Patch 1

ElK

@@ -0,0 +1,317 @@
+#
+# Fluentd configuration - this installs onto all nodes and gathers all logs
+# A separate yaml configures Fluentd
+#
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: fluentd-es
+ namespace: kube-system
+ labels:
+ k8s-app: fluentd-es
+ kubernetes.io/cluster-service: "true"
+ addonmanager.kubernetes.io/mode: Reconcile
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+ name: fluentd-es
+ labels:
+ k8s-app: fluentd-es
+ kubernetes.io/cluster-service: "true"
+ addonmanager.kubernetes.io/mode: Reconcile
+rules:
+- apiGroups:
+ - ""
+ resources:
+ - "namespaces"
+ - "pods"
+ verbs:
+ - "get"
+ - "watch"
+ - "list"
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+ name: fluentd-es
+ labels:
+ k8s-app: fluentd-es
+ kubernetes.io/cluster-service: "true"
+ addonmanager.kubernetes.io/mode: Reconcile
+subjects:
+- kind: ServiceAccount
+ name: fluentd-es
+ namespace: kube-system
+ apiGroup: ""
+roleRef:
+ kind: ClusterRole
+ name: fluentd-es
+ apiGroup: ""
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+ name: fluentd-es-v2.2.0
+ namespace: kube-system
+ labels:
+ k8s-app: fluentd-es
+ version: v2.2.0
+ kubernetes.io/cluster-service: "true"
+ addonmanager.kubernetes.io/mode: Reconcile
+spec:
+ selector:
+ matchLabels:
+ k8s-app: fluentd-es
+ version: v2.2.0
+ template:
+ metadata:
+ labels:
+ k8s-app: fluentd-es
+ kubernetes.io/cluster-service: "true"
+ version: v2.2.0
+ # This annotation ensures that fluentd does not get evicted if the node
+ # supports critical pod annotation based priority scheme.
+ # Note that this does not guarantee admission on the nodes (#40573).
+ annotations:
+ scheduler.alpha.kubernetes.io/critical-pod: ''
+ seccomp.security.alpha.kubernetes.io/pod: 'docker/default'
+ spec:
+ priorityClassName: system-node-critical
+ serviceAccountName: fluentd-es
+ containers:
+ - name: fluentd-es
+ image: k8s.gcr.io/fluentd-elasticsearch:v2.2.0
+ env:
+ - name: FLUENTD_ARGS
+ value: --no-supervisor -q
+ resources:
+ limits:
+ memory: 500Mi
+ requests:
+ cpu: 100m
+ memory: 200Mi
+ volumeMounts:
+ - name: varlog
+ mountPath: /var/log
+ - name: varlibdockercontainers
+ mountPath: /var/lib/docker/containers
+ readOnly: true
+ - name: config-volume
+ mountPath: /etc/fluent/config.d
+ # nodeSelector:
+ # beta.kubernetes.io/fluentd-ds-ready: "true"
+ terminationGracePeriodSeconds: 30
+ volumes:
+ - name: varlog
+ hostPath:
+ path: /var/log
+ - name: varlibdockercontainers
+ hostPath:
+ path: /var/lib/docker/containers
+ - name: config-volume
+ configMap:
+ name: fluentd-es-config-v0.1.4
+
+
+---
+
+#
+# Elastic Search configuration
+#
+apiVersion: v1
+kind: Service
+metadata:
+ name: elasticsearch-logging
+ namespace: kube-system
+ labels:
+ k8s-app: elasticsearch-logging
+ kubernetes.io/cluster-service: "true"
+ addonmanager.kubernetes.io/mode: Reconcile
+ kubernetes.io/name: "Elasticsearch"
+spec:
+ ports:
+ - port: 9200
+ protocol: TCP
+ targetPort: db
+ selector:
+ k8s-app: elasticsearch-logging
+---
+# RBAC authn and authz
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: elasticsearch-logging
+ namespace: kube-system
+ labels:
+ k8s-app: elasticsearch-logging
+ kubernetes.io/cluster-service: "true"
+ addonmanager.kubernetes.io/mode: Reconcile
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+ name: elasticsearch-logging
+ labels:
+ k8s-app: elasticsearch-logging
+ kubernetes.io/cluster-service: "true"
+ addonmanager.kubernetes.io/mode: Reconcile
+rules:
+- apiGroups:
+ - ""
+ resources:
+ - "services"
+ - "namespaces"
+ - "endpoints"
+ verbs:
+ - "get"
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+ namespace: kube-system
+ name: elasticsearch-logging
+ labels:
+ k8s-app: elasticsearch-logging
+ kubernetes.io/cluster-service: "true"
+ addonmanager.kubernetes.io/mode: Reconcile
+subjects:
+- kind: ServiceAccount
+ name: elasticsearch-logging
+ namespace: kube-system
+ apiGroup: ""
+roleRef:
+ kind: ClusterRole
+ name: elasticsearch-logging
+ apiGroup: ""
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+ name: elasticsearch-logging
+ namespace: kube-system
+ labels:
+ k8s-app: elasticsearch-logging
+ version: v6.2.5
+ kubernetes.io/cluster-service: "true"
+ addonmanager.kubernetes.io/mode: Reconcile
+spec:
+ serviceName: elasticsearch-logging
+ replicas: 2
+ selector:
+ matchLabels:
+ k8s-app: elasticsearch-logging
+ version: v6.2.5
+ template:
+ metadata:
+ labels:
+ k8s-app: elasticsearch-logging
+ version: v6.2.5
+ kubernetes.io/cluster-service: "true"
+ spec:
+ serviceAccountName: elasticsearch-logging
+ containers:
+ - image: k8s.gcr.io/elasticsearch:v6.2.5
+ name: elasticsearch-logging
+ resources:
+ # need more cpu upon initialization, therefore burstable class
+ limits:
+ cpu: 1000m
+ requests:
+ cpu: 100m
+ ports:
+ - containerPort: 9200
+ name: db
+ protocol: TCP
+ - containerPort: 9300
+ name: transport
+ protocol: TCP
+ volumeMounts:
+ - name: elasticsearch-logging
+ mountPath: /data
+ env:
+ - name: "NAMESPACE"
+ valueFrom:
+ fieldRef:
+ fieldPath: metadata.namespace
+ # Elasticsearch requires vm.max_map_count to be at least 262144.
+ # If your OS already sets up this number to a higher value, feel free
+ # to remove this init container.
+ initContainers:
+ - image: alpine:3.6
+ command: ["/sbin/sysctl", "-w", "vm.max_map_count=262144"]
+ name: elasticsearch-logging-init
+ securityContext:
+ privileged: true
+ volumeClaimTemplates:
+ - metadata:
+ name: elasticsearch-logging
+ spec:
+ storageClassName: cloud-ssd
+ accessModes: [ "ReadWriteOnce" ]
+ resources:
+ requests:
+ storage: 31Gi
+---
+
+#
+# Finally, Kibana - for visualising the results
+#
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: kibana-logging
+ namespace: kube-system
+ labels:
+ k8s-app: kibana-logging
+ kubernetes.io/cluster-service: "true"
+ addonmanager.kubernetes.io/mode: Reconcile
+spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ k8s-app: kibana-logging
+ template:
+ metadata:
+ labels:
+ k8s-app: kibana-logging
+ annotations:
+ seccomp.security.alpha.kubernetes.io/pod: 'docker/default'
+ spec:
+ containers:
+ - name: kibana-logging
+ image: docker.elastic.co/kibana/kibana-oss:6.2.4
+ resources:
+ # need more cpu upon initialization, therefore burstable class
+ limits:
+ cpu: 1000m
+ requests:
+ cpu: 100m
+ env:
+ - name: ELASTICSEARCH_URL
+ value: http://elasticsearch-logging:9200
+ ports:
+ - containerPort: 5601
+ name: ui
+ protocol: TCP
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+ name: kibana-logging
+ namespace: kube-system
+ labels:
+ k8s-app: kibana-logging
+ kubernetes.io/cluster-service: "true"
+ addonmanager.kubernetes.io/mode: Reconcile
+ kubernetes.io/name: "Kibana"
+spec:
+ ports:
+ - port: 5601
+ protocol: TCP
+ targetPort: ui
+ selector:
+ k8s-app: kibana-logging
+ type: LoadBalancer