1apiVersion: v1
2kind: Namespace
3metadata:
4 labels:
5 app: collectorforkubernetes
6 name: collectorforkubernetes
7---
8apiVersion: apiextensions.k8s.io/v1
9kind: CustomResourceDefinition
10metadata:
11 name: configurations.collectord.io
12spec:
13 group: collectord.io
14 versions:
15 - name: v1
16 served: true
17 storage: true
18 schema:
19 openAPIV3Schema:
20 type: object
21 properties:
22 spec:
23 type: object
24 additionalProperties: true
25 force:
26 type: boolean
27 scope: Cluster
28 names:
29 listKind: ConfigurationList
30 plural: configurations
31 singular: configuration
32 kind: Configuration
33---
34apiVersion: apiextensions.k8s.io/v1
35kind: CustomResourceDefinition
36metadata:
37 name: splunkoutputs.collectord.io
38spec:
39 group: collectord.io
40 versions:
41 - name: v1
42 served: true
43 storage: true
44 schema:
45 openAPIV3Schema:
46 type: object
47 properties:
48 spec:
49 type: object
50 properties:
51 url:
52 type: string
53 format: uri
54 insecure:
55 type: boolean
56 token:
57 type: string
58 description: "Plain token"
59 tokenFromSecret:
60 type: object
61 description: "Reference to a Kubernetes Secret"
62 properties:
63 secret:
64 type: string
65 key:
66 type: string
67 oneOf:
68 - required: ["token"]
69 - required: ["tokenFromSecret"]
70 scope: Namespaced
71 names:
72 listKind: SplunkOutputList
73 plural: splunkoutputs
74 singular: splunkoutput
75 kind: SplunkOutput
76---
77apiVersion: v1
78kind: ServiceAccount
79metadata:
80 labels:
81 app: collectorforkubernetes
82 name: collectorforkubernetes
83 namespace: collectorforkubernetes
84---
85apiVersion: scheduling.k8s.io/v1
86kind: PriorityClass
87metadata:
88 name: collectorforkubernetes-critical
89value: 1000000000
90---
91apiVersion: rbac.authorization.k8s.io/v1
92kind: ClusterRole
93metadata:
94 labels:
95 app: collectorforkubernetes
96 name: collectorforkubernetes
97rules:
98- apiGroups: ['extensions']
99 resources: ['podsecuritypolicies']
100 verbs: ['use']
101 resourceNames:
102 - privileged
103- apiGroups:
104 - ""
105 - apps
106 - batch
107 - extensions
108 - rbac.authorization.k8s.io
109 - collectord.io
110 - discovery.k8s.io
111 resources:
112 - alertmanagers
113 - clusterroles
114 - configmaps
115 - configurations
116 - cronjobs
117 - daemonsets
118 - deployments
119 - endpointslices
120 - events
121 - jobs
122 - namespaces
123 - nodes
124 - nodes/metrics
125 - nodes/proxy
126 - persistentvolumeclaims
127 - pods
128 - replicasets
129 - replicationcontrollers
130 - resourcequotas
131 - scheduledjobs
132 - secrets
133 - services
134 - splunkoutputs
135 - statefulsets
136 verbs:
137 - get
138 - list
139 - watch
140- nonResourceURLs:
141 - /metrics
142 verbs:
143 - get
144 apiGroups: []
145 resources: []
146---
147apiVersion: rbac.authorization.k8s.io/v1
148kind: ClusterRoleBinding
149metadata:
150 labels:
151 app: collectorforkubernetes
152 name: collectorforkubernetes
153roleRef:
154 apiGroup: rbac.authorization.k8s.io
155 kind: ClusterRole
156 name: collectorforkubernetes
157subjects:
158 - kind: ServiceAccount
159 name: collectorforkubernetes
160 namespace: collectorforkubernetes
161---
162apiVersion: v1
163kind: ConfigMap
164metadata:
165 name: collectorforkubernetes
166 namespace: collectorforkubernetes
167 labels:
168 app: collectorforkubernetes
169data:
170 001-general.conf: |
171 # The general configuration is used for all deployments
172 #
173 # Run collectord with the flag -conf and specify location of the configuration files.
174 #
175 # You can override all the values using environment variables with the format like
176 # COLLECTOR__<ANYNAME>=<section>__<key>=<value>
177 # As an example you can set dataPath in [general] section as
178 # COLLECTOR__DATAPATH=general__dataPath=C:\\some\\path\\data.db
179 # This parameter can be configured using -env-override, set it to empty string to disable this feature
180
181 [general]
182
183 # Please review license https://www.outcoldsolutions.com/legal/license-agreement/
184 # and accept license by changing the value to *true*
185 acceptLicense = false
186
187 # Location for the database
188 # Collectord stores positions of the files and internal state
189 dataPath = ./data/
190
191 # log level (accepted values are trace, debug, info, warn, error, fatal)
192 logLevel = info
193
194 # Internal http server. Bound to loopback so nothing is published on the node
195 # network: the DaemonSets run on the host network, where a 0.0.0.0 bind would
196 # expose these endpoints on the node IP. The liveness/readiness probes still reach
197 # it via httpGet.host 127.0.0.1 (the kubelet shares the host network namespace).
198 # The addon runs off the host network and overrides this to 0.0.0.0 in
199 # 004-addon.conf so the kubelet can reach it on the pod IP.
200 httpServerBinding = 127.0.0.1:11888
201
202 # Enable endpoints individually. Only the probe endpoints default on. metrics
203 # (/metrics/json, /metrics/prometheus) and pprof (/debug/pprof) expose internal
204 # detail and are unreachable on a loopback bind anyway - to scrape or profile,
205 # enable the endpoint and widen httpServerBinding (e.g. 0.0.0.0:11888).
206 httpServerEndpoints.health = true
207 httpServerEndpoints.ready = true
208 httpServerEndpoints.metrics = false
209 httpServerEndpoints.pprof = false
210
211 # log requests to the http server
212 httpServerLog = false
213
214 # telemetry report endpoint, set it to empty string to disable telemetry
215 telemetryEndpoint = https://license.outcold.solutions/telemetry/
216
217 # license check endpoint
218 licenseEndpoint = https://license.outcold.solutions/license/
219
220 # license server through proxy
221 # This configuration is used only for the Outcold Solutions License Server
222 # For license server running on-premises, use configuration under [license.client]
223 licenseServerProxyUrl =
224
225 # authentication with basic authorization (user:password)
226 # This configuration is used only for the Outcold Solutions License Server
227 # For license server running on-premises, use configuration under [license.client]
228 licenseServerProxyBasicAuth =
229
230 # license key
231 license =
232
233 # Environment variable $KUBERNETES_NODENAME is used by default to setup hostname
234 # Use value below to override specific name
235 hostname =
236
237 # Default output for events, logs and metrics
238 # valid values: splunk and devnull
239 # Use devnull by default if you don't want to redirect data
240 defaultOutput = splunk
241
242 # Default buffer size for file input
243 fileInputBufferSize = 256b
244
245 # Maximum size of one line the file reader can read
246 fileInputLineMaxSize = 1mb
247
248 # Include custom fields to attach to every event, in example below every event sent to Splunk will hav
249 # indexed field my_environment=dev. Fields names should match to ^[a-z][_a-z0-9]*$
250 # Better way to configure that is to specify labels for Kubernetes Nodes.
251 # ; fields.my_environment = dev
252 # Identify the cluster if you are planning to monitor multiple clusters
253 fields.kubernetes_cluster = -
254
255 # Include EC2 Metadata (see list of possible fields https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html)
256 # Should be in format ec2Metadata.{desired_field_name} = {url path to read the value}
257 # ec2Metadata.ec2_instance_id = /latest/meta-data/instance-id
258 # ec2Metadata.ec2_instance_type = /latest/meta-data/instance-type
259
260 # subdomain for the annotations added to the pods, workloads, namespaces or containers, like splunk.collectord.io/..
261 annotationsSubdomain =
262
263 # configure global thruput per second for forwarded logs (metrics are not included)
264 # for example if you set `thruputPerSecond = 512Kb`, that will limit amount of logs forwarded
265 # from the single Collectord instance to 512Kb per second.
266 # You can configure thruput individually for the logs (including specific for container logs) below
267 thruputPerSecond =
268
269 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
270 # older than 7 days
271 tooOldEvents =
272
273 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
274 tooNewEvents =
275
276 # For input.files::X and application logs, when glob or match are configured, Collectord can automatically
277 # detect gzipped files and skip them (based on the extensions or magic numbers)
278 autoSkipGzipFiles = true
279
280 # Multi-output async publishing. When enabled (default), events routed to
281 # non-default outputs are published asynchronously so that a slow or down
282 # output does not block events destined for other outputs.
283 ; multioutput.async = true
284 # Buffer size for the async proxy (default 100). Absorbs transient bursts.
285 # When this buffer and the output's own queue are both full, events are
286 # dropped immediately without blocking the pipeline.
287 ; multioutput.asyncBufferSize = 100
288
289 [license.client]
290 # point to the license located on the HTTP web server, or a hosted by the Collectord running as license server
291 url =
292 # basic authentication for the HTTP server
293 basicAuth =
294 # if SSL, ignore the certificate verification
295 insecure = false
296 # CA Path for the Server certificate
297 capath =
298 # CA Name fot the Server certificate
299 caname =
300 # license server through proxy
301 proxyUrl =
302 # authentication with basic authorization (user:password)
303 proxyBasicAuth =
304
305
306 # forward internal collectord metrics
307 [input.collectord_metrics]
308
309 # disable collectord internal metrics
310 disabled = false
311
312 # override type
313 type = kubernetes_prometheus
314
315 # how often to collect internal metrics
316 interval = 1m
317
318 # set output (splunk or devnull, default is [general]defaultOutput)
319 output =
320
321 # specify Splunk index
322 index =
323
324 # whitelist or blacklist the metrics
325 whitelist.1 = ^file_input_open$
326 whitelist.2 = ^file_input_read_bytes$
327 whitelist.3 = ^kubernetes_handlers$
328 whitelist.4 = ^pipe$
329 whitelist.5 = ^pipelines_num$
330 whitelist.6 = ^splunk_post_bytes_sum.*$
331 whitelist.7 = ^splunk_post_events_count_sum.*$
332 whitelist.8 = ^splunk_post_failed_requests$
333 whitelist.9 = ^splunk_post_message_max_lag_seconds_bucket.*$
334 whitelist.10 = ^splunk_post_requests_seconds_sum.*$
335 whitelist.11 = ^splunk_post_retries_required_sum.*$
336
337
338 # connection to kubernetes api
339 [general.kubernetes]
340
341 # Override service URL for Kubernetes (default is ${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT})
342 serviceURL =
343
344 # Environment variable $KUBERNETES_NODENAME is used by default to setup nodeName
345 # Use it only when you need to override it
346 nodeName =
347
348 # Configuration to access the API server,
349 # see https://kubernetes.io/docs/tasks/access-application-cluster/access-cluster/#accessing-the-api-from-a-pod
350 # for details
351 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
352 certPath = /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
353
354 # Default timeout for http responses. The streaming/watch requests depend on this timeout.
355 timeout = 30m
356
357 # How long to keep the cache for the recent calls to API server (to limit number of calls when collectord discovers new pods)
358 metadataTTL = 30s
359
360 # regex to find pods
361 podsCgroupFilter = ^/([^/\s]+/)*kubepods(\.slice)?/((kubepods-)?(burstable|besteffort)(\.slice)?/)?([^/]*)pod([0-9a-f]{32}|[0-9a-f\-_]{36})(\.slice)?$
362
363 # regex to find containers in the pods
364 containersCgroupFilter = ^/([^/\s]+/)*kubepods(\.slice)?/((kubepods-)?(burstable|besteffort)(\.slice)?/)?([^/]*)pod([0-9a-f]{32}|[0-9a-f\-_]{36})(\.slice)?/(docker-|crio-|cri-\w+-)?[0-9a-f]{64}(\.scope)?(\/.+)?$
365
366 # path to the kubelet root location (use it to discover application logs for emptyDir)
367 # the expected format is `pods/{pod-id}/volumes/kubernetes.io~empty-dir/{volume-name}/_data/`
368 volumesRootDir = /rootfs/var/lib/kubelet/
369
370 # You can attach annotations as a metadata, using the format
371 # includeAnnotations.{key} = {regexp}
372 # For example if you want to include all annotations that starts with `prometheus.io` or `example.com` you can include
373 # the following format:
374 # includeAnnotations.1 = ^prometheus\.io.*
375 # includeAnnotations.2 = ^example\.com.*
376
377 # You can exclude labels from metadata, using the format
378 # excludeLabels.{key} = {regexp}
379 # For example if you want to exclude all labels that starts with `prometheus.io` or `example.com` you can include
380 # the following format:
381 # excludeLabels.1 = ^prometheus\.io.*
382 # excludeLabels.2 = ^example\.com.*
383
384 # watch for changes (annotations) in the objects
385 watch.namespaces = v1/namespace
386 watch.deployments = apps/v1/deployment
387 watch.configurations = collectord.io/v1/configuration
388
389 # Collectord can review the assigned ClusterRole and traverse metadata for the Pods only for the Owner objects
390 # that are defined in the ClusterRole, ignoring anything else, it does not have access to.
391 # This way Collectord does not generate 403 requests on API Server
392 clusterRole = collectorforkubernetes
393
394 # Alternative of telling Collectord about the ClusterRole is to manually list the objects.
395 # You can define which objects Collectord should traverse when it sees Owners.
396 ; traverseOwnership.namespaces = v1/namespace
397
398 # Implementation of the watch protocol.
399 # 0 - use the default implementation (2)
400 # 1 - use the watch implementation that is optimized for the small number of objects (just issue one watch for all objects)
401 # 2 - use the watch implementation that is optimized for the large number of objects (paginate through the list of objects and issue watch for the last resource version)
402 watchImplementation = 2
403
404 # watch for pods annotations, setup prometheus collection
405 # for these pods
406 # Addon listens on Pod Network
407 # DaemonSets listen on Host Network
408 [input.prometheus_auto]
409
410 # disable prometheus auto discovery for pods
411 disabled = false
412
413 # override type
414 type = kubernetes_prometheus
415
416 # specify Splunk index
417 index =
418
419 # how often to collect prometheus metrics
420 interval = 60s
421
422 # include metrics help with the events
423 includeHelp = true
424
425 # http client timeout
426 timeout = 30s
427
428 # set output (splunk or devnull, default is [general]defaultOutput)
429 output =
430
431 # Include an Authorization header for the prometheus scrapper
432 # When configuring scrapping with collectord using annotations use prometheus.1-AuthorizationKey=key1
433 # authorization.key1 = Bearer FOO
434
435
436 # Splunk output
437 [output.splunk]
438
439 # Splunk HTTP Event Collector url
440 url =
441 # You can specify muiltiple splunk URls with
442 #
443 # urls.0 = https://server1:8088/services/collector/event/1.0
444 # urls.1 = https://server1:8088/services/collector/event/1.0
445 # urls.2 = https://server1:8088/services/collector/event/1.0
446 #
447 # Limitations:
448 # * The urls cannot have different path.
449
450 # Specify how URL should be picked up (in case if multiple is used)
451 # urlSelection = random|round-robin|random-with-round-robin
452 # where:
453 # * random - choose random url on first selection and after each failure (connection or HTTP status code >= 500)
454 # * round-robin - choose url starting from first one and bump on each failure (connection or HTTP status code >= 500)
455 # * random-with-round-robin - choose random url on first selection and after that in round-robin on each
456 # failure (connection or HTTP status code >= 500)
457 urlSelection = random-with-round-robin
458
459 # Splunk HTTP Event Collector Token
460 token =
461
462 # Allow invalid SSL server certificate
463 insecure = false
464 # minTLSVersion = TLSv1.2
465 # maxTLSVersion = TLSv1.3
466
467 # Path to CA cerificate
468 caPath =
469
470 # CA Name to verify
471 caName =
472
473 # path for client certificate (if required)
474 clientCertPath =
475
476 # path for client key (if required)
477 clientKeyPath =
478
479 # Events are batched with the maximum size set by batchSize and staying in pipeline for not longer
480 # than set by frequency
481 frequency = 5s
482 batchSize = 768K
483 # limit by the number of events (0 value has no limit on the number of events)
484 events = 50
485
486 # Splunk through proxy
487 proxyUrl =
488
489 # authentication with basic authorization (user:password)
490 proxyBasicAuth =
491
492 # Splunk acknowledgement url (.../services/collector/ack)
493 ackUrl =
494 # You can specify muiltiple splunk URls for ackUrl
495 #
496 # ackUrls.0 = https://server1:8088/services/collector/ack
497 # ackUrls.1 = https://server1:8088/services/collector/ack
498 # ackUrls.2 = https://server1:8088/services/collector/ack
499 #
500 # Make sure that they in the same order as urls for url, to make sure that this Splunk instance will be
501 # able to acknowledge the payload.
502 #
503 # Limitations:
504 # * The urls cannot have different path.
505
506 # Enable index acknowledgment
507 ackEnabled = false
508
509 # Index acknowledgment timeout
510 ackTimeout = 3m
511
512 # Timeout specifies a time limit for requests made by collectord.
513 # The timeout includes connection time, any
514 # redirects, and reading the response body.
515 timeout = 30s
516
517 # in case when pipeline can post to multiple indexes, we want to avoid posibility of blocking
518 # all pipelines, because just some events have incorrect index
519 dedicatedClientPerIndex = true
520
521 # possible values: RedirectToDefault, Drop, Retry
522 incorrectIndexBehavior = RedirectToDefault
523
524 # gzip compression level (nocompression, default, 1...9)
525 compressionLevel = default
526
527 # number of dedicated splunk output threads (to increase throughput above 4k events per second)
528 threads = 2
529 # Default algorithm between threads is roundrobin, but you can change it to weighted
530 ; threadsAlgorithm = weighted
531
532 # if you want to exclude some preindexed fields from events
533 # excludeFields.kubernetes_pod_ip = true
534
535 # By default if there are no indexes defined on the message, Collectord sends the event without the index, and
536 # Splunk HTTP Event Collector going to use the default index for the Token. You can change that, and tell Collectord
537 # to ignore all events that don't have index defined explicitly
538 ; requireExplicitIndex = true
539
540 # You can define if you want to truncate messages that are larger than 1M in length (or define your own size, like 256K)
541 ; maximumMessageLength = 1M
542
543 # For messages generated from logs, include unique `event_id` in the event
544 ; includeEventID = false
545
546 # Dedicated queue size for the output, default is 1024, larger queue sizes will require more memory,
547 # but will allow to handle more events in case of network issues
548 queueSize = 1024
549
550 # How many digits after the decimal point to keep for timestamps (0-9)
551 # Defaults to 3 (milliseconds)
552 # Change to 6 for microseconds
553 # Change to 9 for nanoseconds
554 ; timestampPrecision = 3
555
556 002-daemonset.conf: |
557 # DaemonSet configuration is used for Nodes and Masters.
558
559 // connection to CRIO
560 [general.cri-o]
561
562 # url for CRIO API, only unix socket is supported
563 url = unix:///rootfs/var/run/crio/crio.sock
564
565 # Timeout for http responses to docker client. The streaming requests depend on this timeout.
566 timeout = 1m
567
568
569 [general.containerd]
570 # Runtime can be on /rootfs/run/containerd (depends on the Linux distribution)
571 runtimePath = /rootfs/var/run/containerd
572 namespace = k8s.io
573
574
575 # cgroup input
576 [input.system_stats]
577
578 # disable system level stats
579 disabled.host = false
580 disabled.cgroup = false
581
582 # cgroups fs location
583 pathCgroups = /rootfs/sys/fs/cgroup
584
585 # proc location
586 pathProc = /rootfs/proc
587
588 # how often to collect cgroup stats
589 statsInterval = 30s
590
591 # override type
592 type.host = kubernetes_stats_v2_host
593 type.cgroup = kubernetes_stats_v2_cgroup
594
595 # specify Splunk index
596 index.host =
597 index.cgroup =
598
599 # set output (splunk or devnull, default is [general]defaultOutput)
600 output.host =
601 output.cgroup =
602
603
604 # proc input
605 [input.proc_stats]
606
607 # disable proc level stats
608 disabled = false
609
610 # proc location
611 pathProc = /rootfs/proc
612
613 # how often to collect proc stats
614 statsInterval = 30s
615
616 # override type
617 type = kubernetes_proc_stats_v2
618
619 # specify Splunk index
620 index.host =
621 index.cgroup =
622
623 # proc filesystem includes by default system threads (there can be over 100 of them)
624 # these stats do not help with the observability
625 # excluding them can reduce the size of the index, performance of the searches and usage of the collector
626 includeSystemThreads = false
627
628 # set output (splunk or devnull, default is [general]defaultOutput)
629 output.host =
630 output.cgroup =
631
632 # Hide arguments for the processes, replacing with HIDDEN_ARGS(NUMBER)
633 hideArgs = false
634
635
636 # network stats
637 [input.net_stats]
638
639 # disable net stats
640 disabled = false
641
642 # proc path location
643 pathProc = /rootfs/proc
644
645 # how often to collect net stats
646 statsInterval = 30s
647
648 # override type
649 type = kubernetes_net_stats_v2
650
651 # specify Splunk index
652 index.host =
653 index.cgroup =
654
655 # set output (splunk or devnull, default is [general]defaultOutput)
656 output.host =
657 output.cgroup =
658
659
660 # network socket table
661 [input.net_socket_table]
662
663 # disable net stats
664 disabled = false
665
666 # proc path location
667 pathProc = /rootfs/proc
668
669 # how often to collect net stats
670 statsInterval = 30s
671
672 # override type
673 type = kubernetes_net_socket_table
674
675 # specify Splunk index
676 index.host =
677 index.cgroup =
678
679 # set output (splunk or devnull, default is [general]defaultOutput)
680 output.host =
681 output.cgroup =
682
683 # group connections by tcp_state, localAddr, remoteAddr (if localPort is not the port it is listening on)
684 # that can significally reduces the amount of events
685 group = true
686
687 # Collectord can watch for services, node, and pod IP addresses, and lookup the names
688 # for the IP addresses. Keeping this enabled can add a significant load on the API Server, with large number of pods.
689 disableLookup = false
690
691
692 # mount input (collects mount stats where kubelet runtime is stored)
693 [input.mount_stats]
694
695 # disable system level stats
696 disabled = false
697
698 # how often to collect mount stats
699 statsInterval = 30s
700
701 # override type
702 type = kubernetes_mount_stats
703
704 # specify Splunk index
705 index =
706
707 # set output (splunk or devnull, default is [general]defaultOutput)
708 output =
709
710
711 # diskstats input (collects /proc/diskstats)
712 [input.disk_stats]
713
714 # disable system level stats
715 disabled = false
716
717 # how often to collect mount stats
718 statsInterval = 30s
719
720 # override type
721 type = kubernetes_disk_stats
722
723 # specify Splunk index
724 index =
725
726 # set output (splunk or devnull, default is [general]defaultOutput)
727 output =
728
729
730 # Container Log files
731 [input.files]
732
733 # disable container logs monitoring
734 disabled = false
735
736 # root location of docker log files
737 # logs are expected in standard docker format like {containerID}/{containerID}-json.log
738 # rotated files
739 path = /rootfs/var/lib/docker/containers/
740 # root location of CRI-O files
741 # logs are expected in Kubernetes format, like {podID}/{containerName}/0.log
742 crioPath = /rootfs/var/log/pods/
743
744 # (obsolete) glob matching pattern for log files
745 # glob = */*-json.log*
746
747 # files are read using polling schema, when reach the EOF how often to check if files got updated
748 pollingInterval = 250ms
749
750 # how often to look for the new files under logs path
751 walkingInterval = 5s
752
753 # include verbose fields in events (file offset)
754 verboseFields = false
755
756 # override type
757 type = kubernetes_logs
758
759 # specify Splunk index
760 index =
761
762 # docker splits events when they are larger than 10-100k (depends on the docker version)
763 # we join them together by default and forward to Splunk as one event
764 joinPartialEvents = true
765
766 # In case if your containers report messages with terminal colors or other escape sequences
767 # you can enable strip for all the containers in one place.
768 # Better is to enable it only for required container with the label collectord.io/strip-terminal-escape-sequences=true
769 stripTerminalEscapeSequences = false
770 # Regexp used for stripping terminal colors, it does not stip all the escape sequences
771 # Read https://man7.org/linux/man-pages/man4/console_codes.4.html for more information
772 stripTerminalEscapeSequencesRegex = (\x1b\[\d{1,3}(;\d{1,3})*m)|(\x07)|(\x1b]\d+(\s\d)?;[^\x07]+\x07)|(.*\x1b\[K)
773
774 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
775 samplingPercent = -1
776
777 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
778 samplingKey =
779
780 # set output (splunk or devnull, default is [general]defaultOutput)
781 output =
782
783 # configure default thruput per second for for each container log
784 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
785 # from the single container to 128Kb per second.
786 thruputPerSecond =
787
788 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
789 # older than 7 days
790 tooOldEvents =
791
792 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
793 tooNewEvents =
794
795
796 # Application Logs
797 [input.app_logs]
798
799 # disable container application logs monitoring
800 disabled = false
801
802 # root location of mounts (applies to hostPath mounts only), if the hostPath differs inside container from the path on host
803 root = /rootfs/
804
805 # how often to review list of available volumes
806 syncInterval = 5s
807
808 # glob matching pattern for log files
809 glob = *.log*
810
811 # files are read using polling schema, when reach the EOF how often to check if files got updated
812 pollingInterval = 250ms
813
814 # how often to look for the new files under logs path
815 walkingInterval = 5s
816
817 # include verbose fields in events (file offset)
818 verboseFields = false
819
820 # override type
821 type = kubernetes_logs
822
823 # specify Splunk index
824 index =
825
826 # we split files using new line character, with this configuration you can specify what defines the new event
827 # after new line
828 eventPatternRegex = ^[^\s]
829 # Maximum interval of messages in pipeline
830 eventPatternMaxInterval = 100ms
831 # Maximum time to wait for the messages in pipeline
832 eventPatternMaxWait = 1s
833 # Maximum message size
834 eventPatternMaxSize = 1MB
835
836 # set output (splunk or devnull, default is [general]defaultOutput)
837 output =
838
839 # configure default thruput per second for for each container log
840 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
841 # from the single container to 128Kb per second.
842 thruputPerSecond =
843
844 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
845 # older than 7 days
846 tooOldEvents =
847
848 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
849 tooNewEvents =
850
851 # Configure how long Collectord should keep the file descriptors open for files, that has not been forwarded yet
852 # When using PVC, and if pipeline is lagging behind, Collectord holding open fd for files, can cause long termination
853 # of pods, as kubelet cannot unmount the PVC volume from the system
854 maxHoldAfterClose = 1800s
855
856
857 # Host logs. Input syslog(.\d+)? files
858 [input.files::syslog]
859
860 # disable host level logs
861 disabled = false
862
863 # root location of docker files
864 path = /rootfs/var/log/
865
866 # regex matching pattern
867 match = ^(syslog|messages)(.\d+)?$
868
869 # limit search only on one level
870 recursive = false
871
872 # files are read using polling schema, when reach the EOF how often to check if files got updated
873 pollingInterval = 250ms
874
875 # how often o look for the new files under logs path
876 walkingInterval = 5s
877
878 # include verbose fields in events (file offset)
879 verboseFields = false
880
881 # override type
882 type = kubernetes_host_logs
883
884 # specify Splunk index
885 index =
886
887 # field extraction
888 extraction = ^(?P<timestamp>[A-Za-z]+\s+\d+\s\d+:\d+:\d+)\s(?P<syslog_hostname>[^\s]+)\s(?P<syslog_component>[^:\[]+)(\[(?P<syslog_pid>\d+)\])?: (.+)$
889 # extractionMessageField =
890
891 # timestamp field
892 timestampField = timestamp
893
894 # format for timestamp
895 # the layout defines the format by showing how the reference time, defined to be `Mon Jan 2 15:04:05 -0700 MST 2006`
896 timestampFormat = Jan 2 15:04:05
897
898 # Adjust date, if month/day aren't set in format
899 timestampSetMonth = false
900 timestampSetDay = false
901
902 # timestamp location (if not defined by format)
903 timestampLocation = Local
904
905 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
906 samplingPercent = -1
907
908 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
909 samplingKey =
910
911 # set output (splunk or devnull, default is [general]defaultOutput)
912 output =
913
914 # configure default thruput per second for this files group
915 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
916 # from the files in this group to 128Kb per second.
917 thruputPerSecond =
918
919 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
920 # older than 7 days
921 tooOldEvents =
922
923 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
924 tooNewEvents =
925
926 # by default every new event should start from not space symbol
927 eventPattern = ^[^\s]
928
929 # Blacklisting and whitelisting the logs
930 # whitelist.0 = ^regexp$
931 # blacklist.0 = ^regexp$
932
933
934 # Host logs. Input all *.log(.\d+)? files
935 [input.files::logs]
936
937 # disable host level logs
938 disabled = false
939
940 # root location of log files
941 path = /rootfs/var/log/
942
943 # regex matching pattern
944 match = ^(([\w\-.]+\.log(.[\d\-]+)?)|(docker))$
945
946 # files are read using polling schema, when reach the EOF how often to check if files got updated
947 pollingInterval = 250ms
948
949 # how often o look for the new files under logs path
950 walkingInterval = 5s
951
952 # include verbose fields in events (file offset)
953 verboseFields = false
954
955 # override type
956 type = kubernetes_host_logs
957
958 # specify Splunk index
959 index =
960
961 # field extraction
962 extraction =
963 extractionMessageField =
964
965 # timestamp field
966 timestampField =
967
968 # format for timestamp
969 # the layout defines the format by showing how the reference time, defined to be `Mon Jan 2 15:04:05 -0700 MST 2006`
970 timestampFormat =
971
972 # timestamp location (if not defined by format)
973 timestampLocation =
974
975 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
976 samplingPercent = -1
977
978 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
979 samplingKey =
980
981 # set output (splunk or devnull, default is [general]defaultOutput)
982 output =
983
984 # configure default thruput per second for this files group
985 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
986 # from the files in this group to 128Kb per second.
987 thruputPerSecond =
988
989 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
990 # older than 7 days
991 tooOldEvents =
992
993 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
994 tooNewEvents =
995
996 # by default every new event should start from not space symbol
997 eventPattern = ^[^\s]
998
999 # Blacklisting and whitelisting the logs
1000 # whitelist.0 = ^regexp$
1001 # blacklist.0 = ^regexp$
1002
1003
1004 [input.journald]
1005
1006 # disable host level logs
1007 disabled = false
1008
1009 # root location of log files
1010 path.persistent = /rootfs/var/log/journal/
1011 path.volatile = /rootfs/run/log/journal/
1012
1013 # when reach end of journald, how often to pull
1014 pollingInterval = 250ms
1015
1016 # if you don't want to forward journald from the beginning,
1017 # set the oldest event in relative value, like -14h or -30m or -30s (h/m/s supported)
1018 startFromRel =
1019
1020 # override type
1021 type = kubernetes_host_logs
1022
1023 # specify Splunk index
1024 index =
1025
1026 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
1027 samplingPercent = -1
1028
1029 # sampling key (should be regexp with the named match pattern `key`)
1030 samplingKey =
1031
1032 # how often to reopen the journald to free old files
1033 reopenInterval = 1h
1034
1035 # set output (splunk or devnull, default is [general]defaultOutput)
1036 output =
1037
1038 # configure default thruput per second for journald
1039 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
1040 # from the journald to 128Kb per second.
1041 thruputPerSecond =
1042
1043 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
1044 # older than 7 days
1045 tooOldEvents =
1046
1047 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
1048 tooNewEvents =
1049
1050 # by default every new event should start from not space symbol
1051 eventPattern = ^[^\s]
1052
1053 # Blacklisting and whitelisting the logs
1054 # whitelist.0 = ^regexp$
1055 # blacklist.0 = ^regexp$
1056
1057 # Move Journald logs reader to a separate process, to prevent process from crashing in case of corrupted log files
1058 spawnExternalProcess = false
1059
1060
1061 # Pipe to join events (container logs only)
1062 [pipe.join]
1063
1064 # disable joining event
1065 disabled = false
1066
1067 # Maximum interval of messages in pipeline
1068 maxInterval = 100ms
1069
1070 # Maximum time to wait for the messages in pipeline
1071 maxWait = 1s
1072
1073 # Maximum message size
1074 maxSize = 1MB
1075
1076 # Default pattern to indicate new message (should start not from space)
1077 patternRegex = ^[^\s]
1078
1079
1080 # (depricated, use annotations for settings up join rules)
1081 # Define special event join patterns for matched events
1082 # Section consist of [pipe.join::<name>]
1083 # [pipe.join::my_app]
1084 ## Set match pattern for the fields
1085 #; matchRegex.docker_container_image = my_app
1086 #; matchRegex.stream = stdout
1087 ## All events start from '[<digits>'
1088 #; patternRegex = ^\[\d+
1089
1090
1091 # You can configure global replace rules for the events, which can help to remove sensitive data
1092 # from logs before they are sent to Splunk. Those rules will be applied to all pipelines for container logs, host logs,
1093 # application logs and events.
1094 # In the following example we replace password=TEST with password=********
1095 ; [pipe.replace::name]
1096 ; patternRegex = (password=)([^\s]+)
1097 ; replace = $1********
1098
1099 # You can configure global hash rules for the events, which can help to hide sensitive data
1100 # from logs before they are sent to outputs. Those rules will be applied to all pipelines for container logs, host logs,
1101 # application logs and events.
1102 # In the following example we hash IP addresses with fnv-1a-64
1103 ; [pipe.hash::name]
1104 ; match = (\d{1,3}\.){3}\d{1,3}'
1105 ; function = fnv-1a-64
1106
1107
1108 [input.prometheus::kubelet]
1109
1110 # disable prometheus kubelet metrics
1111 disabled = false
1112
1113 # override type
1114 type = kubernetes_prometheus
1115
1116 # specify Splunk index
1117 index =
1118
1119 # override host (environment variables are supported, by default Kubernetes node name is used)
1120 host = ${KUBERNETES_NODENAME}
1121
1122 # override source
1123 source = kubelet
1124
1125 # how often to collect prometheus metrics
1126 interval = 60s
1127
1128 # request timeout
1129 timeout = 60s
1130
1131 # Prometheus endpoint, multiple values can be specified, collectord tries them in order till finding the first
1132 # working endpoint.
1133 # At first trying to get it through proxy
1134 endpoint.1proxy = https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}/api/v1/nodes/${KUBERNETES_NODENAME}/proxy/metrics
1135 # In case if cannot get it through proxy, trying localhost
1136 endpoint.2http = http://127.0.0.1:10255/metrics
1137
1138 # token for "Authorization: Bearer $(cat tokenPath)"
1139 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
1140
1141 # server certificate for certificate validation
1142 certPath = /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
1143
1144 # client certificate for authentication
1145 clientCertPath =
1146
1147 # Allow invalid SSL server certificate
1148 insecure = true
1149
1150 # include metrics help with the events
1151 includeHelp = false
1152
1153 # set output (splunk or devnull, default is [general]defaultOutput)
1154 output =
1155
1156 whitelist.1 = ^kubernetes_build_info$
1157 whitelist.2 = ^kubelet_runtime_operations_duration_seconds_sum$
1158 whitelist.3 = ^kubelet_docker_operations_duration_seconds_sum$
1159 whitelist.4 = ^kubelet_network_plugin_operations_duration_seconds_sum$
1160 whitelist.5 = ^kubelet_cgroup_manager_duration_seconds_sum$
1161 whitelist.6 = ^storage_operation_duration_seconds_sum$
1162 whitelist.7 = ^kubelet_docker_operations_errors_total$
1163 whitelist.8 = ^kubelet_runtime_operations_errors_total$
1164 whitelist.9 = ^rest_client_requests_total$
1165 whitelist.10 = ^process_cpu_seconds_total$
1166 whitelist.11 = ^process_resident_memory_bytes$
1167 whitelist.12 = ^process_virtual_memory_bytes$
1168 whitelist.13 = ^rest_client_request_duration_seconds_sum$
1169 whitelist.14 = ^kubelet_volume_stats_.+$
1170 whitelist.15 = ^rest_client_requests_total$
1171
1172
1173 ; # Collectord reports if entropy is low
1174 ; [diagnostics::node-entropy]
1175 ; settings.path = /rootfs/proc/sys/kernel/random/entropy_avail
1176 ; settings.interval = 1h
1177 ; settings.threshold = 800
1178
1179 # Collectord can report if node reboot is required
1180 [diagnostics::node-reboot-required]
1181 settings.path = /rootfs/var/run/reboot-required*
1182 settings.interval = 1h
1183
1184 # See https://www.kernel.org/doc/Documentation/admin-guide/hw-vuln/index.rst
1185 # And https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-devices-system-cpu
1186 [diagnostics::cpu-vulnerabilities]
1187 settings.path = /rootfs/sys/devices/system/cpu/vulnerabilities/*
1188 settings.interval = 1h
1189
1190
1191 003-daemonset-master.conf: |
1192 [input.prometheus::kubernetes-api]
1193
1194 # disable prometheus kubernetes-api metrics
1195 disabled = false
1196
1197 # override type
1198 type = kubernetes_prometheus
1199
1200 # specify Splunk index
1201 index =
1202
1203 # override host (environment variables are supported, by default Kubernetes node name is used)
1204 host = ${KUBERNETES_NODENAME}
1205
1206 # override source
1207 source = kubernetes-api
1208
1209 # how often to collect prometheus metrics
1210 interval = 60s
1211
1212 # request timeout
1213 timeout = 60s
1214
1215 # prometheus endpoint
1216 # at first trying to get it from localhost (avoiding load balancer, if multiple api servers)
1217 endpoint.1localhost = https://127.0.0.1:6443/metrics
1218 # as fallback using proxy
1219 endpoint.2kubeapi = https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}/metrics
1220
1221 # token for "Authorization: Bearer $(cat tokenPath)"
1222 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
1223
1224 # server certificate for certificate validation
1225 certPath = /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
1226
1227 # client certificate for authentication
1228 clientCertPath =
1229
1230 # Allow invalid SSL server certificate
1231 insecure = true
1232
1233 # include metrics help with the events
1234 includeHelp = false
1235
1236 # set output (splunk or devnull, default is [general]defaultOutput)
1237 output =
1238
1239 whitelist.1 = ^kubernetes_build_info$
1240 whitelist.2 = ^authenticated_user_requests$
1241 whitelist.3 = ^apiserver_request_total$
1242 whitelist.4 = ^process_cpu_seconds_total$
1243 whitelist.5 = ^process_resident_memory_bytes$
1244 whitelist.6 = ^process_virtual_memory_bytes$
1245 whitelist.7 = ^rest_client_request_duration_seconds_sum$
1246 whitelist.8 = ^rest_client_requests_total$
1247
1248
1249 # This configuration works if scheduled is bind to the localhost:10251
1250 [input.prometheus::scheduler]
1251
1252 # disable prometheus scheduler metrics
1253 disabled = false
1254
1255 # override type
1256 type = kubernetes_prometheus
1257
1258 # specify Splunk index
1259 index =
1260
1261 # override host
1262 host = ${KUBERNETES_NODENAME}
1263
1264 # override source
1265 source = scheduler
1266
1267 # how often to collect prometheus metrics
1268 interval = 60s
1269
1270 # request timeout
1271 timeout = 60s
1272
1273 # prometheus endpoint
1274 endpoint.https = https://:10259/metrics
1275 endpoint.http = http://127.0.0.1:10251/metrics
1276
1277 # token for "Authorization: Bearer $(cat tokenPath)"
1278 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
1279
1280 # server certificate for certificate validation
1281 certPath =
1282
1283 # client certificate for authentication
1284 clientCertPath =
1285
1286 # Allow invalid SSL server certificate
1287 insecure = true
1288
1289 # include metrics help with the events
1290 includeHelp = false
1291
1292 # set output (splunk or devnull, default is [general]defaultOutput)
1293 output =
1294
1295 whitelist.1 = ^kubernetes_build_info$
1296 whitelist.2 = ^scheduler_e2e_scheduling_duration_seconds_sum$
1297 whitelist.3 = ^scheduler_binding_duration_seconds_sum$
1298 whitelist.4 = ^scheduler_scheduling_algorithm_duration_seconds_sum$
1299 whitelist.5 = ^rest_client_request_duration_seconds_sum$
1300 whitelist.6 = ^rest_client_requests_total$
1301 whitelist.7 = ^process_cpu_seconds_total$
1302 whitelist.8 = ^process_resident_memory_bytes$
1303 whitelist.9 = ^process_virtual_memory_bytes$
1304
1305
1306 # This configuration works if controller-manager is bind to the localhost:10252
1307 [input.prometheus::controller-manager]
1308
1309 # disable prometheus controller-manager metrics
1310 disabled = false
1311
1312 # override type
1313 type = kubernetes_prometheus
1314
1315 # specify Splunk index
1316 index =
1317
1318 # override host
1319 host = ${KUBERNETES_NODENAME}
1320
1321 # override source
1322 source = controller-manager
1323
1324 # how often to collect prometheus metrics
1325 interval = 60s
1326
1327 # request timeout
1328 timeout = 60s
1329
1330 # prometheus endpoint
1331 endpoint.https = https://:10257/metrics
1332 endpoint.http = http://127.0.0.1:10252/metrics
1333
1334 # token for "Authorization: Bearer $(cat tokenPath)"
1335 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
1336
1337 # server certificate for certificate validation
1338 certPath =
1339
1340 # client certificate for authentication
1341 clientCertPath =
1342
1343 # Allow invalid SSL server certificate
1344 insecure = true
1345
1346 # include metrics help with the events
1347 includeHelp = false
1348
1349 # set output (splunk or devnull, default is [general]defaultOutput)
1350 output =
1351
1352 whitelist.1 = ^kubernetes_build_info$
1353 whitelist.2 = ^node_collector_zone_size$
1354 whitelist.3 = ^node_collector_zone_health$
1355 whitelist.4 = ^node_collector_unhealthy_nodes_in_zone$
1356 whitelist.5 = ^rest_client_request_duration_seconds_sum$
1357 whitelist.6 = ^rest_client_requests_total$
1358 whitelist.7 = ^process_cpu_seconds_total$
1359 whitelist.8 = ^process_resident_memory_bytes$
1360 whitelist.9 = ^process_virtual_memory_bytes$
1361
1362
1363 [input.prometheus::etcd]
1364
1365 # disable prometheus etcd metrics
1366 disabled = false
1367
1368 # override type
1369 type = kubernetes_prometheus
1370
1371 # specify Splunk index
1372 index =
1373
1374 # override host
1375 host = ${KUBERNETES_NODENAME}
1376
1377 # override source
1378 source = etcd
1379
1380 # how often to collect prometheus metricd
1381 interval = 60s
1382
1383 # request timeout
1384 timeout = 60s
1385
1386 # prometheus endpoint
1387 endpoint.http = http://:2379/metrics
1388 endpoint.https = https://:2379/metrics
1389
1390 # token for "Authorization: Bearer $(cat tokenPath)"
1391 tokenPath =
1392
1393 # server certificate for certificate validation
1394 certPath = /rootfs/etc/kubernetes/pki/etcd/ca.crt
1395
1396 # client certificate for authentication
1397 clientCertPath = /rootfs/etc/kubernetes/pki/apiserver-etcd-client.crt
1398 clientKeyPath = /rootfs/etc/kubernetes/pki/apiserver-etcd-client.key
1399
1400 # Allow invalid SSL server certificate
1401 insecure = true
1402
1403 # include metrics help with the events
1404 includeHelp = false
1405
1406 # set output (splunk or devnull, default is [general]defaultOutput)
1407 output =
1408
1409 whitelist.1 = ^etcd_server_leader_changes_seen_total$
1410 whitelist.2 = ^etcd_server_has_leader$
1411 whitelist.3 = ^etcd_server_proposals_committed_total$
1412 whitelist.4 = ^etcd_server_proposals_applied_total$
1413 whitelist.5 = ^etcd_server_proposals_committed_total$
1414 whitelist.6 = ^etcd_server_proposals_pending$
1415 whitelist.7 = ^etcd_server_proposals_failed_total$
1416 whitelist.8 = ^etcd_disk_wal_fsync_duration_seconds_sum$
1417 whitelist.9 = ^etcd_disk_wal_fsync_duration_seconds_count$
1418 whitelist.10 = ^etcd_disk_backend_commit_duration_seconds_sum$
1419 whitelist.11 = ^etcd_disk_backend_commit_duration_seconds_count$
1420 whitelist.12 = ^etcd_network_client_grpc_.*$
1421 whitelist.13 = ^grpc_server_handled_total$
1422 whitelist.14 = ^etcd_network_peer_round_trip_time_seconds_bucket$
1423 whitelist.15 = ^process_cpu_seconds_total$
1424 whitelist.16 = ^process_resident_memory_bytes$
1425 whitelist.17 = ^process_virtual_memory_bytes$
1426 whitelist.18 = ^process_open_fds$
1427 whitelist.19 = ^process_max_fds$
1428 whitelist.20 = ^etcd_disk_backend_commit_duration_seconds_bucket$
1429 whitelist.21 = ^etcd_disk_wal_fsync_duration_seconds_bucket$
1430
1431 004-addon.conf: |
1432 [general]
1433
1434 # addons can be run in parallel with agents
1435 addon = true
1436
1437 # The addon runs off the host network, so the kubelet probes /healthz and /readyz
1438 # on the pod IP - bind 0.0.0.0 here (overrides the loopback default in
1439 # 001-general.conf, which would be unreachable). Only health/ready are enabled, so
1440 # this exposes nothing beyond the probes on the cluster-internal pod IP.
1441 httpServerBinding = 0.0.0.0:11888
1442
1443 [input.kubernetes_events]
1444
1445 # disable events
1446 disabled = false
1447
1448 # override type
1449 type = kubernetes_events
1450
1451 # specify Splunk index
1452 index =
1453
1454 # set output (splunk or devnull, default is [general]defaultOutput)
1455 output =
1456
1457 # exclude managed fields from the metadata
1458 excludeManagedFields = true
1459
1460
1461 [input.kubernetes_watch::pods]
1462
1463 # disable events
1464 disabled = false
1465
1466 # Set the timeout for how often watch request should refresh the whole list
1467 refresh = 10m
1468
1469 apiVersion = v1
1470 kind = Pod
1471 namespace =
1472
1473 # override type
1474 type = kubernetes_objects
1475
1476 # specify Splunk index
1477 index =
1478
1479 # set output (splunk or devnull, default is [general]defaultOutput)
1480 output =
1481
1482 # exclude managed fields from the metadata
1483 excludeManagedFields = true
1484
1485 # you can remove or hash some values in the events (after modifyValues you can define path in the JSON object,
1486 # and the value can be hash:{hashFunction}, or remove to remove the object )
1487 ; modifyValues.object.data.* = hash:sha256
1488 ; modifyValues.object.metadata.annotations.* = remove
1489
1490 # You can exclude events by namespace with blacklist or whitelist only required namespaces
1491 # blacklist.kubernetes_namespace = ^namespace0$
1492 # whitelist.kubernetes_namespace = ^((namespace1)|(namespace2))$
1493
1494 [input.kubernetes_watch::resourcequota]
1495 # disable events
1496 disabled = false
1497
1498 # Set the timeout for how often watch request should refresh the whole list
1499 refresh = 10m
1500
1501 apiVersion = v1
1502 kind = ResourceQuota
1503 namespace =
1504
1505 # override type
1506 type = kubernetes_objects
1507
1508 # specify Splunk index
1509 index =
1510
1511 # set output (splunk or devnull, default is [general]defaultOutput)
1512 output =
1513
1514 # exclude managed fields from the metadata
1515 excludeManagedFields = true
1516
1517 [input.kubernetes_watch::nodes]
1518 # disable events
1519 disabled = false
1520
1521 # Set the timeout for how often watch request should refresh the whole list
1522 refresh = 10m
1523
1524 apiVersion = v1
1525 kind = Node
1526 namespace =
1527
1528 # override type
1529 type = kubernetes_objects
1530
1531 # specify Splunk index
1532 index =
1533
1534 # set output (splunk or devnull, default is [general]defaultOutput)
1535 output =
1536
1537 # exclude managed fields from the metadata
1538 excludeManagedFields = true
1539
1540---
1541apiVersion: apps/v1
1542kind: DaemonSet
1543metadata:
1544 name: collectorforkubernetes
1545 namespace: collectorforkubernetes
1546 labels:
1547 app: collectorforkubernetes
1548spec:
1549 # Default updateStrategy is OnDelete. For collectord RollingUpdate is suitable
1550 # When you update configuration
1551 updateStrategy:
1552 type: RollingUpdate
1553 selector:
1554 matchLabels:
1555 daemon: collectorforkubernetes
1556 template:
1557 metadata:
1558 name: collectorforkubernetes
1559 labels:
1560 daemon: collectorforkubernetes
1561 spec:
1562 priorityClassName: collectorforkubernetes-critical
1563 dnsPolicy: ClusterFirstWithHostNet
1564 hostNetwork: true
1565 serviceAccountName: collectorforkubernetes
1566 # We run this DaemonSet only for Non-Masters
1567 affinity:
1568 nodeAffinity:
1569 requiredDuringSchedulingIgnoredDuringExecution:
1570 nodeSelectorTerms:
1571 - matchExpressions:
1572 - key: node-role.kubernetes.io/control-plane
1573 operator: DoesNotExist
1574 tolerations:
1575 - operator: "Exists"
1576 effect: "NoSchedule"
1577 - operator: "Exists"
1578 effect: "NoExecute"
1579 containers:
1580 - name: collectorforkubernetes
1581 # Collectord version
1582 image: docker.io/outcoldsolutions/collectorforkubernetes:26.04.4
1583 imagePullPolicy: Always
1584 livenessProbe:
1585 httpGet:
1586 host: 127.0.0.1
1587 path: /healthz
1588 port: 11888
1589 initialDelaySeconds: 120
1590 periodSeconds: 60
1591 timeoutSeconds: 5
1592 failureThreshold: 3
1593 readinessProbe:
1594 httpGet:
1595 host: 127.0.0.1
1596 path: /readyz
1597 port: 11888
1598 initialDelaySeconds: 10
1599 periodSeconds: 15
1600 timeoutSeconds: 5
1601 failureThreshold: 3
1602 securityContext:
1603 runAsUser: 0
1604 privileged: true
1605 # Define your resources if you need. Defaults should be fine for most.
1606 # You can lower or increase based on your hosts.
1607 resources:
1608 limits:
1609 cpu: 2000m
1610 memory: 1024Mi
1611 requests:
1612 cpu: 500m
1613 memory: 256Mi
1614 env:
1615 - name: KUBERNETES_NODENAME
1616 valueFrom:
1617 fieldRef:
1618 fieldPath: spec.nodeName
1619 - name: POD_NAME
1620 valueFrom:
1621 fieldRef:
1622 fieldPath: metadata.name
1623 volumeMounts:
1624 # We store state in /data folder (file positions)
1625 - name: collectorforkubernetes-state
1626 mountPath: /data
1627 # Configuration file deployed with ConfigMap
1628 - name: collectorforkubernetes-config
1629 mountPath: /config/
1630 readOnly: true
1631 # Root filesystem to have access to logs and metrics
1632 - name: rootfs
1633 mountPath: /rootfs/
1634 readOnly: false
1635 mountPropagation: HostToContainer
1636 # correct timezone
1637 - name: localtime
1638 mountPath: /etc/localtime
1639 readOnly: true
1640 volumes:
1641 # We store state directly on host, change this location, if
1642 # your persistent volume is somewhere else
1643 - name: collectorforkubernetes-state
1644 hostPath:
1645 path: /var/lib/collectorforkubernetes/data/
1646 type: DirectoryOrCreate
1647 # Location of docker root (for container logs and metadata)
1648 - name: rootfs
1649 hostPath:
1650 path: /
1651 # correct timezone
1652 - name: localtime
1653 hostPath:
1654 path: /etc/localtime
1655 # configuration from ConfigMap
1656 - name: collectorforkubernetes-config
1657 configMap:
1658 name: collectorforkubernetes
1659 items:
1660 - key: 001-general.conf
1661 path: 001-general.conf
1662 - key: 002-daemonset.conf
1663 path: 002-daemonset.conf
1664---
1665apiVersion: apps/v1
1666kind: DaemonSet
1667metadata:
1668 name: collectorforkubernetes-master
1669 namespace: collectorforkubernetes
1670 labels:
1671 app: collectorforkubernetes
1672spec:
1673 updateStrategy:
1674 type: RollingUpdate
1675 selector:
1676 matchLabels:
1677 daemon: collectorforkubernetes
1678 template:
1679 metadata:
1680 name: collectorforkubernetes-master
1681 labels:
1682 daemon: collectorforkubernetes
1683 spec:
1684 priorityClassName: collectorforkubernetes-critical
1685 dnsPolicy: ClusterFirstWithHostNet
1686 hostNetwork: true
1687 serviceAccountName: collectorforkubernetes
1688 affinity:
1689 nodeAffinity:
1690 requiredDuringSchedulingIgnoredDuringExecution:
1691 nodeSelectorTerms:
1692 - matchExpressions:
1693 - key: node-role.kubernetes.io/control-plane
1694 operator: Exists
1695 tolerations:
1696 - operator: "Exists"
1697 effect: "NoSchedule"
1698 - operator: "Exists"
1699 effect: "NoExecute"
1700 containers:
1701 - name: collectorforkubernetes
1702 image: docker.io/outcoldsolutions/collectorforkubernetes:26.04.4
1703 imagePullPolicy: Always
1704 livenessProbe:
1705 httpGet:
1706 host: 127.0.0.1
1707 path: /healthz
1708 port: 11888
1709 initialDelaySeconds: 120
1710 periodSeconds: 60
1711 timeoutSeconds: 5
1712 failureThreshold: 3
1713 readinessProbe:
1714 httpGet:
1715 host: 127.0.0.1
1716 path: /readyz
1717 port: 11888
1718 initialDelaySeconds: 10
1719 periodSeconds: 15
1720 timeoutSeconds: 5
1721 failureThreshold: 3
1722 securityContext:
1723 runAsUser: 0
1724 privileged: true
1725 resources:
1726 limits:
1727 cpu: 2000m
1728 memory: 1024Mi
1729 requests:
1730 cpu: 500m
1731 memory: 256Mi
1732 env:
1733 - name: KUBERNETES_NODENAME
1734 valueFrom:
1735 fieldRef:
1736 fieldPath: spec.nodeName
1737 - name: POD_NAME
1738 valueFrom:
1739 fieldRef:
1740 fieldPath: metadata.name
1741 volumeMounts:
1742 - name: collectorforkubernetes-state
1743 mountPath: /data
1744 - name: collectorforkubernetes-config
1745 mountPath: /config/
1746 readOnly: true
1747 - name: rootfs
1748 mountPath: /rootfs/
1749 readOnly: false
1750 mountPropagation: HostToContainer
1751 - name: localtime
1752 mountPath: /etc/localtime
1753 readOnly: true
1754 volumes:
1755 - name: collectorforkubernetes-state
1756 hostPath:
1757 path: /var/lib/collectorforkubernetes/data/
1758 type: DirectoryOrCreate
1759 - name: rootfs
1760 hostPath:
1761 path: /
1762 - name: localtime
1763 hostPath:
1764 path: /etc/localtime
1765 - name: collectorforkubernetes-config
1766 configMap:
1767 name: collectorforkubernetes
1768 items:
1769 - key: 001-general.conf
1770 path: 001-general.conf
1771 - key: 002-daemonset.conf
1772 path: 002-daemonset.conf
1773 - key: 003-daemonset-master.conf
1774 path: 003-daemonset-master.conf
1775---
1776apiVersion: apps/v1
1777kind: Deployment
1778metadata:
1779 name: collectorforkubernetes-addon
1780 namespace: collectorforkubernetes
1781 labels:
1782 app: collectorforkubernetes
1783spec:
1784 replicas: 1
1785 selector:
1786 matchLabels:
1787 daemon: collectorforkubernetes
1788 template:
1789 metadata:
1790 name: collectorforkubernetes-addon
1791 labels:
1792 daemon: collectorforkubernetes
1793 spec:
1794 priorityClassName: collectorforkubernetes-critical
1795 serviceAccountName: collectorforkubernetes
1796 containers:
1797 - name: collectorforkubernetes
1798 image: docker.io/outcoldsolutions/collectorforkubernetes:26.04.4
1799 imagePullPolicy: Always
1800 livenessProbe:
1801 httpGet:
1802 path: /healthz
1803 port: 11888
1804 initialDelaySeconds: 120
1805 periodSeconds: 60
1806 timeoutSeconds: 5
1807 failureThreshold: 3
1808 readinessProbe:
1809 httpGet:
1810 path: /readyz
1811 port: 11888
1812 initialDelaySeconds: 10
1813 periodSeconds: 15
1814 timeoutSeconds: 5
1815 failureThreshold: 3
1816 securityContext:
1817 runAsUser: 0
1818 privileged: true
1819 resources:
1820 limits:
1821 cpu: 1000m
1822 memory: 512Mi
1823 requests:
1824 cpu: 200m
1825 memory: 64Mi
1826 env:
1827 - name: KUBERNETES_NODENAME
1828 valueFrom:
1829 fieldRef:
1830 fieldPath: spec.nodeName
1831 - name: POD_NAME
1832 valueFrom:
1833 fieldRef:
1834 fieldPath: metadata.name
1835 volumeMounts:
1836 - name: collectorforkubernetes-state
1837 mountPath: /data
1838 - name: collectorforkubernetes-config
1839 mountPath: /config/
1840 readOnly: true
1841 volumes:
1842 - name: collectorforkubernetes-state
1843 hostPath:
1844 path: /var/lib/collectorforkubernetes/data/
1845 type: Directory
1846 - name: collectorforkubernetes-config
1847 configMap:
1848 name: collectorforkubernetes
1849 items:
1850 - key: 001-general.conf
1851 path: 001-general.conf
1852 - key: 004-addon.conf
1853 path: 004-addon.conf
