1apiVersion: v1
2kind: Namespace
3metadata:
4 labels:
5 app: collectorforkubernetes
6 name: collectorforkubernetes
7---
8apiVersion: apiextensions.k8s.io/v1
9kind: CustomResourceDefinition
10metadata:
11 name: configurations.collectord.io
12spec:
13 group: collectord.io
14 versions:
15 - name: v1
16 served: true
17 storage: true
18 schema:
19 openAPIV3Schema:
20 type: object
21 properties:
22 spec:
23 type: object
24 additionalProperties: true
25 force:
26 type: boolean
27 scope: Cluster
28 names:
29 listKind: ConfigurationList
30 plural: configurations
31 singular: configuration
32 kind: Configuration
33---
34apiVersion: apiextensions.k8s.io/v1
35kind: CustomResourceDefinition
36metadata:
37 name: splunkoutputs.collectord.io
38spec:
39 group: collectord.io
40 versions:
41 - name: v1
42 served: true
43 storage: true
44 schema:
45 openAPIV3Schema:
46 type: object
47 properties:
48 spec:
49 type: object
50 properties:
51 url:
52 type: string
53 format: uri
54 insecure:
55 type: boolean
56 token:
57 type: string
58 description: "Plain token"
59 tokenFromSecret:
60 type: object
61 description: "Reference to a Kubernetes Secret"
62 properties:
63 secret:
64 type: string
65 key:
66 type: string
67 oneOf:
68 - required: ["token"]
69 - required: ["tokenFromSecret"]
70 scope: Namespaced
71 names:
72 listKind: SplunkOutputList
73 plural: splunkoutputs
74 singular: splunkoutput
75 kind: SplunkOutput
76---
77apiVersion: v1
78kind: ServiceAccount
79metadata:
80 labels:
81 app: collectorforkubernetes
82 name: collectorforkubernetes
83 namespace: collectorforkubernetes
84---
85apiVersion: scheduling.k8s.io/v1
86kind: PriorityClass
87metadata:
88 name: collectorforkubernetes-critical
89value: 1000000000
90---
91apiVersion: rbac.authorization.k8s.io/v1
92kind: ClusterRole
93metadata:
94 labels:
95 app: collectorforkubernetes
96 name: collectorforkubernetes
97rules:
98- apiGroups: ['extensions']
99 resources: ['podsecuritypolicies']
100 verbs: ['use']
101 resourceNames:
102 - privileged
103- apiGroups:
104 - ""
105 - apps
106 - batch
107 - extensions
108 - rbac.authorization.k8s.io
109 - collectord.io
110 - discovery.k8s.io
111 resources:
112 - alertmanagers
113 - clusterroles
114 - configmaps
115 - configurations
116 - cronjobs
117 - daemonsets
118 - deployments
119 - endpointslices
120 - events
121 - jobs
122 - namespaces
123 - nodes
124 - nodes/metrics
125 - nodes/proxy
126 - persistentvolumeclaims
127 - pods
128 - replicasets
129 - replicationcontrollers
130 - resourcequotas
131 - scheduledjobs
132 - secrets
133 - services
134 - splunkoutputs
135 - statefulsets
136 verbs:
137 - get
138 - list
139 - watch
140- nonResourceURLs:
141 - /metrics
142 verbs:
143 - get
144 apiGroups: []
145 resources: []
146---
147apiVersion: rbac.authorization.k8s.io/v1
148kind: ClusterRoleBinding
149metadata:
150 labels:
151 app: collectorforkubernetes
152 name: collectorforkubernetes
153roleRef:
154 apiGroup: rbac.authorization.k8s.io
155 kind: ClusterRole
156 name: collectorforkubernetes
157subjects:
158 - kind: ServiceAccount
159 name: collectorforkubernetes
160 namespace: collectorforkubernetes
161---
162apiVersion: v1
163kind: ConfigMap
164metadata:
165 name: collectorforkubernetes
166 namespace: collectorforkubernetes
167 labels:
168 app: collectorforkubernetes
169data:
170 001-general.conf: |
171 # The general configuration is used for all deployments
172 #
173 # Run collectord with the flag -conf and specify location of the configuration files.
174 #
175 # You can override all the values using environment variables with the format like
176 # COLLECTOR__<ANYNAME>=<section>__<key>=<value>
177 # As an example you can set dataPath in [general] section as
178 # COLLECTOR__DATAPATH=general__dataPath=C:\\some\\path\\data.db
179 # This parameter can be configured using -env-override, set it to empty string to disable this feature
180
181 [general]
182
183 # Please review license https://www.outcoldsolutions.com/legal/license-agreement/
184 # and accept license by changing the value to *true*
185 acceptLicense = false
186
187 # Location for the database
188 # Collectord stores positions of the files and internal state
189 dataPath = ./data/
190
191 # log level (accepted values are trace, debug, info, warn, error, fatal)
192 logLevel = info
193
194 # Internal http server. Bound to loopback so nothing is published on the node
195 # network: the DaemonSets run on the host network, where a 0.0.0.0 bind would
196 # expose these endpoints on the node IP. The liveness/readiness probes still reach
197 # it via httpGet.host 127.0.0.1 (the kubelet shares the host network namespace).
198 # The addon runs off the host network and overrides this to 0.0.0.0 in
199 # 004-addon.conf so the kubelet can reach it on the pod IP.
200 httpServerBinding = 127.0.0.1:11888
201
202 # Enable endpoints individually. Only the probe endpoints default on. metrics
203 # (/metrics/json, /metrics/prometheus) and pprof (/debug/pprof) expose internal
204 # detail and are unreachable on a loopback bind anyway - to scrape or profile,
205 # enable the endpoint and widen httpServerBinding (e.g. 0.0.0.0:11888).
206 httpServerEndpoints.health = true
207 httpServerEndpoints.ready = true
208 httpServerEndpoints.metrics = false
209 httpServerEndpoints.pprof = false
210
211 # log requests to the http server
212 httpServerLog = false
213
214 # telemetry report endpoint, set it to empty string to disable telemetry
215 telemetryEndpoint = https://license.outcold.solutions/telemetry/
216
217 # license check endpoint
218 licenseEndpoint = https://license.outcold.solutions/license/
219
220 # license server through proxy
221 # This configuration is used only for the Outcold Solutions License Server
222 # For license server running on-premises, use configuration under [license.client]
223 licenseServerProxyUrl =
224
225 # authentication with basic authorization (user:password)
226 # This configuration is used only for the Outcold Solutions License Server
227 # For license server running on-premises, use configuration under [license.client]
228 licenseServerProxyBasicAuth =
229
230 # license key
231 license =
232
233 # Environment variable $KUBERNETES_NODENAME is used by default to setup hostname
234 # Use value below to override specific name
235 hostname =
236
237 # Default output for events, logs and metrics
238 # valid values: splunk and devnull
239 # Use devnull by default if you don't want to redirect data
240 defaultOutput = splunk
241
242 # Buffer size for file reads. 8k matches the common filesystem block size and
243 # cuts the number of read syscalls substantially versus the historical 256b.
244 fileInputBufferSize = 8k
245
246 # Maximum size of one line the file reader can read
247 fileInputLineMaxSize = 1mb
248
249 # Include custom fields to attach to every event, in example below every event sent to Splunk will hav
250 # indexed field my_environment=dev. Fields names should match to ^[a-z][_a-z0-9]*$
251 # Better way to configure that is to specify labels for Kubernetes Nodes.
252 # ; fields.my_environment = dev
253 # Identify the cluster if you are planning to monitor multiple clusters
254 fields.kubernetes_cluster = -
255
256 # Include EC2 Metadata (see list of possible fields https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html)
257 # Should be in format ec2Metadata.{desired_field_name} = {url path to read the value}
258 # ec2Metadata.ec2_instance_id = /latest/meta-data/instance-id
259 # ec2Metadata.ec2_instance_type = /latest/meta-data/instance-type
260
261 # subdomain for the annotations added to the pods, workloads, namespaces or containers, like splunk.collectord.io/..
262 annotationsSubdomain =
263
264 # configure global thruput per second for forwarded logs (metrics are not included)
265 # for example if you set `thruputPerSecond = 512Kb`, that will limit amount of logs forwarded
266 # from the single Collectord instance to 512Kb per second.
267 # You can configure thruput individually for the logs (including specific for container logs) below
268 thruputPerSecond =
269
270 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
271 # older than 7 days
272 tooOldEvents =
273
274 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
275 tooNewEvents =
276
277 # For input.files::X and application logs, when glob or match are configured, Collectord can automatically
278 # detect gzipped files and skip them (based on the extensions or magic numbers)
279 autoSkipGzipFiles = true
280
281 # Multi-output async publishing. When enabled (default), events routed to
282 # non-default outputs are published asynchronously so that a slow or down
283 # output does not block events destined for other outputs.
284 ; multioutput.async = true
285 # Buffer size for the async proxy (default 100). Absorbs transient bursts.
286 # When this buffer and the output's own queue are both full, events are
287 # dropped immediately without blocking the pipeline.
288 ; multioutput.asyncBufferSize = 100
289
290 [license.client]
291 # point to the license located on the HTTP web server, or a hosted by the Collectord running as license server
292 url =
293 # basic authentication for the HTTP server
294 basicAuth =
295 # if SSL, ignore the certificate verification
296 insecure = false
297 # CA Path for the Server certificate
298 capath =
299 # CA Name fot the Server certificate
300 caname =
301 # license server through proxy
302 proxyUrl =
303 # authentication with basic authorization (user:password)
304 proxyBasicAuth =
305
306
307 # forward internal collectord metrics
308 [input.collectord_metrics]
309
310 # disable collectord internal metrics
311 disabled = false
312
313 # override type
314 type = kubernetes_prometheus
315
316 # how often to collect internal metrics
317 interval = 1m
318
319 # set output (splunk or devnull, default is [general]defaultOutput)
320 output =
321
322 # specify Splunk index
323 index =
324
325 # whitelist or blacklist the metrics
326 whitelist.1 = ^file_input_open$
327 whitelist.2 = ^file_input_read_bytes$
328 whitelist.3 = ^kubernetes_handlers$
329 whitelist.4 = ^pipe$
330 whitelist.5 = ^pipelines_num$
331 whitelist.6 = ^splunk_post_bytes_sum.*$
332 whitelist.7 = ^splunk_post_events_count_sum.*$
333 whitelist.8 = ^splunk_post_failed_requests$
334 whitelist.9 = ^splunk_post_message_max_lag_seconds_bucket.*$
335 whitelist.10 = ^splunk_post_requests_seconds_sum.*$
336 whitelist.11 = ^splunk_post_retries_required_sum.*$
337
338
339 # connection to kubernetes api
340 [general.kubernetes]
341
342 # Override service URL for Kubernetes (default is ${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT})
343 serviceURL =
344
345 # Environment variable $KUBERNETES_NODENAME is used by default to setup nodeName
346 # Use it only when you need to override it
347 nodeName =
348
349 # Configuration to access the API server,
350 # see https://kubernetes.io/docs/tasks/access-application-cluster/access-cluster/#accessing-the-api-from-a-pod
351 # for details
352 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
353 certPath = /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
354
355 # Default timeout for http responses. The streaming/watch requests depend on this timeout.
356 timeout = 30m
357
358 # How long to keep the cache for the recent calls to API server (to limit number of calls when collectord discovers new pods)
359 metadataTTL = 30s
360
361 # regex to find pods
362 podsCgroupFilter = ^/([^/\s]+/)*kubepods(\.slice)?/((kubepods-)?(burstable|besteffort)(\.slice)?/)?([^/]*)pod([0-9a-f]{32}|[0-9a-f\-_]{36})(\.slice)?$
363
364 # regex to find containers in the pods
365 containersCgroupFilter = ^/([^/\s]+/)*kubepods(\.slice)?/((kubepods-)?(burstable|besteffort)(\.slice)?/)?([^/]*)pod([0-9a-f]{32}|[0-9a-f\-_]{36})(\.slice)?/(docker-|crio-|cri-\w+-)?[0-9a-f]{64}(\.scope)?(\/.+)?$
366
367 # path to the kubelet root location (use it to discover application logs for emptyDir)
368 # the expected format is `pods/{pod-id}/volumes/kubernetes.io~empty-dir/{volume-name}/_data/`
369 volumesRootDir = /rootfs/var/lib/kubelet/
370
371 # You can attach annotations as a metadata, using the format
372 # includeAnnotations.{key} = {regexp}
373 # For example if you want to include all annotations that starts with `prometheus.io` or `example.com` you can include
374 # the following format:
375 # includeAnnotations.1 = ^prometheus\.io.*
376 # includeAnnotations.2 = ^example\.com.*
377
378 # You can exclude labels from metadata, using the format
379 # excludeLabels.{key} = {regexp}
380 # For example if you want to exclude all labels that starts with `prometheus.io` or `example.com` you can include
381 # the following format:
382 # excludeLabels.1 = ^prometheus\.io.*
383 # excludeLabels.2 = ^example\.com.*
384
385 # watch for changes (annotations) in the objects
386 watch.namespaces = v1/namespace
387 watch.deployments = apps/v1/deployment
388 watch.configurations = collectord.io/v1/configuration
389
390 # Collectord can review the assigned ClusterRole and traverse metadata for the Pods only for the Owner objects
391 # that are defined in the ClusterRole, ignoring anything else, it does not have access to.
392 # This way Collectord does not generate 403 requests on API Server
393 clusterRole = collectorforkubernetes
394
395 # Alternative of telling Collectord about the ClusterRole is to manually list the objects.
396 # You can define which objects Collectord should traverse when it sees Owners.
397 ; traverseOwnership.namespaces = v1/namespace
398
399 # Implementation of the watch protocol.
400 # 0 - use the default implementation (2)
401 # 1 - use the watch implementation that is optimized for the small number of objects (just issue one watch for all objects)
402 # 2 - use the watch implementation that is optimized for the large number of objects (paginate through the list of objects and issue watch for the last resource version)
403 watchImplementation = 2
404
405 # watch for pods annotations, setup prometheus collection
406 # for these pods
407 # Addon listens on Pod Network
408 # DaemonSets listen on Host Network
409 [input.prometheus_auto]
410
411 # disable prometheus auto discovery for pods
412 disabled = false
413
414 # override type
415 type = kubernetes_prometheus
416
417 # specify Splunk index
418 index =
419
420 # how often to collect prometheus metrics
421 interval = 60s
422
423 # include metrics help with the events
424 includeHelp = true
425
426 # http client timeout
427 timeout = 30s
428
429 # set output (splunk or devnull, default is [general]defaultOutput)
430 output =
431
432 # Include an Authorization header for the prometheus scrapper
433 # When configuring scrapping with collectord using annotations use prometheus.1-AuthorizationKey=key1
434 # authorization.key1 = Bearer FOO
435
436
437 # Splunk output
438 [output.splunk]
439
440 # Splunk HTTP Event Collector url
441 url =
442 # You can specify muiltiple splunk URls with
443 #
444 # urls.0 = https://server1:8088/services/collector/event/1.0
445 # urls.1 = https://server1:8088/services/collector/event/1.0
446 # urls.2 = https://server1:8088/services/collector/event/1.0
447 #
448 # Limitations:
449 # * The urls cannot have different path.
450
451 # Specify how URL should be picked up (in case if multiple is used)
452 # urlSelection = random|round-robin|random-with-round-robin
453 # where:
454 # * random - choose random url on first selection and after each failure (connection or HTTP status code >= 500)
455 # * round-robin - choose url starting from first one and bump on each failure (connection or HTTP status code >= 500)
456 # * random-with-round-robin - choose random url on first selection and after that in round-robin on each
457 # failure (connection or HTTP status code >= 500)
458 urlSelection = random-with-round-robin
459
460 # Splunk HTTP Event Collector Token
461 token =
462
463 # Allow invalid SSL server certificate
464 insecure = false
465 # minTLSVersion = TLSv1.2
466 # maxTLSVersion = TLSv1.3
467
468 # Path to CA cerificate
469 caPath =
470
471 # CA Name to verify
472 caName =
473
474 # path for client certificate (if required)
475 clientCertPath =
476
477 # path for client key (if required)
478 clientKeyPath =
479
480 # Events are batched with the maximum size set by batchSize and staying in pipeline for not longer
481 # than set by frequency
482 frequency = 5s
483 batchSize = 768K
484 # limit by the number of events (0 value has no limit on the number of events)
485 events = 50
486
487 # Splunk through proxy
488 proxyUrl =
489
490 # authentication with basic authorization (user:password)
491 proxyBasicAuth =
492
493 # Splunk acknowledgement url (.../services/collector/ack)
494 ackUrl =
495 # You can specify muiltiple splunk URls for ackUrl
496 #
497 # ackUrls.0 = https://server1:8088/services/collector/ack
498 # ackUrls.1 = https://server1:8088/services/collector/ack
499 # ackUrls.2 = https://server1:8088/services/collector/ack
500 #
501 # Make sure that they in the same order as urls for url, to make sure that this Splunk instance will be
502 # able to acknowledge the payload.
503 #
504 # Limitations:
505 # * The urls cannot have different path.
506
507 # Enable index acknowledgment
508 ackEnabled = false
509
510 # Index acknowledgment timeout
511 ackTimeout = 3m
512
513 # Timeout specifies a time limit for requests made by collectord.
514 # The timeout includes connection time, any
515 # redirects, and reading the response body.
516 timeout = 30s
517
518 # in case when pipeline can post to multiple indexes, we want to avoid posibility of blocking
519 # all pipelines, because just some events have incorrect index
520 dedicatedClientPerIndex = true
521
522 # possible values: RedirectToDefault, Drop, Retry
523 incorrectIndexBehavior = RedirectToDefault
524
525 # gzip compression level (nocompression, default, 1...9)
526 compressionLevel = default
527
528 # number of dedicated splunk output threads (to increase throughput above 4k events per second)
529 threads = 2
530 # Default algorithm between threads is roundrobin, but you can change it to weighted
531 ; threadsAlgorithm = weighted
532
533 # if you want to exclude some preindexed fields from events
534 # excludeFields.kubernetes_pod_ip = true
535
536 # By default if there are no indexes defined on the message, Collectord sends the event without the index, and
537 # Splunk HTTP Event Collector going to use the default index for the Token. You can change that, and tell Collectord
538 # to ignore all events that don't have index defined explicitly
539 ; requireExplicitIndex = true
540
541 # You can define if you want to truncate messages that are larger than 1M in length (or define your own size, like 256K)
542 ; maximumMessageLength = 1M
543
544 # For messages generated from logs, include unique `event_id` in the event
545 ; includeEventID = false
546
547 # Dedicated queue size for the output, default is 1024, larger queue sizes will require more memory,
548 # but will allow to handle more events in case of network issues
549 queueSize = 1024
550
551 # How many digits after the decimal point to keep for timestamps (0-9)
552 # Defaults to 3 (milliseconds)
553 # Change to 6 for microseconds
554 # Change to 9 for nanoseconds
555 ; timestampPrecision = 3
556
557 002-daemonset.conf: |
558 # DaemonSet configuration is used for Nodes and Masters.
559
560 // connection to CRIO
561 [general.cri-o]
562
563 # url for CRIO API, only unix socket is supported
564 url = unix:///rootfs/var/run/crio/crio.sock
565
566 # Timeout for http responses to docker client. The streaming requests depend on this timeout.
567 timeout = 1m
568
569
570 [general.containerd]
571 # Runtime can be on /rootfs/run/containerd (depends on the Linux distribution)
572 runtimePath = /rootfs/var/run/containerd
573 namespace = k8s.io
574
575
576 # cgroup input
577 [input.system_stats]
578
579 # disable system level stats
580 disabled.host = false
581 disabled.cgroup = false
582
583 # cgroups fs location
584 pathCgroups = /rootfs/sys/fs/cgroup
585
586 # proc location
587 pathProc = /rootfs/proc
588
589 # how often to collect cgroup stats
590 statsInterval = 30s
591
592 # override type
593 type.host = kubernetes_stats_v2_host
594 type.cgroup = kubernetes_stats_v2_cgroup
595
596 # specify Splunk index
597 index.host =
598 index.cgroup =
599
600 # set output (splunk or devnull, default is [general]defaultOutput)
601 output.host =
602 output.cgroup =
603
604
605 # proc input
606 [input.proc_stats]
607
608 # disable proc level stats
609 disabled = false
610
611 # proc location
612 pathProc = /rootfs/proc
613
614 # how often to collect proc stats
615 statsInterval = 30s
616
617 # override type
618 type = kubernetes_proc_stats_v2
619
620 # specify Splunk index
621 index.host =
622 index.cgroup =
623
624 # proc filesystem includes by default system threads (there can be over 100 of them)
625 # these stats do not help with the observability
626 # excluding them can reduce the size of the index, performance of the searches and usage of the collector
627 includeSystemThreads = false
628
629 # set output (splunk or devnull, default is [general]defaultOutput)
630 output.host =
631 output.cgroup =
632
633 # Hide arguments for the processes, replacing with HIDDEN_ARGS(NUMBER)
634 hideArgs = false
635
636
637 # network stats
638 [input.net_stats]
639
640 # disable net stats
641 disabled = false
642
643 # proc path location
644 pathProc = /rootfs/proc
645
646 # how often to collect net stats
647 statsInterval = 30s
648
649 # override type
650 type = kubernetes_net_stats_v2
651
652 # specify Splunk index
653 index.host =
654 index.cgroup =
655
656 # set output (splunk or devnull, default is [general]defaultOutput)
657 output.host =
658 output.cgroup =
659
660
661 # network socket table
662 [input.net_socket_table]
663
664 # disable net stats
665 disabled = false
666
667 # proc path location
668 pathProc = /rootfs/proc
669
670 # how often to collect net stats
671 statsInterval = 30s
672
673 # override type
674 type = kubernetes_net_socket_table
675
676 # specify Splunk index
677 index.host =
678 index.cgroup =
679
680 # set output (splunk or devnull, default is [general]defaultOutput)
681 output.host =
682 output.cgroup =
683
684 # group connections by tcp_state, localAddr, remoteAddr (if localPort is not the port it is listening on)
685 # that can significally reduces the amount of events
686 group = true
687
688 # Collectord can watch for services, node, and pod IP addresses, and lookup the names
689 # for the IP addresses. Keeping this enabled can add a significant load on the API Server, with large number of pods.
690 disableLookup = false
691
692
693 # mount input (collects mount stats where kubelet runtime is stored)
694 [input.mount_stats]
695
696 # disable system level stats
697 disabled = false
698
699 # how often to collect mount stats
700 statsInterval = 30s
701
702 # override type
703 type = kubernetes_mount_stats
704
705 # specify Splunk index
706 index =
707
708 # set output (splunk or devnull, default is [general]defaultOutput)
709 output =
710
711
712 # diskstats input (collects /proc/diskstats)
713 [input.disk_stats]
714
715 # disable system level stats
716 disabled = false
717
718 # how often to collect mount stats
719 statsInterval = 30s
720
721 # override type
722 type = kubernetes_disk_stats
723
724 # specify Splunk index
725 index =
726
727 # set output (splunk or devnull, default is [general]defaultOutput)
728 output =
729
730
731 # Container Log files
732 [input.files]
733
734 # disable container logs monitoring
735 disabled = false
736
737 # root location of docker log files
738 # logs are expected in standard docker format like {containerID}/{containerID}-json.log
739 # rotated files
740 path = /rootfs/var/lib/docker/containers/
741 # root location of CRI-O files
742 # logs are expected in Kubernetes format, like {podID}/{containerName}/0.log
743 crioPath = /rootfs/var/log/pods/
744
745 # (obsolete) glob matching pattern for log files
746 # glob = */*-json.log*
747
748 # files are read using polling schema, when reach the EOF how often to check if files got updated
749 pollingInterval = 250ms
750
751 # how often to look for the new files under logs path
752 walkingInterval = 5s
753
754 # include verbose fields in events (file offset)
755 verboseFields = false
756
757 # override type
758 type = kubernetes_logs
759
760 # specify Splunk index
761 index =
762
763 # docker splits events when they are larger than 10-100k (depends on the docker version)
764 # we join them together by default and forward to Splunk as one event
765 joinPartialEvents = true
766
767 # In case if your containers report messages with terminal colors or other escape sequences
768 # you can enable strip for all the containers in one place.
769 # Better is to enable it only for required container with the label collectord.io/strip-terminal-escape-sequences=true
770 stripTerminalEscapeSequences = false
771 # Regexp used for stripping terminal colors, it does not stip all the escape sequences
772 # Read https://man7.org/linux/man-pages/man4/console_codes.4.html for more information
773 stripTerminalEscapeSequencesRegex = (\x1b\[\d{1,3}(;\d{1,3})*m)|(\x07)|(\x1b]\d+(\s\d)?;[^\x07]+\x07)|(.*\x1b\[K)
774
775 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
776 samplingPercent = -1
777
778 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
779 samplingKey =
780
781 # set output (splunk or devnull, default is [general]defaultOutput)
782 output =
783
784 # configure default thruput per second for for each container log
785 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
786 # from the single container to 128Kb per second.
787 thruputPerSecond =
788
789 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
790 # older than 7 days
791 tooOldEvents =
792
793 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
794 tooNewEvents =
795
796
797 # Application Logs
798 [input.app_logs]
799
800 # disable container application logs monitoring
801 disabled = false
802
803 # root location of mounts (applies to hostPath mounts only), if the hostPath differs inside container from the path on host
804 root = /rootfs/
805
806 # how often to review list of available volumes
807 syncInterval = 5s
808
809 # glob matching pattern for log files
810 glob = *.log*
811
812 # files are read using polling schema, when reach the EOF how often to check if files got updated
813 pollingInterval = 250ms
814
815 # how often to look for the new files under logs path
816 walkingInterval = 5s
817
818 # include verbose fields in events (file offset)
819 verboseFields = false
820
821 # override type
822 type = kubernetes_logs
823
824 # specify Splunk index
825 index =
826
827 # we split files using new line character, with this configuration you can specify what defines the new event
828 # after new line
829 eventPatternRegex = ^[^\s]
830 # Maximum interval of messages in pipeline
831 eventPatternMaxInterval = 100ms
832 # Maximum time to wait for the messages in pipeline
833 eventPatternMaxWait = 1s
834 # Maximum message size
835 eventPatternMaxSize = 1MB
836
837 # set output (splunk or devnull, default is [general]defaultOutput)
838 output =
839
840 # configure default thruput per second for for each container log
841 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
842 # from the single container to 128Kb per second.
843 thruputPerSecond =
844
845 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
846 # older than 7 days
847 tooOldEvents =
848
849 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
850 tooNewEvents =
851
852 # Configure how long Collectord should keep the file descriptors open for files, that has not been forwarded yet
853 # When using PVC, and if pipeline is lagging behind, Collectord holding open fd for files, can cause long termination
854 # of pods, as kubelet cannot unmount the PVC volume from the system
855 maxHoldAfterClose = 1800s
856
857
858 # Host logs. Input syslog(.\d+)? files
859 [input.files::syslog]
860
861 # disable host level logs
862 disabled = false
863
864 # root location of docker files
865 path = /rootfs/var/log/
866
867 # regex matching pattern
868 match = ^(syslog|messages)(.\d+)?$
869
870 # limit search only on one level
871 recursive = false
872
873 # files are read using polling schema, when reach the EOF how often to check if files got updated
874 pollingInterval = 250ms
875
876 # how often o look for the new files under logs path
877 walkingInterval = 5s
878
879 # include verbose fields in events (file offset)
880 verboseFields = false
881
882 # override type
883 type = kubernetes_host_logs
884
885 # specify Splunk index
886 index =
887
888 # field extraction
889 extraction = ^(?P<timestamp>[A-Za-z]+\s+\d+\s\d+:\d+:\d+)\s(?P<syslog_hostname>[^\s]+)\s(?P<syslog_component>[^:\[]+)(\[(?P<syslog_pid>\d+)\])?: (.+)$
890 # extractionMessageField =
891
892 # timestamp field
893 timestampField = timestamp
894
895 # format for timestamp
896 # the layout defines the format by showing how the reference time, defined to be `Mon Jan 2 15:04:05 -0700 MST 2006`
897 timestampFormat = Jan 2 15:04:05
898
899 # Adjust date, if month/day aren't set in format
900 timestampSetMonth = false
901 timestampSetDay = false
902
903 # timestamp location (if not defined by format)
904 timestampLocation = Local
905
906 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
907 samplingPercent = -1
908
909 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
910 samplingKey =
911
912 # set output (splunk or devnull, default is [general]defaultOutput)
913 output =
914
915 # configure default thruput per second for this files group
916 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
917 # from the files in this group to 128Kb per second.
918 thruputPerSecond =
919
920 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
921 # older than 7 days
922 tooOldEvents =
923
924 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
925 tooNewEvents =
926
927 # by default every new event should start from not space symbol
928 eventPattern = ^[^\s]
929
930 # Blacklisting and whitelisting the logs
931 # whitelist.0 = ^regexp$
932 # blacklist.0 = ^regexp$
933
934
935 # Host logs. Input all *.log(.\d+)? files
936 [input.files::logs]
937
938 # disable host level logs
939 disabled = false
940
941 # root location of log files
942 path = /rootfs/var/log/
943
944 # regex matching pattern
945 match = ^(([\w\-.]+\.log(.[\d\-]+)?)|(docker))$
946
947 # files are read using polling schema, when reach the EOF how often to check if files got updated
948 pollingInterval = 250ms
949
950 # how often o look for the new files under logs path
951 walkingInterval = 5s
952
953 # include verbose fields in events (file offset)
954 verboseFields = false
955
956 # override type
957 type = kubernetes_host_logs
958
959 # specify Splunk index
960 index =
961
962 # field extraction
963 extraction =
964 extractionMessageField =
965
966 # timestamp field
967 timestampField =
968
969 # format for timestamp
970 # the layout defines the format by showing how the reference time, defined to be `Mon Jan 2 15:04:05 -0700 MST 2006`
971 timestampFormat =
972
973 # timestamp location (if not defined by format)
974 timestampLocation =
975
976 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
977 samplingPercent = -1
978
979 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
980 samplingKey =
981
982 # set output (splunk or devnull, default is [general]defaultOutput)
983 output =
984
985 # configure default thruput per second for this files group
986 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
987 # from the files in this group to 128Kb per second.
988 thruputPerSecond =
989
990 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
991 # older than 7 days
992 tooOldEvents =
993
994 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
995 tooNewEvents =
996
997 # by default every new event should start from not space symbol
998 eventPattern = ^[^\s]
999
1000 # Blacklisting and whitelisting the logs
1001 # whitelist.0 = ^regexp$
1002 # blacklist.0 = ^regexp$
1003
1004
1005 [input.journald]
1006
1007 # disable host level logs
1008 disabled = false
1009
1010 # root location of log files
1011 path.persistent = /rootfs/var/log/journal/
1012 path.volatile = /rootfs/run/log/journal/
1013
1014 # when reach end of journald, how often to pull
1015 pollingInterval = 250ms
1016
1017 # if you don't want to forward journald from the beginning,
1018 # set the oldest event in relative value, like -14h or -30m or -30s (h/m/s supported)
1019 startFromRel =
1020
1021 # override type
1022 type = kubernetes_host_logs
1023
1024 # specify Splunk index
1025 index =
1026
1027 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
1028 samplingPercent = -1
1029
1030 # sampling key (should be regexp with the named match pattern `key`)
1031 samplingKey =
1032
1033 # how often to reopen the journald to free old files
1034 reopenInterval = 1h
1035
1036 # set output (splunk or devnull, default is [general]defaultOutput)
1037 output =
1038
1039 # configure default thruput per second for journald
1040 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
1041 # from the journald to 128Kb per second.
1042 thruputPerSecond =
1043
1044 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
1045 # older than 7 days
1046 tooOldEvents =
1047
1048 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
1049 tooNewEvents =
1050
1051 # by default every new event should start from not space symbol
1052 eventPattern = ^[^\s]
1053
1054 # Blacklisting and whitelisting the logs
1055 # whitelist.0 = ^regexp$
1056 # blacklist.0 = ^regexp$
1057
1058 # Move Journald logs reader to a separate process, to prevent process from crashing in case of corrupted log files
1059 spawnExternalProcess = false
1060
1061
1062 # Pipe to join events (container logs only)
1063 [pipe.join]
1064
1065 # disable joining event
1066 disabled = false
1067
1068 # Maximum interval of messages in pipeline
1069 maxInterval = 100ms
1070
1071 # Maximum time to wait for the messages in pipeline
1072 maxWait = 1s
1073
1074 # Maximum message size
1075 maxSize = 1MB
1076
1077 # Default pattern to indicate new message (should start not from space)
1078 patternRegex = ^[^\s]
1079
1080
1081 # (depricated, use annotations for settings up join rules)
1082 # Define special event join patterns for matched events
1083 # Section consist of [pipe.join::<name>]
1084 # [pipe.join::my_app]
1085 ## Set match pattern for the fields
1086 #; matchRegex.docker_container_image = my_app
1087 #; matchRegex.stream = stdout
1088 ## All events start from '[<digits>'
1089 #; patternRegex = ^\[\d+
1090
1091
1092 # You can configure global replace rules for the events, which can help to remove sensitive data
1093 # from logs before they are sent to Splunk. Those rules will be applied to all pipelines for container logs, host logs,
1094 # application logs and events.
1095 # In the following example we replace password=TEST with password=********
1096 ; [pipe.replace::name]
1097 ; patternRegex = (password=)([^\s]+)
1098 ; replace = $1********
1099
1100 # You can configure global hash rules for the events, which can help to hide sensitive data
1101 # from logs before they are sent to outputs. Those rules will be applied to all pipelines for container logs, host logs,
1102 # application logs and events.
1103 # In the following example we hash IP addresses with fnv-1a-64
1104 ; [pipe.hash::name]
1105 ; match = (\d{1,3}\.){3}\d{1,3}'
1106 ; function = fnv-1a-64
1107
1108
1109 [input.prometheus::kubelet]
1110
1111 # disable prometheus kubelet metrics
1112 disabled = false
1113
1114 # override type
1115 type = kubernetes_prometheus
1116
1117 # specify Splunk index
1118 index =
1119
1120 # override host (environment variables are supported, by default Kubernetes node name is used)
1121 host = ${KUBERNETES_NODENAME}
1122
1123 # override source
1124 source = kubelet
1125
1126 # how often to collect prometheus metrics
1127 interval = 60s
1128
1129 # request timeout
1130 timeout = 60s
1131
1132 # Prometheus endpoint, multiple values can be specified, collectord tries them in order till finding the first
1133 # working endpoint.
1134 # At first trying to get it through proxy
1135 endpoint.1proxy = https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}/api/v1/nodes/${KUBERNETES_NODENAME}/proxy/metrics
1136 # In case if cannot get it through proxy, trying localhost
1137 endpoint.2http = http://127.0.0.1:10255/metrics
1138
1139 # token for "Authorization: Bearer $(cat tokenPath)"
1140 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
1141
1142 # server certificate for certificate validation
1143 certPath = /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
1144
1145 # client certificate for authentication
1146 clientCertPath =
1147
1148 # Allow invalid SSL server certificate
1149 insecure = true
1150
1151 # include metrics help with the events
1152 includeHelp = false
1153
1154 # set output (splunk or devnull, default is [general]defaultOutput)
1155 output =
1156
1157 whitelist.1 = ^kubernetes_build_info$
1158 whitelist.2 = ^kubelet_runtime_operations_duration_seconds_sum$
1159 whitelist.3 = ^kubelet_docker_operations_duration_seconds_sum$
1160 whitelist.4 = ^kubelet_network_plugin_operations_duration_seconds_sum$
1161 whitelist.5 = ^kubelet_cgroup_manager_duration_seconds_sum$
1162 whitelist.6 = ^storage_operation_duration_seconds_sum$
1163 whitelist.7 = ^kubelet_docker_operations_errors_total$
1164 whitelist.8 = ^kubelet_runtime_operations_errors_total$
1165 whitelist.9 = ^rest_client_requests_total$
1166 whitelist.10 = ^process_cpu_seconds_total$
1167 whitelist.11 = ^process_resident_memory_bytes$
1168 whitelist.12 = ^process_virtual_memory_bytes$
1169 whitelist.13 = ^rest_client_request_duration_seconds_sum$
1170 whitelist.14 = ^kubelet_volume_stats_.+$
1171 whitelist.15 = ^rest_client_requests_total$
1172
1173
1174 ; # Collectord reports if entropy is low
1175 ; [diagnostics::node-entropy]
1176 ; settings.path = /rootfs/proc/sys/kernel/random/entropy_avail
1177 ; settings.interval = 1h
1178 ; settings.threshold = 800
1179
1180 # Collectord can report if node reboot is required
1181 [diagnostics::node-reboot-required]
1182 settings.path = /rootfs/var/run/reboot-required*
1183 settings.interval = 1h
1184
1185 # See https://www.kernel.org/doc/Documentation/admin-guide/hw-vuln/index.rst
1186 # And https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-devices-system-cpu
1187 [diagnostics::cpu-vulnerabilities]
1188 settings.path = /rootfs/sys/devices/system/cpu/vulnerabilities/*
1189 settings.interval = 1h
1190
1191
1192 003-daemonset-master.conf: |
1193 [input.prometheus::kubernetes-api]
1194
1195 # disable prometheus kubernetes-api metrics
1196 disabled = false
1197
1198 # override type
1199 type = kubernetes_prometheus
1200
1201 # specify Splunk index
1202 index =
1203
1204 # override host (environment variables are supported, by default Kubernetes node name is used)
1205 host = ${KUBERNETES_NODENAME}
1206
1207 # override source
1208 source = kubernetes-api
1209
1210 # how often to collect prometheus metrics
1211 interval = 60s
1212
1213 # request timeout
1214 timeout = 60s
1215
1216 # prometheus endpoint
1217 # at first trying to get it from localhost (avoiding load balancer, if multiple api servers)
1218 endpoint.1localhost = https://127.0.0.1:6443/metrics
1219 # as fallback using proxy
1220 endpoint.2kubeapi = https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}/metrics
1221
1222 # token for "Authorization: Bearer $(cat tokenPath)"
1223 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
1224
1225 # server certificate for certificate validation
1226 certPath = /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
1227
1228 # client certificate for authentication
1229 clientCertPath =
1230
1231 # Allow invalid SSL server certificate
1232 insecure = true
1233
1234 # include metrics help with the events
1235 includeHelp = false
1236
1237 # set output (splunk or devnull, default is [general]defaultOutput)
1238 output =
1239
1240 whitelist.1 = ^kubernetes_build_info$
1241 whitelist.2 = ^authenticated_user_requests$
1242 whitelist.3 = ^apiserver_request_total$
1243 whitelist.4 = ^process_cpu_seconds_total$
1244 whitelist.5 = ^process_resident_memory_bytes$
1245 whitelist.6 = ^process_virtual_memory_bytes$
1246 whitelist.7 = ^rest_client_request_duration_seconds_sum$
1247 whitelist.8 = ^rest_client_requests_total$
1248
1249
1250 # This configuration works if scheduled is bind to the localhost:10251
1251 [input.prometheus::scheduler]
1252
1253 # disable prometheus scheduler metrics
1254 disabled = false
1255
1256 # override type
1257 type = kubernetes_prometheus
1258
1259 # specify Splunk index
1260 index =
1261
1262 # override host
1263 host = ${KUBERNETES_NODENAME}
1264
1265 # override source
1266 source = scheduler
1267
1268 # how often to collect prometheus metrics
1269 interval = 60s
1270
1271 # request timeout
1272 timeout = 60s
1273
1274 # prometheus endpoint
1275 endpoint.https = https://:10259/metrics
1276 endpoint.http = http://127.0.0.1:10251/metrics
1277
1278 # token for "Authorization: Bearer $(cat tokenPath)"
1279 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
1280
1281 # server certificate for certificate validation
1282 certPath =
1283
1284 # client certificate for authentication
1285 clientCertPath =
1286
1287 # Allow invalid SSL server certificate
1288 insecure = true
1289
1290 # include metrics help with the events
1291 includeHelp = false
1292
1293 # set output (splunk or devnull, default is [general]defaultOutput)
1294 output =
1295
1296 whitelist.1 = ^kubernetes_build_info$
1297 whitelist.2 = ^scheduler_e2e_scheduling_duration_seconds_sum$
1298 whitelist.3 = ^scheduler_binding_duration_seconds_sum$
1299 whitelist.4 = ^scheduler_scheduling_algorithm_duration_seconds_sum$
1300 whitelist.5 = ^rest_client_request_duration_seconds_sum$
1301 whitelist.6 = ^rest_client_requests_total$
1302 whitelist.7 = ^process_cpu_seconds_total$
1303 whitelist.8 = ^process_resident_memory_bytes$
1304 whitelist.9 = ^process_virtual_memory_bytes$
1305
1306
1307 # This configuration works if controller-manager is bind to the localhost:10252
1308 [input.prometheus::controller-manager]
1309
1310 # disable prometheus controller-manager metrics
1311 disabled = false
1312
1313 # override type
1314 type = kubernetes_prometheus
1315
1316 # specify Splunk index
1317 index =
1318
1319 # override host
1320 host = ${KUBERNETES_NODENAME}
1321
1322 # override source
1323 source = controller-manager
1324
1325 # how often to collect prometheus metrics
1326 interval = 60s
1327
1328 # request timeout
1329 timeout = 60s
1330
1331 # prometheus endpoint
1332 endpoint.https = https://:10257/metrics
1333 endpoint.http = http://127.0.0.1:10252/metrics
1334
1335 # token for "Authorization: Bearer $(cat tokenPath)"
1336 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
1337
1338 # server certificate for certificate validation
1339 certPath =
1340
1341 # client certificate for authentication
1342 clientCertPath =
1343
1344 # Allow invalid SSL server certificate
1345 insecure = true
1346
1347 # include metrics help with the events
1348 includeHelp = false
1349
1350 # set output (splunk or devnull, default is [general]defaultOutput)
1351 output =
1352
1353 whitelist.1 = ^kubernetes_build_info$
1354 whitelist.2 = ^node_collector_zone_size$
1355 whitelist.3 = ^node_collector_zone_health$
1356 whitelist.4 = ^node_collector_unhealthy_nodes_in_zone$
1357 whitelist.5 = ^rest_client_request_duration_seconds_sum$
1358 whitelist.6 = ^rest_client_requests_total$
1359 whitelist.7 = ^process_cpu_seconds_total$
1360 whitelist.8 = ^process_resident_memory_bytes$
1361 whitelist.9 = ^process_virtual_memory_bytes$
1362
1363
1364 [input.prometheus::etcd]
1365
1366 # disable prometheus etcd metrics
1367 disabled = false
1368
1369 # override type
1370 type = kubernetes_prometheus
1371
1372 # specify Splunk index
1373 index =
1374
1375 # override host
1376 host = ${KUBERNETES_NODENAME}
1377
1378 # override source
1379 source = etcd
1380
1381 # how often to collect prometheus metricd
1382 interval = 60s
1383
1384 # request timeout
1385 timeout = 60s
1386
1387 # prometheus endpoint
1388 endpoint.http = http://:2379/metrics
1389 endpoint.https = https://:2379/metrics
1390
1391 # token for "Authorization: Bearer $(cat tokenPath)"
1392 tokenPath =
1393
1394 # server certificate for certificate validation
1395 certPath = /rootfs/etc/kubernetes/pki/etcd/ca.crt
1396
1397 # client certificate for authentication
1398 clientCertPath = /rootfs/etc/kubernetes/pki/apiserver-etcd-client.crt
1399 clientKeyPath = /rootfs/etc/kubernetes/pki/apiserver-etcd-client.key
1400
1401 # Allow invalid SSL server certificate
1402 insecure = true
1403
1404 # include metrics help with the events
1405 includeHelp = false
1406
1407 # set output (splunk or devnull, default is [general]defaultOutput)
1408 output =
1409
1410 whitelist.1 = ^etcd_server_leader_changes_seen_total$
1411 whitelist.2 = ^etcd_server_has_leader$
1412 whitelist.3 = ^etcd_server_proposals_committed_total$
1413 whitelist.4 = ^etcd_server_proposals_applied_total$
1414 whitelist.5 = ^etcd_server_proposals_committed_total$
1415 whitelist.6 = ^etcd_server_proposals_pending$
1416 whitelist.7 = ^etcd_server_proposals_failed_total$
1417 whitelist.8 = ^etcd_disk_wal_fsync_duration_seconds_sum$
1418 whitelist.9 = ^etcd_disk_wal_fsync_duration_seconds_count$
1419 whitelist.10 = ^etcd_disk_backend_commit_duration_seconds_sum$
1420 whitelist.11 = ^etcd_disk_backend_commit_duration_seconds_count$
1421 whitelist.12 = ^etcd_network_client_grpc_.*$
1422 whitelist.13 = ^grpc_server_handled_total$
1423 whitelist.14 = ^etcd_network_peer_round_trip_time_seconds_bucket$
1424 whitelist.15 = ^process_cpu_seconds_total$
1425 whitelist.16 = ^process_resident_memory_bytes$
1426 whitelist.17 = ^process_virtual_memory_bytes$
1427 whitelist.18 = ^process_open_fds$
1428 whitelist.19 = ^process_max_fds$
1429 whitelist.20 = ^etcd_disk_backend_commit_duration_seconds_bucket$
1430 whitelist.21 = ^etcd_disk_wal_fsync_duration_seconds_bucket$
1431
1432 004-addon.conf: |
1433 [general]
1434
1435 # addons can be run in parallel with agents
1436 addon = true
1437
1438 # The addon runs off the host network, so the kubelet probes /healthz and /readyz
1439 # on the pod IP - bind 0.0.0.0 here (overrides the loopback default in
1440 # 001-general.conf, which would be unreachable). Only health/ready are enabled, so
1441 # this exposes nothing beyond the probes on the cluster-internal pod IP.
1442 httpServerBinding = 0.0.0.0:11888
1443
1444 [input.kubernetes_events]
1445
1446 # disable events
1447 disabled = false
1448
1449 # override type
1450 type = kubernetes_events
1451
1452 # specify Splunk index
1453 index =
1454
1455 # set output (splunk or devnull, default is [general]defaultOutput)
1456 output =
1457
1458 # exclude managed fields from the metadata
1459 excludeManagedFields = true
1460
1461
1462 [input.kubernetes_watch::pods]
1463
1464 # disable events
1465 disabled = false
1466
1467 # Set the timeout for how often watch request should refresh the whole list
1468 refresh = 10m
1469
1470 apiVersion = v1
1471 kind = Pod
1472 namespace =
1473
1474 # override type
1475 type = kubernetes_objects
1476
1477 # specify Splunk index
1478 index =
1479
1480 # set output (splunk or devnull, default is [general]defaultOutput)
1481 output =
1482
1483 # exclude managed fields from the metadata
1484 excludeManagedFields = true
1485
1486 # you can remove or hash some values in the events (after modifyValues you can define path in the JSON object,
1487 # and the value can be hash:{hashFunction}, or remove to remove the object )
1488 ; modifyValues.object.data.* = hash:sha256
1489 ; modifyValues.object.metadata.annotations.* = remove
1490
1491 # You can exclude events by namespace with blacklist or whitelist only required namespaces
1492 # blacklist.kubernetes_namespace = ^namespace0$
1493 # whitelist.kubernetes_namespace = ^((namespace1)|(namespace2))$
1494
1495 [input.kubernetes_watch::resourcequota]
1496 # disable events
1497 disabled = false
1498
1499 # Set the timeout for how often watch request should refresh the whole list
1500 refresh = 10m
1501
1502 apiVersion = v1
1503 kind = ResourceQuota
1504 namespace =
1505
1506 # override type
1507 type = kubernetes_objects
1508
1509 # specify Splunk index
1510 index =
1511
1512 # set output (splunk or devnull, default is [general]defaultOutput)
1513 output =
1514
1515 # exclude managed fields from the metadata
1516 excludeManagedFields = true
1517
1518 [input.kubernetes_watch::nodes]
1519 # disable events
1520 disabled = false
1521
1522 # Set the timeout for how often watch request should refresh the whole list
1523 refresh = 10m
1524
1525 apiVersion = v1
1526 kind = Node
1527 namespace =
1528
1529 # override type
1530 type = kubernetes_objects
1531
1532 # specify Splunk index
1533 index =
1534
1535 # set output (splunk or devnull, default is [general]defaultOutput)
1536 output =
1537
1538 # exclude managed fields from the metadata
1539 excludeManagedFields = true
1540
1541---
1542apiVersion: apps/v1
1543kind: DaemonSet
1544metadata:
1545 name: collectorforkubernetes
1546 namespace: collectorforkubernetes
1547 labels:
1548 app: collectorforkubernetes
1549spec:
1550 # Default updateStrategy is OnDelete. For collectord RollingUpdate is suitable
1551 # When you update configuration
1552 updateStrategy:
1553 type: RollingUpdate
1554 selector:
1555 matchLabels:
1556 daemon: collectorforkubernetes
1557 template:
1558 metadata:
1559 name: collectorforkubernetes
1560 labels:
1561 daemon: collectorforkubernetes
1562 spec:
1563 priorityClassName: collectorforkubernetes-critical
1564 dnsPolicy: ClusterFirstWithHostNet
1565 hostNetwork: true
1566 serviceAccountName: collectorforkubernetes
1567 # We run this DaemonSet only for Non-Masters
1568 affinity:
1569 nodeAffinity:
1570 requiredDuringSchedulingIgnoredDuringExecution:
1571 nodeSelectorTerms:
1572 - matchExpressions:
1573 - key: node-role.kubernetes.io/control-plane
1574 operator: DoesNotExist
1575 tolerations:
1576 - operator: "Exists"
1577 effect: "NoSchedule"
1578 - operator: "Exists"
1579 effect: "NoExecute"
1580 containers:
1581 - name: collectorforkubernetes
1582 # Collectord version
1583 image: docker.io/outcoldsolutions/collectorforkubernetes:26.04.4
1584 imagePullPolicy: Always
1585 livenessProbe:
1586 httpGet:
1587 host: 127.0.0.1
1588 path: /healthz
1589 port: 11888
1590 initialDelaySeconds: 120
1591 periodSeconds: 60
1592 timeoutSeconds: 5
1593 failureThreshold: 3
1594 readinessProbe:
1595 httpGet:
1596 host: 127.0.0.1
1597 path: /readyz
1598 port: 11888
1599 initialDelaySeconds: 10
1600 periodSeconds: 15
1601 timeoutSeconds: 5
1602 failureThreshold: 3
1603 securityContext:
1604 runAsUser: 0
1605 privileged: true
1606 # Define your resources if you need. Defaults should be fine for most.
1607 # You can lower or increase based on your hosts.
1608 resources:
1609 limits:
1610 cpu: 2000m
1611 memory: 1024Mi
1612 requests:
1613 cpu: 500m
1614 memory: 256Mi
1615 env:
1616 - name: KUBERNETES_NODENAME
1617 valueFrom:
1618 fieldRef:
1619 fieldPath: spec.nodeName
1620 - name: POD_NAME
1621 valueFrom:
1622 fieldRef:
1623 fieldPath: metadata.name
1624 volumeMounts:
1625 # We store state in /data folder (file positions)
1626 - name: collectorforkubernetes-state
1627 mountPath: /data
1628 # Configuration file deployed with ConfigMap
1629 - name: collectorforkubernetes-config
1630 mountPath: /config/
1631 readOnly: true
1632 # Root filesystem to have access to logs and metrics
1633 - name: rootfs
1634 mountPath: /rootfs/
1635 readOnly: false
1636 mountPropagation: HostToContainer
1637 # correct timezone
1638 - name: localtime
1639 mountPath: /etc/localtime
1640 readOnly: true
1641 volumes:
1642 # We store state directly on host, change this location, if
1643 # your persistent volume is somewhere else
1644 - name: collectorforkubernetes-state
1645 hostPath:
1646 path: /var/lib/collectorforkubernetes/data/
1647 type: DirectoryOrCreate
1648 # Location of docker root (for container logs and metadata)
1649 - name: rootfs
1650 hostPath:
1651 path: /
1652 # correct timezone
1653 - name: localtime
1654 hostPath:
1655 path: /etc/localtime
1656 # configuration from ConfigMap
1657 - name: collectorforkubernetes-config
1658 configMap:
1659 name: collectorforkubernetes
1660 items:
1661 - key: 001-general.conf
1662 path: 001-general.conf
1663 - key: 002-daemonset.conf
1664 path: 002-daemonset.conf
1665---
1666apiVersion: apps/v1
1667kind: DaemonSet
1668metadata:
1669 name: collectorforkubernetes-master
1670 namespace: collectorforkubernetes
1671 labels:
1672 app: collectorforkubernetes
1673spec:
1674 updateStrategy:
1675 type: RollingUpdate
1676 selector:
1677 matchLabels:
1678 daemon: collectorforkubernetes
1679 template:
1680 metadata:
1681 name: collectorforkubernetes-master
1682 labels:
1683 daemon: collectorforkubernetes
1684 spec:
1685 priorityClassName: collectorforkubernetes-critical
1686 dnsPolicy: ClusterFirstWithHostNet
1687 hostNetwork: true
1688 serviceAccountName: collectorforkubernetes
1689 affinity:
1690 nodeAffinity:
1691 requiredDuringSchedulingIgnoredDuringExecution:
1692 nodeSelectorTerms:
1693 - matchExpressions:
1694 - key: node-role.kubernetes.io/control-plane
1695 operator: Exists
1696 tolerations:
1697 - operator: "Exists"
1698 effect: "NoSchedule"
1699 - operator: "Exists"
1700 effect: "NoExecute"
1701 containers:
1702 - name: collectorforkubernetes
1703 image: docker.io/outcoldsolutions/collectorforkubernetes:26.04.4
1704 imagePullPolicy: Always
1705 livenessProbe:
1706 httpGet:
1707 host: 127.0.0.1
1708 path: /healthz
1709 port: 11888
1710 initialDelaySeconds: 120
1711 periodSeconds: 60
1712 timeoutSeconds: 5
1713 failureThreshold: 3
1714 readinessProbe:
1715 httpGet:
1716 host: 127.0.0.1
1717 path: /readyz
1718 port: 11888
1719 initialDelaySeconds: 10
1720 periodSeconds: 15
1721 timeoutSeconds: 5
1722 failureThreshold: 3
1723 securityContext:
1724 runAsUser: 0
1725 privileged: true
1726 resources:
1727 limits:
1728 cpu: 2000m
1729 memory: 1024Mi
1730 requests:
1731 cpu: 500m
1732 memory: 256Mi
1733 env:
1734 - name: KUBERNETES_NODENAME
1735 valueFrom:
1736 fieldRef:
1737 fieldPath: spec.nodeName
1738 - name: POD_NAME
1739 valueFrom:
1740 fieldRef:
1741 fieldPath: metadata.name
1742 volumeMounts:
1743 - name: collectorforkubernetes-state
1744 mountPath: /data
1745 - name: collectorforkubernetes-config
1746 mountPath: /config/
1747 readOnly: true
1748 - name: rootfs
1749 mountPath: /rootfs/
1750 readOnly: false
1751 mountPropagation: HostToContainer
1752 - name: localtime
1753 mountPath: /etc/localtime
1754 readOnly: true
1755 volumes:
1756 - name: collectorforkubernetes-state
1757 hostPath:
1758 path: /var/lib/collectorforkubernetes/data/
1759 type: DirectoryOrCreate
1760 - name: rootfs
1761 hostPath:
1762 path: /
1763 - name: localtime
1764 hostPath:
1765 path: /etc/localtime
1766 - name: collectorforkubernetes-config
1767 configMap:
1768 name: collectorforkubernetes
1769 items:
1770 - key: 001-general.conf
1771 path: 001-general.conf
1772 - key: 002-daemonset.conf
1773 path: 002-daemonset.conf
1774 - key: 003-daemonset-master.conf
1775 path: 003-daemonset-master.conf
1776---
1777apiVersion: apps/v1
1778kind: Deployment
1779metadata:
1780 name: collectorforkubernetes-addon
1781 namespace: collectorforkubernetes
1782 labels:
1783 app: collectorforkubernetes
1784spec:
1785 replicas: 1
1786 selector:
1787 matchLabels:
1788 daemon: collectorforkubernetes
1789 template:
1790 metadata:
1791 name: collectorforkubernetes-addon
1792 labels:
1793 daemon: collectorforkubernetes
1794 spec:
1795 priorityClassName: collectorforkubernetes-critical
1796 serviceAccountName: collectorforkubernetes
1797 containers:
1798 - name: collectorforkubernetes
1799 image: docker.io/outcoldsolutions/collectorforkubernetes:26.04.4
1800 imagePullPolicy: Always
1801 livenessProbe:
1802 httpGet:
1803 path: /healthz
1804 port: 11888
1805 initialDelaySeconds: 120
1806 periodSeconds: 60
1807 timeoutSeconds: 5
1808 failureThreshold: 3
1809 readinessProbe:
1810 httpGet:
1811 path: /readyz
1812 port: 11888
1813 initialDelaySeconds: 10
1814 periodSeconds: 15
1815 timeoutSeconds: 5
1816 failureThreshold: 3
1817 securityContext:
1818 runAsUser: 0
1819 privileged: true
1820 resources:
1821 limits:
1822 cpu: 1000m
1823 memory: 512Mi
1824 requests:
1825 cpu: 200m
1826 memory: 64Mi
1827 env:
1828 - name: KUBERNETES_NODENAME
1829 valueFrom:
1830 fieldRef:
1831 fieldPath: spec.nodeName
1832 - name: POD_NAME
1833 valueFrom:
1834 fieldRef:
1835 fieldPath: metadata.name
1836 volumeMounts:
1837 - name: collectorforkubernetes-state
1838 mountPath: /data
1839 - name: collectorforkubernetes-config
1840 mountPath: /config/
1841 readOnly: true
1842 volumes:
1843 - name: collectorforkubernetes-state
1844 hostPath:
1845 path: /var/lib/collectorforkubernetes/data/
1846 type: Directory
1847 - name: collectorforkubernetes-config
1848 configMap:
1849 name: collectorforkubernetes
1850 items:
1851 - key: 001-general.conf
1852 path: 001-general.conf
1853 - key: 004-addon.conf
1854 path: 004-addon.conf
