rancher-logging-exitlisted

Migrate off the Rancher-bundled `rancher-logging` chart (cattle-logging-system, rancher/mirrored-kube-logging-* images) to the upstream kube-logging logging-operator ≥6.7.0 — air-gap-first. Rancher 2.11 through 2.15-dev all bundle a frozen operator 4.10.0 that is inside the affected range of CVE-2026-54680 (CVSS 9.9 config-injection RCE, no SUSE fix) — so the exit is security-urgent. Covers the maintainer-endorsed helm-release-secret strategy (near-zero gap; NOT `helm uninstall rancher-logging-crd`, which cascade-deletes every CR and the data plane), CR compatibility 4.10→6.7 (silent field pruning), server-side CRD apply (828KB CRDs), buffer-PVC preservation, air-gap image/chart mirroring, rollback, and stale-CRD debris cleanup.
air-gapped/skills · ★ 5 · DevOps & Infrastructure · score 80

Install: claude install-skill air-gapped/skills

# rancher-logging-exit — Rancher-bundled → upstream logging-operator Migration reference, verified 2026-07-22. Target: **upstream ≥6.7.0** (6.6.0 fixes the CVE but breaks newline-containing passwords, #2254 — 6.7.0 has the corrected fix). Version matrix authority: `k8s-components-checker` `references/compat/rancher-logging.md`. Day-2 configuration of the migrated pipeline: the **logging-operator** skill. ## Why migrate (the honest urgency statement) - **Frozen**: every Rancher minor 2.11 → 2.14 (and 2.15-dev) ships the same upstream base **operator 4.10.0** (Oct 2024) — only `-rancher.N` chart respins. The `-rancher.N` fork is **chart-level only** (rancher/ob-team-charts); the operator image is a stock upstream mirror. "Wait for Rancher" has been dead for 20+ months of releases. **Re-confirmed 2026-09-15**: the newest chart in `rancher/charts` is **`110.0.0+up4.10.0-rancher.24`**. A whole chart major has landed since this skill was written and the upstream base in the version string is *still* `up4.10.0`. The chart major number moving while the `up` component does not is exactly the shape that makes "we're on the latest chart" feel like currency when it is not. - **CVE-2026-54680** (GHSA-mjqf-28ph-426h, CVSS 9.9): operator ≤6.5.2 renders CRD/secret values into fluent.conf unescaped — a newline in a Flow/Output field or referenced Secret injects arbitrary fluentd directives (`<match **> @type exec` ⇒ RCE in the aggregator). 4.10.0 is affected; the