1apiVersion: project.openshift.io/v1
2kind: Project
3metadata:
4 labels:
5 app: collectorforopenshift
6 name: collectorforopenshift
7 annotations:
8 openshift.io/node-selector: ''
9 openshift.io/description: 'Monitoring OpenShift in Splunk, built by Outcold Solutions'
10 openshift.io/display-name: 'Collectord for OpenShift'
11---
12apiVersion: apiextensions.k8s.io/v1
13kind: CustomResourceDefinition
14metadata:
15 name: configurations.collectord.io
16spec:
17 group: collectord.io
18 versions:
19 - name: v1
20 served: true
21 storage: true
22 schema:
23 openAPIV3Schema:
24 type: object
25 properties:
26 spec:
27 type: object
28 additionalProperties: true
29 force:
30 type: boolean
31 scope: Cluster
32 names:
33 listKind: ConfigurationList
34 plural: configurations
35 singular: configuration
36 kind: Configuration
37---
38apiVersion: apiextensions.k8s.io/v1
39kind: CustomResourceDefinition
40metadata:
41 name: splunkoutputs.collectord.io
42spec:
43 group: collectord.io
44 versions:
45 - name: v1
46 served: true
47 storage: true
48 schema:
49 openAPIV3Schema:
50 type: object
51 properties:
52 spec:
53 type: object
54 properties:
55 url:
56 type: string
57 format: uri
58 insecure:
59 type: boolean
60 token:
61 type: string
62 description: "Plain token"
63 tokenFromSecret:
64 type: object
65 description: "Reference to a Kubernetes Secret"
66 properties:
67 secret:
68 type: string
69 key:
70 type: string
71 oneOf:
72 - required: ["token"]
73 - required: ["tokenFromSecret"]
74 scope: Namespaced
75 names:
76 listKind: SplunkOutputList
77 plural: splunkoutputs
78 singular: splunkoutput
79 kind: SplunkOutput
80---
81apiVersion: scheduling.k8s.io/v1
82kind: PriorityClass
83metadata:
84 name: collectorforopenshift-critical
85value: 1000000000
86---
87kind: SecurityContextConstraints
88apiVersion: security.openshift.io/v1
89metadata:
90 name: collectorforopenshift
91allowHostDirVolumePlugin: true
92allowHostIPC: true
93allowHostNetwork: true
94allowHostPID: true
95allowHostPorts: true
96allowPrivilegeEscalation: true
97allowPrivilegedContainer: true
98readOnlyRootFilesystem: false
99allowedCapabilities:
100 - '*'
101allowedUnsafeSysctls:
102 - '*'
103fsGroup:
104 type: RunAsAny
105runAsUser:
106 type: RunAsAny
107seLinuxContext:
108 type: RunAsAny
109supplementalGroups:
110 type: RunAsAny
111seccompProfiles:
112 - '*'
113users:
114 - system:serviceaccount:collectorforopenshift:collectorforopenshift
115volumes:
116 - '*'
117---
118apiVersion: v1
119kind: ServiceAccount
120metadata:
121 labels:
122 app: collectorforopenshift
123 name: collectorforopenshift
124 namespace: collectorforopenshift
125---
126apiVersion: rbac.authorization.k8s.io/v1
127kind: ClusterRole
128metadata:
129 labels:
130 app: collectorforopenshift
131 name: collectorforopenshift
132rules:
133- apiGroups:
134 - ""
135 - apps
136 - batch
137 - extensions
138 - collectord.io
139 - apps.openshift.io
140 - build.openshift.io
141 - authorization.openshift.io
142 - template.openshift.io
143 - quota.openshift.io
144 - discovery.k8s.io
145 resources:
146 - alertmanagers
147 - clusterresourcequotas
148 - clusterroles
149 - configurations
150 - cronjobs
151 - daemonsets
152 - deploymentconfigs
153 - deployments
154 - endpointslices
155 - events
156 - jobs
157 - namespaces
158 - nodes
159 - nodes/metrics
160 - nodes/proxy
161 - persistentvolumeclaims
162 - pods
163 - replicasets
164 - replicationcontrollers
165 - resourcequotas
166 - scheduledjobs
167 - secrets
168 - services
169 - splunkoutputs
170 - statefulsets
171 verbs:
172 - get
173 - list
174 - watch
175- nonResourceURLs:
176 - /metrics
177 verbs:
178 - get
179 apiGroups: []
180 resources: []
181---
182apiVersion: rbac.authorization.k8s.io/v1
183kind: ClusterRoleBinding
184metadata:
185 labels:
186 app: collectorforopenshift
187 name: collectorforopenshift
188roleRef:
189 kind: ClusterRole
190 name: collectorforopenshift
191 apiGroup: rbac.authorization.k8s.io
192subjects:
193 - kind: ServiceAccount
194 name: collectorforopenshift
195 namespace: collectorforopenshift
196---
197apiVersion: v1
198kind: ConfigMap
199metadata:
200 name: collectorforopenshift
201 namespace: collectorforopenshift
202 labels:
203 app: collectorforopenshift
204data:
205 001-general.conf: |
206 # The general configuration is used for all deployments
207 #
208 # Run collectord with the flag `-conf` and specify location of the configuration files.
209 #
210 # You can override all the values using environment variables with the format like
211 # COLLECTOR__<ANYNAME>=<section>__<key>=<value>
212 # As an example you can set `dataPath` in the `[general]` section as
213 # COLLECTOR__DATAPATH=general__dataPath=C:\\some\\path\\data.db
214 # This parameter can be configured using -env-override, set it to empty string to disable this feature
215
216 [general]
217
218 # Please review license https://www.outcoldsolutions.com/legal/license-agreement/
219 # and accept license by changing the value to *true*
220 acceptLicense = false
221
222 # Location for the database
223 # Collectord stores positions of the files and internal state
224 dataPath = ./data/
225
226 # log level (accepted values are trace, debug, info, warn, error, fatal)
227 logLevel = info
228
229 # Internal http server. Bound to loopback so nothing is published on the node
230 # network: the DaemonSets run on the host network, where a 0.0.0.0 bind would
231 # expose these endpoints on the node IP. The liveness/readiness probes still reach
232 # it via httpGet.host 127.0.0.1 (the kubelet shares the host network namespace).
233 # The addon runs off the host network and overrides this to 0.0.0.0 in
234 # 004-addon.conf so the kubelet can reach it on the pod IP.
235 httpServerBinding = 127.0.0.1:11888
236
237 # Enable endpoints individually. Only the probe endpoints default on. metrics
238 # (/metrics/json, /metrics/prometheus) and pprof (/debug/pprof) expose internal
239 # detail and are unreachable on a loopback bind anyway - to scrape or profile,
240 # enable the endpoint and widen httpServerBinding (e.g. 0.0.0.0:11888).
241 httpServerEndpoints.health = true
242 httpServerEndpoints.ready = true
243 httpServerEndpoints.metrics = false
244 httpServerEndpoints.pprof = false
245
246 # log requests to the http server
247 httpServerLog = false
248
249 # telemetry report endpoint, set it to empty string to disable telemetry
250 telemetryEndpoint = https://license.outcold.solutions/telemetry/
251
252 # license check endpoint
253 licenseEndpoint = https://license.outcold.solutions/license/
254
255 # license server through proxy
256 # This configuration is used only for the Outcold Solutions License Server
257 # For license server running on-premises, use configuration under [license.client]
258 licenseServerProxyUrl =
259
260 # authentication with basic authorization (user:password)
261 # This configuration is used only for the Outcold Solutions License Server
262 # For license server running on-premises, use configuration under [license.client]
263 licenseServerProxyBasicAuth =
264
265 # license key
266 license =
267
268 # Environment variable $KUBERNETES_NODENAME is used by default to setup hostname
269 # Use value below to override specific name
270 hostname =
271
272 # Default output for events, logs and metrics
273 # valid values: splunk and devnull
274 # Use devnull by default if you don't want to redirect data
275 defaultOutput = splunk
276
277 # Buffer size for file reads. 8k matches the common filesystem block size and
278 # cuts the number of read syscalls substantially versus the historical 256b.
279 fileInputBufferSize = 8k
280
281 # Maximum size of one line the file reader can read
282 fileInputLineMaxSize = 1mb
283
284 # Include custom fields to attach to every event, in example below every event sent to Splunk will hav
285 # indexed field my_environment=dev. Fields names should match to ^[a-z][_a-z0-9]*$
286 # Better way to configure that is to specify labels for OpenShift Nodes.
287 # ; fields.my_environment = dev
288 # Identify the cluster if you are planning to monitor multiple clusters
289 fields.openshift_cluster = -
290
291 # Include EC2 Metadata (see list of possible fields https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html)
292 # Should be in format ec2Metadata.{desired_field_name} = {url path to read the value}
293 # ec2Metadata.ec2_instance_id = /latest/meta-data/instance-id
294 # ec2Metadata.ec2_instance_type = /latest/meta-data/instance-type
295
296 # subdomain for the annotations added to the pods, workloads, namespaces or containers, like splunk.collectord.io/..
297 annotationsSubdomain =
298
299 # configure global thruput per second for forwarded logs (metrics are not included)
300 # for example if you set `thruputPerSecond = 512Kb`, that will limit amount of logs forwarded
301 # from the single Collectord instance to 512Kb per second.
302 # You can configure thruput individually for the logs (including specific for container logs) below
303 thruputPerSecond =
304
305 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
306 # older than 7 days
307 tooOldEvents =
308
309 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
310 tooNewEvents =
311
312 # For input.files::X and application logs, when glob or match are configured, Collectord can automatically
313 # detect gzipped files and skip them (based on the extensions or magic numbers)
314 autoSkipGzipFiles = true
315
316 # Multi-output async publishing. When enabled (default), events routed to
317 # non-default outputs are published asynchronously so that a slow or down
318 # output does not block events destined for other outputs.
319 ; multioutput.async = true
320 # Buffer size for the async proxy (default 100). Absorbs transient bursts.
321 # When this buffer and the output's own queue are both full, events are
322 # dropped immediately without blocking the pipeline.
323 ; multioutput.asyncBufferSize = 100
324
325 [license.client]
326 # point to the license located on the HTTP web server, or a hosted by the Collectord running as license server
327 url =
328 # basic authentication for the HTTP server
329 basicAuth =
330 # if SSL, ignore the certificate verification
331 insecure = false
332 # CA Path for the Server certificate
333 capath =
334 # CA Name fot the Server certificate
335 caname =
336 # license server through proxy
337 proxyUrl =
338 # authentication with basic authorization (user:password)
339 proxyBasicAuth =
340
341 # forward internal collectord metrics
342 [input.collectord_metrics]
343
344 # disable collectord internal metrics
345 disabled = false
346
347 # override type
348 type = openshift_prometheus
349
350 # how often to collect internal metrics
351 interval = 1m
352
353 # set output (splunk or devnull, default is [general]defaultOutput)
354 output =
355
356 # specify Splunk index
357 index =
358
359 # whitelist or blacklist the metrics
360 whitelist.1 = ^file_input_open$
361 whitelist.2 = ^file_input_read_bytes$
362 whitelist.3 = ^openshift_handlers$
363 whitelist.4 = ^pipe$
364 whitelist.5 = ^pipelines_num$
365 whitelist.6 = ^splunk_post_bytes_sum.*$
366 whitelist.7 = ^splunk_post_events_count_sum.*$
367 whitelist.8 = ^splunk_post_failed_requests$
368 whitelist.9 = ^splunk_post_message_max_lag_seconds_bucket.*$
369 whitelist.10 = ^splunk_post_requests_seconds_sum.*$
370 whitelist.11 = ^splunk_post_retries_required_sum.*$
371
372
373 # connection to kubernetes api
374 [general.kubernetes]
375
376 # Override service URL for Kubernetes (default is ${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT})
377 serviceURL =
378
379 # Environment variable $KUBERNETES_NODENAME is used by default to setup nodeName
380 # Use it only when you need to override it
381 nodeName =
382
383 # Configuration to access the API server,
384 # see https://kubernetes.io/docs/tasks/access-application-cluster/access-cluster/#accessing-the-api-from-a-pod
385 # for details
386 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
387 certPath = /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
388
389 # Default timeout for http responses. The streaming/watch requests depend on this timeout.
390 timeout = 30m
391
392 # How long to keep the cache for the recent calls to API server (to limit number of calls when collectord discovers new pods)
393 metadataTTL = 30s
394
395 # regex to find pods
396 podsCgroupFilter = ^/([^/\s]+/)*kubepods(\.slice)?/((kubepods-)?(burstable|besteffort)(\.slice)?/)?([^/]*)pod([0-9a-f]{32}|[0-9a-f\-_]{36})(\.slice)?$
397
398 # regex to find containers in the pods
399 containersCgroupFilter = ^/([^/\s]+/)*kubepods(\.slice)?/((kubepods-)?(burstable|besteffort)(\.slice)?/)?([^/]*)pod([0-9a-f]{32}|[0-9a-f\-_]{36})(\.slice)?/(docker-|crio-|cri-\w+-)?[0-9a-f]{64}(\.scope)?(\/.+)?$
400
401 # path to the kubelet root location (use it to discover application logs for emptyDir)
402 # the expected format is `pods/{pod-id}/volumes/kubernetes.io~empty-dir/{volume-name}/_data/`
403 volumesRootDir = /rootfs/var/lib/kubelet/
404
405 # You can attach annotations as a metadata, using the format
406 # includeAnnotations.{key} = {regexp}
407 # For example if you want to include all annotations that starts with `prometheus.io` or `example.com` you can include
408 # the following format:
409 # includeAnnotations.1 = ^prometheus\.io.*
410 # includeAnnotations.2 = ^example\.com.*
411
412 # You can exclude labels from metadata, using the format
413 # excludeLabels.{key} = {regexp}
414 # For example if you want to exclude all labels that starts with `prometheus.io` or `example.com` you can include
415 # the following format:
416 # excludeLabels.1 = ^prometheus\.io.*
417 # excludeLabels.2 = ^example\.com.*
418
419 # watch for changes (annotations) in the objects
420 watch.namespaces = v1/namespace
421 watch.deploymentconfigs = apps.openshift.io/v1/deploymentconfig
422 watch.configurations = collectord.io/v1/configuration
423
424 # Collectord can review the assigned ClusterRole and traverse metadata for the Pods only for the Owner objects
425 # that are defined in the ClusterRole, ignoring anything else, it does not have access to.
426 # This way Collectord does not generate 403 requests on API Server
427 clusterRole = collectorforopenshift
428
429 # Alternative of telling Collectord about the ClusterRole is to manually list the objects.
430 # You can define which objects Collectord should traverse when it sees Owners.
431 ; traverseOwnership.namespaces = v1/namespace
432
433 # Implementation of the watch protocol.
434 # 0 - use the default implementation (2)
435 # 1 - use the watch implementation that is optimized for the small number of objects (just issue one watch for all objects)
436 # 2 - use the watch implementation that is optimized for the large number of objects (paginate through the list of objects and issue watch for the last resource version)
437 watchImplementation = 2
438
439 # watch for pods annotations, setup prometheus collection
440 # for these pods
441 # Addon listens on Pod Network
442 # DaemonSets listen on Host Network
443 [input.prometheus_auto]
444
445 # disable prometheus auto discovery for pods
446 disabled = false
447
448 # override type
449 type = openshift_prometheus
450
451 # specify Splunk index
452 index =
453
454 # how often to collect prometheus metrics
455 interval = 60s
456
457 # request timeout
458 timeout = 60s
459
460 # include metrics help with the events
461 includeHelp = true
462
463 # http client timeout
464 timeout = 30s
465
466 # set output (splunk or devnull, default is [general]defaultOutput)
467 output =
468
469 # Include an Authorization header for the prometheus scrapper
470 # When configuring scrapping with collectord using annotations use prometheus.1-AuthorizationKey=key1
471 # authorization.key1 = Bearer FOO
472
473
474 # Splunk output
475 [output.splunk]
476
477 # Splunk HTTP Event Collector url
478 url =
479 # You can specify muiltiple splunk URls with
480 #
481 # urls.0 = https://server1:8088/services/collector/event/1.0
482 # urls.1 = https://server1:8088/services/collector/event/1.0
483 # urls.2 = https://server1:8088/services/collector/event/1.0
484 #
485 # Limitations:
486 # * The urls cannot have different path.
487
488 # Specify how URL should be picked up (in case if multiple is used)
489 # urlSelection = random|round-robin|random-with-round-robin
490 # where:
491 # * random - choose random url on first selection and after each failure (connection or HTTP status code >= 500)
492 # * round-robin - choose url starting from first one and bump on each failure (connection or HTTP status code >= 500)
493 # * random-with-round-robin - choose random url on first selection and after that in round-robin on each
494 # failure (connection or HTTP status code >= 500)
495 urlSelection = random-with-round-robin
496
497 # Splunk HTTP Event Collector Token
498 token =
499
500 # Allow invalid SSL server certificate
501 insecure = false
502 # minTLSVersion = TLSv1.2
503 # maxTLSVersion = TLSv1.3
504
505 # Path to CA cerificate
506 caPath =
507
508 # CA Name to verify
509 caName =
510
511 # path for client certificate (if required)
512 clientCertPath =
513
514 # path for client key (if required)
515 clientKeyPath =
516
517 # Events are batched with the maximum size set by batchSize and staying in pipeline for not longer
518 # than set by frequency
519 frequency = 5s
520 batchSize = 768K
521 # limit by the number of events (0 value has no limit on the number of events)
522 events = 50
523
524 # Splunk through proxy
525 proxyUrl =
526
527 # authentication with basic authorization (user:password)
528 proxyBasicAuth =
529
530 # Splunk acknowledgement url (.../services/collector/ack)
531 ackUrl =
532 # You can specify muiltiple splunk URls for ackUrl
533 #
534 # ackUrls.0 = https://server1:8088/services/collector/ack
535 # ackUrls.1 = https://server1:8088/services/collector/ack
536 # ackUrls.2 = https://server1:8088/services/collector/ack
537 #
538 # Make sure that they in the same order as urls for url, to make sure that this Splunk instance will be
539 # able to acknowledge the payload.
540 #
541 # Limitations:
542 # * The urls cannot have different path.
543
544 # Enable index acknowledgment
545 ackEnabled = false
546
547 # Index acknowledgment timeout
548 ackTimeout = 3m
549
550 # Timeout specifies a time limit for requests made by collectord.
551 # The timeout includes connection time, any
552 # redirects, and reading the response body.
553 timeout = 30s
554
555 # in case when pipeline can post to multiple indexes, we want to avoid posibility of blocking
556 # all pipelines, because just some events have incorrect index
557 dedicatedClientPerIndex = true
558
559 # possible values: RedirectToDefault, Drop, Retry
560 incorrectIndexBehavior = RedirectToDefault
561
562 # gzip compression level (nocompression, default, 1...9)
563 compressionLevel = default
564
565 # number of dedicated splunk output threads (to increase throughput above 4k events per second)
566 threads = 2
567 # Default algorithm between threads is roundrobin, but you can change it to weighted
568 ; threadsAlgorithm = weighted
569
570 # if you want to exclude some preindexed fields from events
571 # excludeFields.openshift_pod_ip = true
572
573 # By default if there are no indexes defined on the message, Collectord sends the event without the index, and
574 # Splunk HTTP Event Collector going to use the default index for the Token. You can change that, and tell Collectord
575 # to ignore all events that don't have index defined explicitly
576 ; requireExplicitIndex = true
577
578 # You can define if you want to truncate messages that are larger than 1M in length (or define your own size, like 256K)
579 ; maximumMessageLength = 1M
580
581 # For messages generated from logs, include unique `event_id` in the event
582 ; includeEventID = false
583
584 # Dedicated queue size for the output, default is 1024, larger queue sizes will require more memory,
585 # but will allow to handle more events in case of network issues
586 queueSize = 1024
587
588 # How many digits after the decimal point to keep for timestamps (0-9)
589 # Defaults to 3 (milliseconds)
590 # Change to 6 for microseconds
591 # Change to 9 for nanoseconds
592 ; timestampPrecision = 3
593
594 002-daemonset.conf: |
595 # DaemonSet configuration is used for Nodes and Masters.
596
597 # connection to CRIO
598 [general.cri-o]
599
600 # url for CRIO API, only unix socket is supported
601 url = unix:///rootfs/var/run/crio/crio.sock
602
603 # Timeout for http responses to docker client. The streaming requests depend on this timeout.
604 timeout = 1m
605
606 # cgroup input
607 [input.system_stats]
608
609 # disable system level stats
610 disabled.host = false
611 disabled.cgroup = false
612
613 # cgroups fs location
614 pathCgroups = /rootfs/sys/fs/cgroup
615
616 # proc location
617 pathProc = /rootfs/proc
618
619 # how often to collect cgroup stats
620 statsInterval = 30s
621
622 # override type
623 type.host = openshift_stats_v2_host
624 type.cgroup = openshift_stats_v2_cgroup
625
626 # specify Splunk index
627 index.host =
628 index.cgroup =
629
630 # set output (splunk or devnull, default is [general]defaultOutput)
631 output.host =
632 output.cgroup =
633
634
635 # proc input
636 [input.proc_stats]
637
638 # disable proc level stats
639 disabled = false
640
641 # proc location
642 pathProc = /rootfs/proc
643
644 # how often to collect proc stats
645 statsInterval = 60s
646
647 # override type
648 type = openshift_proc_stats_v2
649
650 # specify Splunk index
651 index.host =
652 index.cgroup =
653
654 # proc filesystem includes by default system threads (there can be over 100 of them)
655 # these stats do not help with the observability
656 # excluding them can reduce the size of the index, performance of the searches and usage of the collector
657 includeSystemThreads = false
658
659 # set output (splunk or devnull, default is [general]defaultOutput)
660 output.host =
661 output.cgroup =
662
663 # Hide arguments for the processes, replacing with HIDDEN_ARGS(NUMBER)
664 hideArgs = false
665
666
667 # network stats
668 [input.net_stats]
669
670 # disable net stats
671 disabled = false
672
673 # proc path location
674 pathProc = /rootfs/proc
675
676 # how often to collect net stats
677 statsInterval = 30s
678
679 # override type
680 type = openshift_net_stats_v2
681
682 # specify Splunk index
683 index.host =
684 index.cgroup =
685
686 # set output (splunk or devnull, default is [general]defaultOutput)
687 output.host =
688 output.cgroup =
689
690
691 # network socket table
692 [input.net_socket_table]
693
694 # disable net stats
695 disabled = false
696
697 # proc path location
698 pathProc = /rootfs/proc
699
700 # how often to collect net stats
701 statsInterval = 30s
702
703 # override type
704 type = openshift_net_socket_table
705
706 # specify Splunk index
707 index.host =
708 index.cgroup =
709
710 # set output (splunk or devnull, default is [general]defaultOutput)
711 output.host =
712 output.cgroup =
713
714 # group connections by tcp_state, localAddr, remoteAddr (if localPort is not the port it is listening on)
715 # that can significally reduces the amount of events
716 group = true
717
718 # Collectord can watch for services, node, and pod IP addresses, and lookup the names
719 # for the IP addresses. Keeping this enabled can add a significant load on the API Server, with large number of pods.
720 disableLookup = false
721
722
723 # mount input (collects mount stats where kubelet runtime is stored)
724 [input.mount_stats]
725
726 # disable system level stats
727 disabled = false
728
729 # how often to collect mount stats
730 statsInterval = 30s
731
732 # override type
733 type = openshift_mount_stats
734
735 # specify Splunk index
736 index =
737
738 # set output (splunk or devnull, default is [general]defaultOutput)
739 output =
740
741
742 # diskstats input (collects /proc/diskstats)
743 [input.disk_stats]
744
745 # disable system level stats
746 disabled = false
747
748 # how often to collect mount stats
749 statsInterval = 30s
750
751 # override type
752 type = openshift_disk_stats
753
754 # specify Splunk index
755 index =
756
757 # set output (splunk or devnull, default is [general]defaultOutput)
758 output =
759
760
761 # Container Log files
762 [input.files]
763
764 # disable container logs monitoring
765 disabled = false
766
767 # root location of docker log files
768 # logs are expected in standard docker format like {containerID}/{containerID}-json.log
769 # rotated files
770 path = /rootfs/var/lib/docker/containers/
771 # root location of CRI-O files
772 # logs are expected in Kubernetes format, like {podID}/{containerName}/0.log
773 crioPath = /rootfs/var/log/pods/
774
775 # (obsolete) glob matching pattern for log files
776 # glob = */*-json.log*
777
778 # files are read using polling schema, when reach the EOF how often to check if files got updated
779 pollingInterval = 250ms
780
781 # how often to look for the new files under logs path
782 walkingInterval = 5s
783
784 # include verbose fields in events (file offset)
785 verboseFields = false
786
787 # override type
788 type = openshift_logs
789
790 # specify Splunk index
791 index =
792
793 # docker splits events when they are larger than 10-100k (depends on the docker version)
794 # we join them together by default and forward to Splunk as one event
795 joinPartialEvents = true
796
797 # In case if your containers report messages with terminal colors or other escape sequences
798 # you can enable strip for all the containers in one place.
799 # Better is to enable it only for required container with the label collectord.io/strip-terminal-escape-sequences=true
800 stripTerminalEscapeSequences = false
801 # Regexp used for stripping terminal colors, it does not stip all the escape sequences
802 # Read https://man7.org/linux/man-pages/man4/console_codes.4.html for more information
803 stripTerminalEscapeSequencesRegex = (\x1b\[\d{1,3}(;\d{1,3})*m)|(\x07)|(\x1b]\d+(\s\d)?;[^\x07]+\x07)|(.*\x1b\[K)
804
805 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
806 samplingPercent = -1
807
808 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
809 samplingKey =
810
811 # set output (splunk or devnull, default is [general]defaultOutput)
812 output =
813
814 # configure default thruput per second for for each container log
815 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
816 # from the single container to 128Kb per second.
817 thruputPerSecond =
818
819 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
820 # older than 7 days
821 tooOldEvents =
822
823 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
824 tooNewEvents =
825
826
827 # Application Logs
828 [input.app_logs]
829
830 # disable container application logs monitoring
831 disabled = false
832
833 # root location of mounts (applies to hostPath mounts only), if the hostPath differs inside container from the path on host
834 root = /rootfs/
835
836 # how often to review list of available volumes
837 syncInterval = 5s
838
839 # glob matching pattern for log files
840 glob = *.log*
841
842 # files are read using polling schema, when reach the EOF how often to check if files got updated
843 pollingInterval = 250ms
844
845 # how often to look for the new files under logs path
846 walkingInterval = 5s
847
848 # include verbose fields in events (file offset)
849 verboseFields = false
850
851 # override type
852 type = openshift_logs
853
854 # specify Splunk index
855 index =
856
857 # we split files using new line character, with this configuration you can specify what defines the new event
858 # after new line
859 eventPatternRegex = ^[^\s]
860 # Maximum interval of messages in pipeline
861 eventPatternMaxInterval = 100ms
862 # Maximum time to wait for the messages in pipeline
863 eventPatternMaxWait = 1s
864 # Maximum message size
865 eventPatternMaxSize = 1MB
866
867 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
868 samplingPercent = -1
869
870 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
871 samplingKey =
872
873 # set output (splunk or devnull, default is [general]defaultOutput)
874 output =
875
876 # configure default thruput per second for for each container log
877 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
878 # from the single container to 128Kb per second.
879 thruputPerSecond =
880
881 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
882 # older than 7 days
883 tooOldEvents =
884
885 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
886 tooNewEvents =
887
888 # Configure how long Collectord should keep the file descriptors open for files, that has not been forwarded yet
889 # When using PVC, and if pipeline is lagging behind, Collectord holding open fd for files, can cause long termination
890 # of pods, as kubelet cannot unmount the PVC volume from the system
891 maxHoldAfterClose = 1800s
892
893
894 [input.journald]
895
896 # disable host level logs
897 disabled = false
898
899 # root location of log files
900 path.persistent = /rootfs/var/log/journal/
901 # only if required
902 # path.volatile = /rootfs/run/log/journal/
903
904 # when reach end of journald, how often to pull
905 pollingInterval = 250ms
906
907 # if you don't want to forward journald from the beginning,
908 # set the oldest event in relative value, like -14h or -30m or -30s (h/m/s supported)
909 startFromRel =
910
911 # override type
912 type = openshift_host_logs
913
914 # specify Splunk index
915 index =
916
917 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
918 samplingPercent = -1
919
920 # sampling key (should be regexp with the named match pattern `key`)
921 samplingKey =
922
923 # how often to reopen the journald to free old files
924 reopenInterval = 1h
925
926 # set output (splunk or devnull, default is [general]defaultOutput)
927 output =
928
929 # configure default thruput per second for this files group
930 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
931 # from the files in this group to 128Kb per second.
932 thruputPerSecond =
933
934 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
935 # older than 7 days
936 tooOldEvents =
937
938 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
939 tooNewEvents =
940
941 # by default every new event should start from not space symbol
942 eventPattern = ^[^\s]
943
944 # By default ignoring verbose hyperkube logs (all INFO messages)
945 blacklist.0 = ^I\d+.*$
946 # whitelist.0 = ^regexp$
947 # blacklist.1 = ^regexp$
948
949 # Move Journald logs reader to a separate process, to prevent process from crashing in case of corrupted log files
950 spawnExternalProcess = false
951
952 # Pipe to join events (container logs only)
953 [pipe.join]
954
955 # disable joining event
956 disabled = false
957
958 # Maximum interval of messages in pipeline
959 maxInterval = 100ms
960
961 # Maximum time to wait for the messages in pipeline
962 maxWait = 1s
963
964 # Maximum message size
965 maxSize = 1MB
966
967 # Default pattern to indicate new message (should start not from space)
968 patternRegex = ^[^\s]
969
970 # (depricated, use annotations for settings up join rules)
971 # Define special event join patterns for matched events
972 # Section consist of [pipe.join::<name>]
973 # [pipe.join::my_app]
974 ## Set match pattern for the fields
975 #; matchRegex.docker_container_image = my_app
976 #; matchRegex.stream = stdout
977 ## All events start from '[<digits>'
978 #; patternRegex = ^\[\d+
979
980 # You can configure global replace rules for the events, which can help to remove sensitive data
981 # from logs before they are sent to Splunk. Those rules will be applied to all pipelines for container logs, host logs,
982 # application logs and events.
983 # In the following example we replace password=TEST with password=********
984 ; [pipe.replace::name]
985 ; patternRegex = (password=)([^\s]+)
986 ; replace = $1********
987
988 # You can configure global hash rules for the events, which can help to hide sensitive data
989 # from logs before they are sent to outputs. Those rules will be applied to all pipelines for container logs, host logs,
990 # application logs and events.
991 # In the following example we hash IP addresses with fnv-1a-64
992 ; [pipe.hash::name]
993 ; match = (\d{1,3}\.){3}\d{1,3}'
994 ; function = fnv-1a-64
995
996
997 [input.prometheus::kubelet]
998
999 # disable prometheus kubelet metrics
1000 disabled = false
1001
1002 # override type
1003 type = openshift_prometheus
1004
1005 # specify Splunk index
1006 index =
1007
1008 # Override host (environment variables are supported)
1009 host = ${KUBERNETES_NODENAME}
1010
1011 # Override source
1012 source = kubelet
1013
1014 # how often to collect prometheus metrics
1015 interval = 60s
1016
1017 # request timeout
1018 timeout = 60s
1019
1020 # prometheus endpoint
1021 endpoint = https://127.0.0.1:10250/metrics
1022
1023 # token for "Authorization: Bearer $(cat tokenPath)"
1024 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
1025
1026 # server certificate for certificate validation
1027 certPath = /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
1028
1029 # client certificate for authentication
1030 clientCertPath =
1031
1032 # Allow invalid SSL server certificate
1033 insecure = true
1034
1035 # include metrics help with the events
1036 # can be useful to explore prometheus metrics
1037 includeHelp = false
1038
1039 # set output (splunk or devnull, default is [general]defaultOutput)
1040 output =
1041
1042 # filter only metrics used by dashboards
1043 whitelist.1 = ^(kubernetes|openshift)_build_info$
1044 whitelist.2 = ^kubelet_runtime_operations_duration_seconds_sum$
1045 whitelist.3 = ^kubelet_docker_operations_duration_seconds_sum$
1046 whitelist.4 = ^kubelet_network_plugin_operations_duration_seconds_sum$
1047 whitelist.5 = ^kubelet_cgroup_manager_duration_seconds_sum$
1048 whitelist.6 = ^storage_operation_duration_seconds_sum$
1049 whitelist.7 = ^kubelet_docker_operations_errors_total$
1050 whitelist.8 = ^kubelet_runtime_operations_errors_total$
1051 whitelist.9 = ^rest_client_requests_total$
1052 whitelist.10 = ^process_cpu_seconds_total$
1053 whitelist.11 = ^process_resident_memory_bytes$
1054 whitelist.12 = ^process_virtual_memory_bytes$
1055 whitelist.13 = ^kubelet_volume_stats_.+$
1056
1057 ; # Collectord reports if entropy is low (uncomment to use it)
1058 ; [diagnostics::node-entropy]
1059 ; settings.path = /rootfs/proc/sys/kernel/random/entropy_avail
1060 ; settings.interval = 1h
1061 ; settings.threshold = 800
1062
1063 # Collectord can report if node reboot is required (uncomment to use it)
1064 [diagnostics::node-reboot-required]
1065 settings.path = /rootfs/var/run/reboot-required*
1066 settings.interval = 1h
1067
1068 # See https://www.kernel.org/doc/Documentation/admin-guide/hw-vuln/index.rst
1069 # And https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-devices-system-cpu
1070 [diagnostics::cpu-vulnerabilities]
1071 settings.path = /rootfs/sys/devices/system/cpu/vulnerabilities/*
1072 settings.interval = 1h
1073
1074 003-daemonset-master.conf: |
1075 [input.prometheus::kubernetes-api]
1076
1077 # disable prometheus kubernetes-api input
1078 disabled = false
1079
1080 # override type
1081 type = openshift_prometheus
1082
1083 # specify Splunk index
1084 index =
1085
1086 # override host
1087 host = ${KUBERNETES_NODENAME}
1088
1089 # override source
1090 source = kubernetes-api
1091
1092 # how often to collect prometheus metrics
1093 interval = 60s
1094
1095 # request timeout
1096 timeout = 60s
1097
1098 # prometheus endpoint
1099 # at first trying to get it from localhost (that way avoiding load balancer, if multiple)
1100 # as fallback using proxy
1101 endpoint.1localhost = https://127.0.0.1:8443/metrics
1102 endpoint.2kubeapi = https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}/metrics
1103
1104 # token for "Authorization: Bearer $(cat tokenPath)"
1105 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
1106
1107 # server certificate for certificate validation
1108 certPath = /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
1109
1110 # client certificate for authentication
1111 clientCertPath =
1112
1113 # Allow invalid SSL server certificate
1114 insecure = true
1115
1116 # include metrics help with the events
1117 includeHelp = false
1118
1119 # set output (splunk or devnull, default is [general]defaultOutput)
1120 output =
1121
1122 # filter only metrics used by dashboards
1123 whitelist.1 = ^(kubernetes|openshift)_build_info$
1124 whitelist.2 = ^authenticated_user_requests$
1125 whitelist.3 = ^apiserver_request_total$
1126 whitelist.4 = ^process_cpu_seconds_total$
1127 whitelist.5 = ^process_resident_memory_bytes$
1128 whitelist.6 = ^process_virtual_memory_bytes$
1129
1130
1131 [input.prometheus::controller]
1132
1133 # disable prometheus controller metrics
1134 disabled = false
1135
1136 # override type
1137 type = openshift_prometheus
1138
1139 # specify Splunk index
1140 index =
1141
1142 # override host
1143 host = ${KUBERNETES_NODENAME}
1144
1145 # override source
1146 source = controller
1147
1148 # how often to collect prometheus metrics
1149 interval = 60s
1150
1151 # request timeout
1152 timeout = 60s
1153
1154 # prometheus endpoint
1155 endpoint.https1 = https://:10257/metrics
1156 endpoint.https2 = https://:8444/metrics
1157
1158 # token for "Authorization: Bearer $(cat tokenPath)"
1159 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
1160
1161 # server certificate for certificate validation
1162 certPath =
1163
1164 # client certificate for authentication
1165 clientCertPath =
1166 clientKeyPath =
1167
1168 # Allow invalid SSL server certificate
1169 insecure = true
1170
1171 # include metrics help with the events
1172 includeHelp = false
1173
1174 # set output (splunk or devnull, default is [general]defaultOutput)
1175 output =
1176
1177 # filter only metrics used by dashboards
1178 whitelist.1 = ^(kubernetes|openshift)_build_info$
1179 whitelist.2 = ^process_cpu_seconds_total$
1180 whitelist.3 = ^process_resident_memory_bytes$
1181 whitelist.4 = ^process_virtual_memory_bytes$
1182 whitelist.5 = ^node_collector_zone_size$
1183 whitelist.6 = ^node_collector_zone_health$
1184 whitelist.7 = ^node_collector_unhealthy_nodes_in_zone$
1185
1186 [input.prometheus::scheduler]
1187
1188 # disable prometheus scheduler metrics
1189 disabled = false
1190
1191 # override type
1192 type = openshift_prometheus
1193
1194 # specify Splunk index
1195 index =
1196
1197 # override host
1198 host = ${KUBERNETES_NODENAME}
1199
1200 # override source
1201 source = scheduler
1202
1203 # how often to collect prometheus metrics
1204 interval = 60s
1205
1206 # request timeout
1207 timeout = 60s
1208
1209 # prometheus endpoint
1210 endpoint.https1 = https://:10259/metrics
1211 endpoint.https2 = https://:8444/metrics
1212
1213 # token for "Authorization: Bearer $(cat tokenPath)"
1214 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
1215
1216 # server certificate for certificate validation
1217 certPath =
1218
1219 # client certificate for authentication
1220 clientCertPath =
1221 clientKeyPath =
1222
1223 # Allow invalid SSL server certificate
1224 insecure = true
1225
1226 # include metrics help with the events
1227 includeHelp = false
1228
1229 # set output (splunk or devnull, default is [general]defaultOutput)
1230 output =
1231
1232 # filter only metrics used by dashboards
1233 whitelist.1 = ^(kubernetes|openshift)_build_info$
1234 whitelist.2 = ^scheduler_e2e_scheduling_duration_seconds_sum$
1235 whitelist.3 = ^scheduler_binding_duration_seconds_sum$
1236 whitelist.4 = ^scheduler_scheduling_algorithm_duration_seconds_sum$
1237 whitelist.5 = ^process_cpu_seconds_total$
1238 whitelist.6 = ^process_resident_memory_bytes$
1239 whitelist.7 = ^process_virtual_memory_bytes$
1240
1241
1242 [input.prometheus::etcd]
1243
1244 # disable prometheus etcd metrics
1245 disabled = false
1246
1247 # override type
1248 type = openshift_prometheus
1249
1250 # specify Splunk index
1251 index =
1252
1253 # override host
1254 host = ${KUBERNETES_NODENAME}
1255
1256 # override source
1257 source = etcd
1258
1259 # how often to collect prometheus metricd
1260 interval = 60s
1261
1262 # prometheus endpoint
1263 endpoint.https1 = https://:9979/metrics
1264 endpoint.https2 = https://:9978/metrics
1265
1266 # token for "Authorization: Bearer $(cat tokenPath)"
1267 tokenPath =
1268
1269 # server certificate for certificate validation
1270 certPath = /rootfs/etc/kubernetes/static-pod-resources/etcd-certs/secrets/etcd-all-certs/etcd-serving-*.crt
1271
1272 # client certificate for authentication
1273 clientCertPath = /rootfs/etc/kubernetes/static-pod-resources/etcd-certs/secrets/etcd-all-certs/etcd-peer-*.crt
1274 clientKeyPath = /rootfs/etc/kubernetes/static-pod-resources/etcd-certs/secrets/etcd-all-certs/etcd-peer-*.key
1275
1276 # Allow invalid SSL server certificate
1277 insecure = true
1278
1279 # include metrics help with the events
1280 includeHelp = false
1281
1282 # set output (splunk or devnull, default is [general]defaultOutput)
1283 output =
1284
1285 whitelist.1 = ^etcd_server_leader_changes_seen_total$
1286 whitelist.2 = ^etcd_server_has_leader$
1287 whitelist.3 = ^etcd_server_proposals_committed_total$
1288 whitelist.4 = ^etcd_server_proposals_applied_total$
1289 whitelist.5 = ^etcd_server_proposals_committed_total$
1290 whitelist.6 = ^etcd_server_proposals_pending$
1291 whitelist.7 = ^etcd_server_proposals_failed_total$
1292 whitelist.8 = ^etcd_disk_wal_fsync_duration_seconds_sum$
1293 whitelist.9 = ^etcd_disk_wal_fsync_duration_seconds_count$
1294 whitelist.10 = ^etcd_disk_backend_commit_duration_seconds_sum$
1295 whitelist.11 = ^etcd_disk_backend_commit_duration_seconds_count$
1296 whitelist.12 = ^etcd_network_client_grpc_.*$
1297 whitelist.13 = ^grpc_server_handled_total$
1298 whitelist.14 = ^etcd_network_peer_round_trip_time_seconds_bucket$
1299 whitelist.15 = ^process_cpu_seconds_total$
1300 whitelist.16 = ^process_resident_memory_bytes$
1301 whitelist.17 = ^process_virtual_memory_bytes$
1302 whitelist.18 = ^process_open_fds$
1303 whitelist.19 = ^process_max_fds$
1304 whitelist.20 = ^etcd_disk_backend_commit_duration_seconds_bucket$
1305 whitelist.21 = ^etcd_disk_wal_fsync_duration_seconds_bucket$
1306
1307
1308 # Audit logs
1309 [input.files::audit-logs]
1310
1311 # disable host level logs
1312 disabled = false
1313
1314 # root location of for audit logs
1315 path = /rootfs/var/log/kube-apiserver/
1316
1317 # glob matching files
1318 glob = audit*.log
1319
1320 # files are read using polling schema, when reach the EOF how often to check if files got updated
1321 pollingInterval = 250ms
1322
1323 # how often o look for the new files under logs path
1324 walkingInterval = 5s
1325
1326 # include verbose fields in events (file offset)
1327 verboseFields = false
1328
1329 # override type
1330 type = openshift_host_logs
1331
1332 # specify Splunk index
1333 index =
1334
1335 # field extraction
1336 extraction = (?P<message>.*"stageTimestamp":"(?P<timestamp>[^"]+)".*)
1337 extractionMessageField = message
1338
1339 # timestamp field
1340 timestampField = timestamp
1341
1342 # format for timestamp
1343 # the layout defines the format by showing how the reference time, defined to be `Mon Jan 2 15:04:05 -0700 MST 2006`
1344 timestampFormat = 2006-01-02T15:04:05.999999999Z07:00
1345
1346 # timestamp location (if not defined by format)
1347 timestampLocation =
1348
1349 # set output (splunk or devnull, default is [general]defaultOutput)
1350 output =
1351
1352 # configure default thruput per second for this files group
1353 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
1354 # from the files in this group to 128Kb per second.
1355 thruputPerSecond =
1356
1357 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
1358 # older than 7 days
1359 tooOldEvents =
1360
1361 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
1362 tooNewEvents =
1363
1364 # Blacklisting and whitelisting the logs
1365 # whitelist.0 = ^regexp$
1366 # blacklist.0 = ^regexp$
1367
1368
1369 004-addon.conf: |
1370 [general]
1371 # addons can be run in parallel with agents
1372 addon = true
1373
1374 # The addon runs off the host network, so the kubelet probes /healthz and /readyz
1375 # on the pod IP - bind 0.0.0.0 here (overrides the loopback default in
1376 # 001-general.conf, which would be unreachable). Only health/ready are enabled, so
1377 # this exposes nothing beyond the probes on the cluster-internal pod IP.
1378 httpServerBinding = 0.0.0.0:11888
1379
1380 [input.kubernetes_events]
1381
1382 # disable collecting kubernetes events
1383 disabled = false
1384
1385 # override type
1386 type = openshift_events
1387
1388 # specify Splunk index
1389 index =
1390
1391 # set output (splunk or devnull, default is [general]defaultOutput)
1392 output =
1393
1394 # exclude managed fields from the metadata
1395 excludeManagedFields = true
1396
1397
1398 [input.kubernetes_watch::pods]
1399
1400 # disable events
1401 disabled = false
1402
1403 # Set the timeout for how often watch request should refresh the whole list
1404 refresh = 10m
1405
1406 apiVersion = v1
1407 kind = Pod
1408 namespace =
1409
1410 # override type
1411 type = openshift_objects
1412
1413 # specify Splunk index
1414 index =
1415
1416 # set output (splunk or devnull, default is [general]defaultOutput)
1417 output =
1418
1419 # exclude managed fields from the metadata
1420 excludeManagedFields = true
1421
1422 # you can remove or hash some values in the events (after modifyValues you can define path in the JSON object,
1423 # and the value can be hash:{hashFunction}, or remove to remove the object )
1424 ; modifyValues.object.data.* = hash:sha256
1425 ; modifyValues.object.metadata.annotations.* = remove
1426
1427 # You can exclude events by namespace with blacklist or whitelist only required namespaces
1428 # blacklist.kubernetes_namespace = ^namespace0$
1429 # whitelist.kubernetes_namespace = ^((namespace1)|(namespace2))$
1430
1431 [input.kubernetes_watch::resourcequota]
1432 # disable events
1433 disabled = false
1434
1435 # Set the timeout for how often watch request should refresh the whole list
1436 refresh = 10m
1437
1438 apiVersion = v1
1439 kind = ResourceQuota
1440 namespace =
1441
1442 # override type
1443 type = openshift_objects
1444
1445 # specify Splunk index
1446 index =
1447
1448 # set output (splunk or devnull, default is [general]defaultOutput)
1449 output =
1450
1451 # exclude managed fields from the metadata
1452 excludeManagedFields = true
1453
1454
1455 [input.kubernetes_watch::clusterresourcequota]
1456 # disable events
1457 disabled = false
1458
1459 # Set the timeout for how often watch request should refresh the whole list
1460 refresh = 10m
1461
1462 apiVersion = quota.openshift.io/v1
1463 kind = ClusterResourceQuota
1464 namespace =
1465
1466 # override type
1467 type = openshift_objects
1468
1469 # specify Splunk index
1470 index =
1471
1472 # set output (splunk or devnull, default is [general]defaultOutput)
1473 output =
1474
1475 # exclude managed fields from the metadata
1476 excludeManagedFields = true
1477
1478
1479 [input.kubernetes_watch::nodes]
1480 # disable events
1481 disabled = false
1482
1483 # Set the timeout for how often watch request should refresh the whole list
1484 refresh = 10m
1485
1486 apiVersion = v1
1487 kind = Node
1488 namespace =
1489
1490 # override type
1491 type = openshift_objects
1492
1493 # specify Splunk index
1494 index =
1495
1496 # set output (splunk or devnull, default is [general]defaultOutput)
1497 output =
1498
1499 # exclude managed fields from the metadata
1500 excludeManagedFields = true
1501
1502---
1503apiVersion: apps/v1
1504kind: DaemonSet
1505metadata:
1506 name: collectorforopenshift
1507 namespace: collectorforopenshift
1508 labels:
1509 app: collectorforopenshift
1510spec:
1511 # Default updateStrategy is OnDelete. For collectord RollingUpdate is suitable
1512 # When you update configuration
1513 updateStrategy:
1514 type: RollingUpdate
1515
1516 selector:
1517 matchLabels:
1518 daemon: collectorforopenshift
1519
1520 template:
1521 metadata:
1522 name: collectorforopenshift
1523 labels:
1524 daemon: collectorforopenshift
1525 spec:
1526 priorityClassName: collectorforopenshift-critical
1527 dnsPolicy: ClusterFirstWithHostNet
1528 hostNetwork: true
1529 serviceAccountName: collectorforopenshift
1530 # We run this DaemonSet only for Non-Masters
1531 affinity:
1532 nodeAffinity:
1533 requiredDuringSchedulingIgnoredDuringExecution:
1534 nodeSelectorTerms:
1535 - matchExpressions:
1536 - key: node-role.kubernetes.io/control-plane
1537 operator: DoesNotExist
1538 tolerations:
1539 - operator: "Exists"
1540 effect: "NoSchedule"
1541 - operator: "Exists"
1542 effect: "NoExecute"
1543 containers:
1544 - name: collectorforopenshift
1545 # Stick to specific version
1546 image: registry.connect.redhat.com/outcoldsolutions/collectorforopenshift:26.04.4
1547 livenessProbe:
1548 httpGet:
1549 host: 127.0.0.1
1550 path: /healthz
1551 port: 11888
1552 initialDelaySeconds: 120
1553 periodSeconds: 60
1554 timeoutSeconds: 5
1555 failureThreshold: 3
1556 readinessProbe:
1557 httpGet:
1558 host: 127.0.0.1
1559 path: /readyz
1560 port: 11888
1561 initialDelaySeconds: 10
1562 periodSeconds: 15
1563 timeoutSeconds: 5
1564 failureThreshold: 3
1565 securityContext:
1566 privileged: true
1567 runAsUser: 0
1568 # Define your resources if you need. Defaults should be fine for most.
1569 resources:
1570 limits:
1571 cpu: 2000m
1572 memory: 512Mi
1573 requests:
1574 cpu: 500m
1575 memory: 256Mi
1576 env:
1577 - name: KUBERNETES_NODENAME
1578 valueFrom:
1579 fieldRef:
1580 fieldPath: spec.nodeName
1581 - name: POD_NAME
1582 valueFrom:
1583 fieldRef:
1584 fieldPath: metadata.name
1585 volumeMounts:
1586 # We store state in /data folder (file positions)
1587 - name: collectorforopenshift-state
1588 mountPath: /data
1589 # Configuration file deployed with ConfigMap
1590 - name: collectorforopenshift-config
1591 mountPath: /config/
1592 readOnly: true
1593 # Rootfs
1594 - name: rootfs
1595 mountPath: /rootfs/
1596 readOnly: false
1597 mountPropagation: HostToContainer
1598 # correct timezone
1599 - name: localtime
1600 mountPath: /etc/localtime
1601 readOnly: true
1602 volumes:
1603 # We store state directly on host, change this location, if
1604 # your persistent volume is somewhere else
1605 - name: collectorforopenshift-state
1606 hostPath:
1607 path: /var/lib/collectorforopenshift/data/
1608 type: DirectoryOrCreate
1609 # Location of rootfs
1610 - name: rootfs
1611 hostPath:
1612 path: /
1613 # correct timezone
1614 - name: localtime
1615 hostPath:
1616 path: /etc/localtime
1617 # configuration from ConfigMap
1618 - name: collectorforopenshift-config
1619 configMap:
1620 name: collectorforopenshift
1621 items:
1622 - key: 001-general.conf
1623 path: 001-general.conf
1624 - key: 002-daemonset.conf
1625 path: 002-daemonset.conf
1626---
1627apiVersion: apps/v1
1628kind: DaemonSet
1629metadata:
1630 name: collectorforopenshift-master
1631 namespace: collectorforopenshift
1632 labels:
1633 app: collectorforopenshift
1634spec:
1635 updateStrategy:
1636 type: RollingUpdate
1637 selector:
1638 matchLabels:
1639 daemon: collectorforopenshift
1640 template:
1641 metadata:
1642 name: collectorforopenshift-master
1643 labels:
1644 daemon: collectorforopenshift
1645 spec:
1646 priorityClassName: collectorforopenshift-critical
1647 dnsPolicy: ClusterFirstWithHostNet
1648 hostNetwork: true
1649 serviceAccountName: collectorforopenshift
1650 # Deploy only on master
1651 affinity:
1652 nodeAffinity:
1653 requiredDuringSchedulingIgnoredDuringExecution:
1654 nodeSelectorTerms:
1655 - matchExpressions:
1656 - key: node-role.kubernetes.io/control-plane
1657 operator: Exists
1658 tolerations:
1659 - operator: "Exists"
1660 effect: "NoSchedule"
1661 - operator: "Exists"
1662 effect: "NoExecute"
1663 containers:
1664 - name: collectorforopenshift
1665 image: registry.connect.redhat.com/outcoldsolutions/collectorforopenshift:26.04.4
1666 livenessProbe:
1667 httpGet:
1668 host: 127.0.0.1
1669 path: /healthz
1670 port: 11888
1671 initialDelaySeconds: 120
1672 periodSeconds: 60
1673 timeoutSeconds: 5
1674 failureThreshold: 3
1675 readinessProbe:
1676 httpGet:
1677 host: 127.0.0.1
1678 path: /readyz
1679 port: 11888
1680 initialDelaySeconds: 10
1681 periodSeconds: 15
1682 timeoutSeconds: 5
1683 failureThreshold: 3
1684 securityContext:
1685 privileged: true
1686 runAsUser: 0
1687 resources:
1688 limits:
1689 cpu: 2000m
1690 memory: 1024Mi
1691 requests:
1692 cpu: 500m
1693 memory: 256Mi
1694 env:
1695 - name: KUBERNETES_NODENAME
1696 valueFrom:
1697 fieldRef:
1698 fieldPath: spec.nodeName
1699 - name: POD_NAME
1700 valueFrom:
1701 fieldRef:
1702 fieldPath: metadata.name
1703 volumeMounts:
1704 - name: collectorforopenshift-state
1705 mountPath: /data
1706 - name: collectorforopenshift-config
1707 mountPath: /config/
1708 readOnly: true
1709 # Rootfs
1710 - name: rootfs
1711 mountPath: /rootfs/
1712 readOnly: false
1713 mountPropagation: HostToContainer
1714 - name: localtime
1715 mountPath: /etc/localtime
1716 readOnly: true
1717 volumes:
1718 - name: collectorforopenshift-state
1719 hostPath:
1720 path: /var/lib/collectorforopenshift/data/
1721 type: DirectoryOrCreate
1722 - name: rootfs
1723 hostPath:
1724 path: /
1725 - name: localtime
1726 hostPath:
1727 path: /etc/localtime
1728 - name: collectorforopenshift-config
1729 configMap:
1730 name: collectorforopenshift
1731 items:
1732 - key: 001-general.conf
1733 path: 001-general.conf
1734 - key: 002-daemonset.conf
1735 path: 002-daemonset.conf
1736 - key: 003-daemonset-master.conf
1737 path: 003-daemonset-master.conf
1738---
1739apiVersion: apps/v1
1740kind: Deployment
1741metadata:
1742 name: collectorforopenshift-addon
1743 namespace: collectorforopenshift
1744 labels:
1745 app: collectorforopenshift
1746spec:
1747 replicas: 1
1748 selector:
1749 matchLabels:
1750 daemon: collectorforopenshift
1751 template:
1752 metadata:
1753 name: collectorforopenshift-addon
1754 labels:
1755 daemon: collectorforopenshift
1756 spec:
1757 priorityClassName: collectorforopenshift-critical
1758 serviceAccountName: collectorforopenshift
1759 containers:
1760 - name: collectorforopenshift
1761 image: registry.connect.redhat.com/outcoldsolutions/collectorforopenshift:26.04.4
1762 livenessProbe:
1763 httpGet:
1764 path: /healthz
1765 port: 11888
1766 initialDelaySeconds: 120
1767 periodSeconds: 60
1768 timeoutSeconds: 5
1769 failureThreshold: 3
1770 readinessProbe:
1771 httpGet:
1772 path: /readyz
1773 port: 11888
1774 initialDelaySeconds: 10
1775 periodSeconds: 15
1776 timeoutSeconds: 5
1777 failureThreshold: 3
1778 securityContext:
1779 privileged: true
1780 runAsUser: 0
1781 resources:
1782 limits:
1783 cpu: 1000m
1784 memory: 512Mi
1785 requests:
1786 cpu: 200m
1787 memory: 64Mi
1788 env:
1789 - name: KUBERNETES_NODENAME
1790 valueFrom:
1791 fieldRef:
1792 fieldPath: spec.nodeName
1793 - name: POD_NAME
1794 valueFrom:
1795 fieldRef:
1796 fieldPath: metadata.name
1797 volumeMounts:
1798 - name: collectorforopenshift-state
1799 mountPath: /data
1800 - name: collectorforopenshift-config
1801 mountPath: /config/
1802 readOnly: true
1803 volumes:
1804 - name: collectorforopenshift-state
1805 hostPath:
1806 path: /var/lib/collectorforopenshift/data/
1807 type: Directory
1808 - name: collectorforopenshift-config
1809 configMap:
1810 name: collectorforopenshift
1811 items:
1812 - key: 001-general.conf
1813 path: 001-general.conf
1814 - key: 004-addon.conf
1815 path: 004-addon.conf
