This page covers what Collectord runs as, what it touches on the host and the cluster, and what you can lock down. If you’re walking through a security review, this is the short version of the answers.
Collectord
Image
We build our image from scratch - a 0-size base. The Collectord image ships only what’s required to run: the collectord binary, the system libraries it links against, a set of root certificates, and a timezone database, all taken from Debian 13. It also carries the glibc compatibility libraries (libpthread, librt, libanl, libutil) that runtime security agents injected into a container expect; Collectord itself doesn’t use them. There’s no shell, no package manager, no interpreter to pivot from.
Container configuration
To collect logs from the cluster, Collectord needs access to the host filesystem - that’s why the DaemonSet requires privileged access. The addon Deployment runs without privileges. Collectord treats the host as read-only. The only thing it writes back is acknowledgement state in the form of a small database, which by default lives under /var/lib/collectorforkubernetes-elasticsearch (the OpenSearch manifest uses the same path; with Helm, /var/lib/<release name>). If you configure a volume database, it goes in the volume root instead.
If you skip the volume database, you can drop the host filesystem to read-only - but you’ll still need write access to Collectord’s primary database directory (the data folder).
Collectord also reads from the API Server. We scope that access with RBAC so it only has the read permissions it needs, nothing more. The ClusterRole grants nothing on Secrets. With the manifests, the collectorforkubernetes ClusterRole is shared with the Collectord for Splunk manifest: on a cluster that runs both, you apply that one last (see Installation), and it grants get on Secrets, for the one Secret a SplunkOutput names. A Helm release gets a ClusterRole of its own.
Before 26.10, the ClusterRole also granted
get,listandwatchon Secrets.
Internet access
The default license requires internet access so license clients can verify against our license server. If your environment doesn’t allow outbound traffic, we can issue a license that doesn’t require verification - reach out and we’ll set you up.
Collectord also forwards anonymous telemetry to our license server. You can turn that off in the configuration.
Connection to ElasticSearch / OpenSearch
We recommend TLS for the connection to ElasticSearch / OpenSearch. Set host = https://... in the [output.elasticsearch] block, and provide a CA path or set insecure = false (the default) to require certificate validation. Basic authentication credentials live in authorizationBasicUsername / authorizationBasicPassword; for token-based auth, set the header yourself: headers.Authorization = Bearer <token>.