-bit is changing? Like 0.2.0

[sapphirew]

good call, changed version to 0.2.0

[cheeseandcereal]

Looks good. Please do a check through the fluent-bit change logs to make sure none of our config setup is broken by the transition from fluent-bit 1.9->4.2

Also, looks like there's a newer upstream version now: https://github.com/aws/aws-for-fluent-bit/releases/tag/v3.2.1 - so probably worth pulling that in before merging.

Other than that, lgtm

[sapphirew]

@cheeseandcereal

The followings are the breaking changes for Fluent Bit 1.9.x → 4.2.x, but none of them is used in this helm chart, so there is no configuration change required in this PR

• v2.0.0 (Release Notes)
  • td-agent-bit package removed: Package renamed from td-agent-bit to fluent-bit
  • mbedTLS deprecated → OpenSSL: All TLS operations now use OpenSSL instead of mbedTLS
  • Loki concurrent delivery: Loki output allows concurrent delivery; requires Loki ≥ 2.4
  • Stricter @INCLUDE parsing: Duplicate @INCLUDE reads now cause errors
• v3.0.0 (Release Notes, Announcement)
  • HTTP/2 enabled by default: HTTP-based input plugins now use HTTP/2 by default
  • out_http default format changed: HTTP output format defaults to JSON

Also bumped upstream version to https://github.com/aws/aws-for-fluent-bit/releases/tag/v3.2.1