1apiVersion: project.openshift.io/v1
2kind: Project
3metadata:
4 labels:
5 app: collectorforopenshift
6 name: collectorforopenshift
7 annotations:
8 openshift.io/node-selector: ''
9 openshift.io/description: 'Monitoring OpenShift in Splunk, built by Outcold Solutions'
10 openshift.io/display-name: 'Collectord for OpenShift'
11---
12apiVersion: apiextensions.k8s.io/v1
13kind: CustomResourceDefinition
14metadata:
15 name: configurations.collectord.io
16spec:
17 group: collectord.io
18 versions:
19 - name: v1
20 served: true
21 storage: true
22 schema:
23 openAPIV3Schema:
24 type: object
25 properties:
26 spec:
27 type: object
28 additionalProperties: true
29 force:
30 type: boolean
31 scope: Cluster
32 names:
33 listKind: ConfigurationList
34 plural: configurations
35 singular: configuration
36 kind: Configuration
37---
38apiVersion: apiextensions.k8s.io/v1
39kind: CustomResourceDefinition
40metadata:
41 name: splunkoutputs.collectord.io
42spec:
43 group: collectord.io
44 versions:
45 - name: v1
46 served: true
47 storage: true
48 schema:
49 openAPIV3Schema:
50 type: object
51 properties:
52 spec:
53 type: object
54 properties:
55 url:
56 type: string
57 format: uri
58 insecure:
59 type: boolean
60 token:
61 type: string
62 description: "Plain token"
63 tokenFromSecret:
64 type: object
65 description: "Reference to a Kubernetes Secret"
66 properties:
67 secret:
68 type: string
69 key:
70 type: string
71 oneOf:
72 - required: ["token"]
73 - required: ["tokenFromSecret"]
74 scope: Namespaced
75 names:
76 listKind: SplunkOutputList
77 plural: splunkoutputs
78 singular: splunkoutput
79 kind: SplunkOutput
80---
81apiVersion: scheduling.k8s.io/v1
82kind: PriorityClass
83metadata:
84 name: collectorforopenshift-critical
85value: 1000000000
86---
87kind: SecurityContextConstraints
88apiVersion: security.openshift.io/v1
89metadata:
90 name: collectorforopenshift
91allowHostDirVolumePlugin: true
92allowHostIPC: true
93allowHostNetwork: true
94allowHostPID: true
95allowHostPorts: true
96allowPrivilegeEscalation: true
97allowPrivilegedContainer: true
98readOnlyRootFilesystem: false
99allowedCapabilities:
100 - '*'
101allowedUnsafeSysctls:
102 - '*'
103fsGroup:
104 type: RunAsAny
105runAsUser:
106 type: RunAsAny
107seLinuxContext:
108 type: RunAsAny
109supplementalGroups:
110 type: RunAsAny
111seccompProfiles:
112 - '*'
113users:
114 - system:serviceaccount:collectorforopenshift:collectorforopenshift
115volumes:
116 - '*'
117---
118apiVersion: v1
119kind: ServiceAccount
120metadata:
121 labels:
122 app: collectorforopenshift
123 name: collectorforopenshift
124 namespace: collectorforopenshift
125---
126apiVersion: rbac.authorization.k8s.io/v1
127kind: ClusterRole
128metadata:
129 labels:
130 app: collectorforopenshift
131 name: collectorforopenshift
132rules:
133- apiGroups:
134 - ""
135 - apps
136 - batch
137 - extensions
138 - collectord.io
139 - apps.openshift.io
140 - build.openshift.io
141 - authorization.openshift.io
142 - template.openshift.io
143 - quota.openshift.io
144 - discovery.k8s.io
145 resources:
146 - alertmanagers
147 - clusterresourcequotas
148 - clusterroles
149 - configurations
150 - cronjobs
151 - daemonsets
152 - deploymentconfigs
153 - deployments
154 - endpointslices
155 - events
156 - jobs
157 - namespaces
158 - nodes
159 - nodes/metrics
160 - nodes/proxy
161 - persistentvolumeclaims
162 - pods
163 - replicasets
164 - replicationcontrollers
165 - resourcequotas
166 - scheduledjobs
167 - secrets
168 - services
169 - splunkoutputs
170 - statefulsets
171 verbs:
172 - get
173 - list
174 - watch
175- nonResourceURLs:
176 - /metrics
177 verbs:
178 - get
179 apiGroups: []
180 resources: []
181---
182apiVersion: rbac.authorization.k8s.io/v1
183kind: ClusterRoleBinding
184metadata:
185 labels:
186 app: collectorforopenshift
187 name: collectorforopenshift
188roleRef:
189 kind: ClusterRole
190 name: collectorforopenshift
191 apiGroup: rbac.authorization.k8s.io
192subjects:
193 - kind: ServiceAccount
194 name: collectorforopenshift
195 namespace: collectorforopenshift
196---
197apiVersion: v1
198kind: ConfigMap
199metadata:
200 name: collectorforopenshift
201 namespace: collectorforopenshift
202 labels:
203 app: collectorforopenshift
204data:
205 001-general.conf: |
206 # The general configuration is used for all deployments
207 #
208 # Run collectord with the flag `-conf` and specify location of the configuration files.
209 #
210 # You can override all the values using environment variables with the format like
211 # COLLECTOR__<ANYNAME>=<section>__<key>=<value>
212 # As an example you can set `dataPath` in the `[general]` section as
213 # COLLECTOR__DATAPATH=general__dataPath=C:\\some\\path\\data.db
214 # This parameter can be configured using -env-override, set it to empty string to disable this feature
215
216 [general]
217
218 # Please review license https://www.outcoldsolutions.com/legal/license-agreement/
219 # and accept license by changing the value to *true*
220 acceptLicense = false
221
222 # Location for the database
223 # Collectord stores positions of the files and internal state
224 dataPath = ./data/
225
226 # log level (accepted values are trace, debug, info, warn, error, fatal)
227 logLevel = info
228
229 # Internal http server. Bound to loopback so nothing is published on the node
230 # network: the DaemonSets run on the host network, where a 0.0.0.0 bind would
231 # expose these endpoints on the node IP. The liveness/readiness probes still reach
232 # it via httpGet.host 127.0.0.1 (the kubelet shares the host network namespace).
233 # The addon runs off the host network and overrides this to 0.0.0.0 in
234 # 004-addon.conf so the kubelet can reach it on the pod IP.
235 httpServerBinding = 127.0.0.1:11888
236
237 # Enable endpoints individually. Only the probe endpoints default on. metrics
238 # (/metrics/json, /metrics/prometheus) and pprof (/debug/pprof) expose internal
239 # detail and are unreachable on a loopback bind anyway - to scrape or profile,
240 # enable the endpoint and widen httpServerBinding (e.g. 0.0.0.0:11888).
241 httpServerEndpoints.health = true
242 httpServerEndpoints.ready = true
243 httpServerEndpoints.metrics = false
244 httpServerEndpoints.pprof = false
245
246 # log requests to the http server
247 httpServerLog = false
248
249 # telemetry report endpoint, set it to empty string to disable telemetry
250 telemetryEndpoint = https://license.outcold.solutions/telemetry/
251
252 # license check endpoint
253 licenseEndpoint = https://license.outcold.solutions/license/
254
255 # license server through proxy
256 # This configuration is used only for the Outcold Solutions License Server
257 # For license server running on-premises, use configuration under [license.client]
258 licenseServerProxyUrl =
259
260 # authentication with basic authorization (user:password)
261 # This configuration is used only for the Outcold Solutions License Server
262 # For license server running on-premises, use configuration under [license.client]
263 licenseServerProxyBasicAuth =
264
265 # license key
266 license =
267
268 # Environment variable $KUBERNETES_NODENAME is used by default to setup hostname
269 # Use value below to override specific name
270 hostname =
271
272 # Default output for events, logs and metrics
273 # valid values: splunk and devnull
274 # Use devnull by default if you don't want to redirect data
275 defaultOutput = splunk
276
277 # Default buffer size for file input
278 fileInputBufferSize = 256b
279
280 # Maximum size of one line the file reader can read
281 fileInputLineMaxSize = 1mb
282
283 # Include custom fields to attach to every event, in example below every event sent to Splunk will hav
284 # indexed field my_environment=dev. Fields names should match to ^[a-z][_a-z0-9]*$
285 # Better way to configure that is to specify labels for OpenShift Nodes.
286 # ; fields.my_environment = dev
287 # Identify the cluster if you are planning to monitor multiple clusters
288 fields.openshift_cluster = -
289
290 # Include EC2 Metadata (see list of possible fields https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html)
291 # Should be in format ec2Metadata.{desired_field_name} = {url path to read the value}
292 # ec2Metadata.ec2_instance_id = /latest/meta-data/instance-id
293 # ec2Metadata.ec2_instance_type = /latest/meta-data/instance-type
294
295 # subdomain for the annotations added to the pods, workloads, namespaces or containers, like splunk.collectord.io/..
296 annotationsSubdomain =
297
298 # configure global thruput per second for forwarded logs (metrics are not included)
299 # for example if you set `thruputPerSecond = 512Kb`, that will limit amount of logs forwarded
300 # from the single Collectord instance to 512Kb per second.
301 # You can configure thruput individually for the logs (including specific for container logs) below
302 thruputPerSecond =
303
304 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
305 # older than 7 days
306 tooOldEvents =
307
308 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
309 tooNewEvents =
310
311 # For input.files::X and application logs, when glob or match are configured, Collectord can automatically
312 # detect gzipped files and skip them (based on the extensions or magic numbers)
313 autoSkipGzipFiles = true
314
315 # Multi-output async publishing. When enabled (default), events routed to
316 # non-default outputs are published asynchronously so that a slow or down
317 # output does not block events destined for other outputs.
318 ; multioutput.async = true
319 # Buffer size for the async proxy (default 100). Absorbs transient bursts.
320 # When this buffer and the output's own queue are both full, events are
321 # dropped immediately without blocking the pipeline.
322 ; multioutput.asyncBufferSize = 100
323
324 [license.client]
325 # point to the license located on the HTTP web server, or a hosted by the Collectord running as license server
326 url =
327 # basic authentication for the HTTP server
328 basicAuth =
329 # if SSL, ignore the certificate verification
330 insecure = false
331 # CA Path for the Server certificate
332 capath =
333 # CA Name fot the Server certificate
334 caname =
335 # license server through proxy
336 proxyUrl =
337 # authentication with basic authorization (user:password)
338 proxyBasicAuth =
339
340 # forward internal collectord metrics
341 [input.collectord_metrics]
342
343 # disable collectord internal metrics
344 disabled = false
345
346 # override type
347 type = openshift_prometheus
348
349 # how often to collect internal metrics
350 interval = 1m
351
352 # set output (splunk or devnull, default is [general]defaultOutput)
353 output =
354
355 # specify Splunk index
356 index =
357
358 # whitelist or blacklist the metrics
359 whitelist.1 = ^file_input_open$
360 whitelist.2 = ^file_input_read_bytes$
361 whitelist.3 = ^openshift_handlers$
362 whitelist.4 = ^pipe$
363 whitelist.5 = ^pipelines_num$
364 whitelist.6 = ^splunk_post_bytes_sum.*$
365 whitelist.7 = ^splunk_post_events_count_sum.*$
366 whitelist.8 = ^splunk_post_failed_requests$
367 whitelist.9 = ^splunk_post_message_max_lag_seconds_bucket.*$
368 whitelist.10 = ^splunk_post_requests_seconds_sum.*$
369 whitelist.11 = ^splunk_post_retries_required_sum.*$
370
371
372 # connection to kubernetes api
373 [general.kubernetes]
374
375 # Override service URL for Kubernetes (default is ${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT})
376 serviceURL =
377
378 # Environment variable $KUBERNETES_NODENAME is used by default to setup nodeName
379 # Use it only when you need to override it
380 nodeName =
381
382 # Configuration to access the API server,
383 # see https://kubernetes.io/docs/tasks/access-application-cluster/access-cluster/#accessing-the-api-from-a-pod
384 # for details
385 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
386 certPath = /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
387
388 # Default timeout for http responses. The streaming/watch requests depend on this timeout.
389 timeout = 30m
390
391 # How long to keep the cache for the recent calls to API server (to limit number of calls when collectord discovers new pods)
392 metadataTTL = 30s
393
394 # regex to find pods
395 podsCgroupFilter = ^/([^/\s]+/)*kubepods(\.slice)?/((kubepods-)?(burstable|besteffort)(\.slice)?/)?([^/]*)pod([0-9a-f]{32}|[0-9a-f\-_]{36})(\.slice)?$
396
397 # regex to find containers in the pods
398 containersCgroupFilter = ^/([^/\s]+/)*kubepods(\.slice)?/((kubepods-)?(burstable|besteffort)(\.slice)?/)?([^/]*)pod([0-9a-f]{32}|[0-9a-f\-_]{36})(\.slice)?/(docker-|crio-|cri-\w+-)?[0-9a-f]{64}(\.scope)?(\/.+)?$
399
400 # path to the kubelet root location (use it to discover application logs for emptyDir)
401 # the expected format is `pods/{pod-id}/volumes/kubernetes.io~empty-dir/{volume-name}/_data/`
402 volumesRootDir = /rootfs/var/lib/kubelet/
403
404 # You can attach annotations as a metadata, using the format
405 # includeAnnotations.{key} = {regexp}
406 # For example if you want to include all annotations that starts with `prometheus.io` or `example.com` you can include
407 # the following format:
408 # includeAnnotations.1 = ^prometheus\.io.*
409 # includeAnnotations.2 = ^example\.com.*
410
411 # You can exclude labels from metadata, using the format
412 # excludeLabels.{key} = {regexp}
413 # For example if you want to exclude all labels that starts with `prometheus.io` or `example.com` you can include
414 # the following format:
415 # excludeLabels.1 = ^prometheus\.io.*
416 # excludeLabels.2 = ^example\.com.*
417
418 # watch for changes (annotations) in the objects
419 watch.namespaces = v1/namespace
420 watch.deploymentconfigs = apps.openshift.io/v1/deploymentconfig
421 watch.configurations = collectord.io/v1/configuration
422
423 # Collectord can review the assigned ClusterRole and traverse metadata for the Pods only for the Owner objects
424 # that are defined in the ClusterRole, ignoring anything else, it does not have access to.
425 # This way Collectord does not generate 403 requests on API Server
426 clusterRole = collectorforopenshift
427
428 # Alternative of telling Collectord about the ClusterRole is to manually list the objects.
429 # You can define which objects Collectord should traverse when it sees Owners.
430 ; traverseOwnership.namespaces = v1/namespace
431
432 # Implementation of the watch protocol.
433 # 0 - use the default implementation (2)
434 # 1 - use the watch implementation that is optimized for the small number of objects (just issue one watch for all objects)
435 # 2 - use the watch implementation that is optimized for the large number of objects (paginate through the list of objects and issue watch for the last resource version)
436 watchImplementation = 2
437
438 # watch for pods annotations, setup prometheus collection
439 # for these pods
440 # Addon listens on Pod Network
441 # DaemonSets listen on Host Network
442 [input.prometheus_auto]
443
444 # disable prometheus auto discovery for pods
445 disabled = false
446
447 # override type
448 type = openshift_prometheus
449
450 # specify Splunk index
451 index =
452
453 # how often to collect prometheus metrics
454 interval = 60s
455
456 # request timeout
457 timeout = 60s
458
459 # include metrics help with the events
460 includeHelp = true
461
462 # http client timeout
463 timeout = 30s
464
465 # set output (splunk or devnull, default is [general]defaultOutput)
466 output =
467
468 # Include an Authorization header for the prometheus scrapper
469 # When configuring scrapping with collectord using annotations use prometheus.1-AuthorizationKey=key1
470 # authorization.key1 = Bearer FOO
471
472
473 # Splunk output
474 [output.splunk]
475
476 # Splunk HTTP Event Collector url
477 url =
478 # You can specify muiltiple splunk URls with
479 #
480 # urls.0 = https://server1:8088/services/collector/event/1.0
481 # urls.1 = https://server1:8088/services/collector/event/1.0
482 # urls.2 = https://server1:8088/services/collector/event/1.0
483 #
484 # Limitations:
485 # * The urls cannot have different path.
486
487 # Specify how URL should be picked up (in case if multiple is used)
488 # urlSelection = random|round-robin|random-with-round-robin
489 # where:
490 # * random - choose random url on first selection and after each failure (connection or HTTP status code >= 500)
491 # * round-robin - choose url starting from first one and bump on each failure (connection or HTTP status code >= 500)
492 # * random-with-round-robin - choose random url on first selection and after that in round-robin on each
493 # failure (connection or HTTP status code >= 500)
494 urlSelection = random-with-round-robin
495
496 # Splunk HTTP Event Collector Token
497 token =
498
499 # Allow invalid SSL server certificate
500 insecure = false
501 # minTLSVersion = TLSv1.2
502 # maxTLSVersion = TLSv1.3
503
504 # Path to CA cerificate
505 caPath =
506
507 # CA Name to verify
508 caName =
509
510 # path for client certificate (if required)
511 clientCertPath =
512
513 # path for client key (if required)
514 clientKeyPath =
515
516 # Events are batched with the maximum size set by batchSize and staying in pipeline for not longer
517 # than set by frequency
518 frequency = 5s
519 batchSize = 768K
520 # limit by the number of events (0 value has no limit on the number of events)
521 events = 50
522
523 # Splunk through proxy
524 proxyUrl =
525
526 # authentication with basic authorization (user:password)
527 proxyBasicAuth =
528
529 # Splunk acknowledgement url (.../services/collector/ack)
530 ackUrl =
531 # You can specify muiltiple splunk URls for ackUrl
532 #
533 # ackUrls.0 = https://server1:8088/services/collector/ack
534 # ackUrls.1 = https://server1:8088/services/collector/ack
535 # ackUrls.2 = https://server1:8088/services/collector/ack
536 #
537 # Make sure that they in the same order as urls for url, to make sure that this Splunk instance will be
538 # able to acknowledge the payload.
539 #
540 # Limitations:
541 # * The urls cannot have different path.
542
543 # Enable index acknowledgment
544 ackEnabled = false
545
546 # Index acknowledgment timeout
547 ackTimeout = 3m
548
549 # Timeout specifies a time limit for requests made by collectord.
550 # The timeout includes connection time, any
551 # redirects, and reading the response body.
552 timeout = 30s
553
554 # in case when pipeline can post to multiple indexes, we want to avoid posibility of blocking
555 # all pipelines, because just some events have incorrect index
556 dedicatedClientPerIndex = true
557
558 # possible values: RedirectToDefault, Drop, Retry
559 incorrectIndexBehavior = RedirectToDefault
560
561 # gzip compression level (nocompression, default, 1...9)
562 compressionLevel = default
563
564 # number of dedicated splunk output threads (to increase throughput above 4k events per second)
565 threads = 2
566 # Default algorithm between threads is roundrobin, but you can change it to weighted
567 ; threadsAlgorithm = weighted
568
569 # if you want to exclude some preindexed fields from events
570 # excludeFields.openshift_pod_ip = true
571
572 # By default if there are no indexes defined on the message, Collectord sends the event without the index, and
573 # Splunk HTTP Event Collector going to use the default index for the Token. You can change that, and tell Collectord
574 # to ignore all events that don't have index defined explicitly
575 ; requireExplicitIndex = true
576
577 # You can define if you want to truncate messages that are larger than 1M in length (or define your own size, like 256K)
578 ; maximumMessageLength = 1M
579
580 # For messages generated from logs, include unique `event_id` in the event
581 ; includeEventID = false
582
583 # Dedicated queue size for the output, default is 1024, larger queue sizes will require more memory,
584 # but will allow to handle more events in case of network issues
585 queueSize = 1024
586
587 # How many digits after the decimal point to keep for timestamps (0-9)
588 # Defaults to 3 (milliseconds)
589 # Change to 6 for microseconds
590 # Change to 9 for nanoseconds
591 ; timestampPrecision = 3
592
593 002-daemonset.conf: |
594 # DaemonSet configuration is used for Nodes and Masters.
595
596 # connection to CRIO
597 [general.cri-o]
598
599 # url for CRIO API, only unix socket is supported
600 url = unix:///rootfs/var/run/crio/crio.sock
601
602 # Timeout for http responses to docker client. The streaming requests depend on this timeout.
603 timeout = 1m
604
605 # cgroup input
606 [input.system_stats]
607
608 # disable system level stats
609 disabled.host = false
610 disabled.cgroup = false
611
612 # cgroups fs location
613 pathCgroups = /rootfs/sys/fs/cgroup
614
615 # proc location
616 pathProc = /rootfs/proc
617
618 # how often to collect cgroup stats
619 statsInterval = 30s
620
621 # override type
622 type.host = openshift_stats_v2_host
623 type.cgroup = openshift_stats_v2_cgroup
624
625 # specify Splunk index
626 index.host =
627 index.cgroup =
628
629 # set output (splunk or devnull, default is [general]defaultOutput)
630 output.host =
631 output.cgroup =
632
633
634 # proc input
635 [input.proc_stats]
636
637 # disable proc level stats
638 disabled = false
639
640 # proc location
641 pathProc = /rootfs/proc
642
643 # how often to collect proc stats
644 statsInterval = 60s
645
646 # override type
647 type = openshift_proc_stats_v2
648
649 # specify Splunk index
650 index.host =
651 index.cgroup =
652
653 # proc filesystem includes by default system threads (there can be over 100 of them)
654 # these stats do not help with the observability
655 # excluding them can reduce the size of the index, performance of the searches and usage of the collector
656 includeSystemThreads = false
657
658 # set output (splunk or devnull, default is [general]defaultOutput)
659 output.host =
660 output.cgroup =
661
662 # Hide arguments for the processes, replacing with HIDDEN_ARGS(NUMBER)
663 hideArgs = false
664
665
666 # network stats
667 [input.net_stats]
668
669 # disable net stats
670 disabled = false
671
672 # proc path location
673 pathProc = /rootfs/proc
674
675 # how often to collect net stats
676 statsInterval = 30s
677
678 # override type
679 type = openshift_net_stats_v2
680
681 # specify Splunk index
682 index.host =
683 index.cgroup =
684
685 # set output (splunk or devnull, default is [general]defaultOutput)
686 output.host =
687 output.cgroup =
688
689
690 # network socket table
691 [input.net_socket_table]
692
693 # disable net stats
694 disabled = false
695
696 # proc path location
697 pathProc = /rootfs/proc
698
699 # how often to collect net stats
700 statsInterval = 30s
701
702 # override type
703 type = openshift_net_socket_table
704
705 # specify Splunk index
706 index.host =
707 index.cgroup =
708
709 # set output (splunk or devnull, default is [general]defaultOutput)
710 output.host =
711 output.cgroup =
712
713 # group connections by tcp_state, localAddr, remoteAddr (if localPort is not the port it is listening on)
714 # that can significally reduces the amount of events
715 group = true
716
717 # Collectord can watch for services, node, and pod IP addresses, and lookup the names
718 # for the IP addresses. Keeping this enabled can add a significant load on the API Server, with large number of pods.
719 disableLookup = false
720
721
722 # mount input (collects mount stats where kubelet runtime is stored)
723 [input.mount_stats]
724
725 # disable system level stats
726 disabled = false
727
728 # how often to collect mount stats
729 statsInterval = 30s
730
731 # override type
732 type = openshift_mount_stats
733
734 # specify Splunk index
735 index =
736
737 # set output (splunk or devnull, default is [general]defaultOutput)
738 output =
739
740
741 # diskstats input (collects /proc/diskstats)
742 [input.disk_stats]
743
744 # disable system level stats
745 disabled = false
746
747 # how often to collect mount stats
748 statsInterval = 30s
749
750 # override type
751 type = openshift_disk_stats
752
753 # specify Splunk index
754 index =
755
756 # set output (splunk or devnull, default is [general]defaultOutput)
757 output =
758
759
760 # Container Log files
761 [input.files]
762
763 # disable container logs monitoring
764 disabled = false
765
766 # root location of docker log files
767 # logs are expected in standard docker format like {containerID}/{containerID}-json.log
768 # rotated files
769 path = /rootfs/var/lib/docker/containers/
770 # root location of CRI-O files
771 # logs are expected in Kubernetes format, like {podID}/{containerName}/0.log
772 crioPath = /rootfs/var/log/pods/
773
774 # (obsolete) glob matching pattern for log files
775 # glob = */*-json.log*
776
777 # files are read using polling schema, when reach the EOF how often to check if files got updated
778 pollingInterval = 250ms
779
780 # how often to look for the new files under logs path
781 walkingInterval = 5s
782
783 # include verbose fields in events (file offset)
784 verboseFields = false
785
786 # override type
787 type = openshift_logs
788
789 # specify Splunk index
790 index =
791
792 # docker splits events when they are larger than 10-100k (depends on the docker version)
793 # we join them together by default and forward to Splunk as one event
794 joinPartialEvents = true
795
796 # In case if your containers report messages with terminal colors or other escape sequences
797 # you can enable strip for all the containers in one place.
798 # Better is to enable it only for required container with the label collectord.io/strip-terminal-escape-sequences=true
799 stripTerminalEscapeSequences = false
800 # Regexp used for stripping terminal colors, it does not stip all the escape sequences
801 # Read https://man7.org/linux/man-pages/man4/console_codes.4.html for more information
802 stripTerminalEscapeSequencesRegex = (\x1b\[\d{1,3}(;\d{1,3})*m)|(\x07)|(\x1b]\d+(\s\d)?;[^\x07]+\x07)|(.*\x1b\[K)
803
804 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
805 samplingPercent = -1
806
807 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
808 samplingKey =
809
810 # set output (splunk or devnull, default is [general]defaultOutput)
811 output =
812
813 # configure default thruput per second for for each container log
814 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
815 # from the single container to 128Kb per second.
816 thruputPerSecond =
817
818 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
819 # older than 7 days
820 tooOldEvents =
821
822 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
823 tooNewEvents =
824
825
826 # Application Logs
827 [input.app_logs]
828
829 # disable container application logs monitoring
830 disabled = false
831
832 # root location of mounts (applies to hostPath mounts only), if the hostPath differs inside container from the path on host
833 root = /rootfs/
834
835 # how often to review list of available volumes
836 syncInterval = 5s
837
838 # glob matching pattern for log files
839 glob = *.log*
840
841 # files are read using polling schema, when reach the EOF how often to check if files got updated
842 pollingInterval = 250ms
843
844 # how often to look for the new files under logs path
845 walkingInterval = 5s
846
847 # include verbose fields in events (file offset)
848 verboseFields = false
849
850 # override type
851 type = openshift_logs
852
853 # specify Splunk index
854 index =
855
856 # we split files using new line character, with this configuration you can specify what defines the new event
857 # after new line
858 eventPatternRegex = ^[^\s]
859 # Maximum interval of messages in pipeline
860 eventPatternMaxInterval = 100ms
861 # Maximum time to wait for the messages in pipeline
862 eventPatternMaxWait = 1s
863 # Maximum message size
864 eventPatternMaxSize = 1MB
865
866 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
867 samplingPercent = -1
868
869 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
870 samplingKey =
871
872 # set output (splunk or devnull, default is [general]defaultOutput)
873 output =
874
875 # configure default thruput per second for for each container log
876 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
877 # from the single container to 128Kb per second.
878 thruputPerSecond =
879
880 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
881 # older than 7 days
882 tooOldEvents =
883
884 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
885 tooNewEvents =
886
887 # Configure how long Collectord should keep the file descriptors open for files, that has not been forwarded yet
888 # When using PVC, and if pipeline is lagging behind, Collectord holding open fd for files, can cause long termination
889 # of pods, as kubelet cannot unmount the PVC volume from the system
890 maxHoldAfterClose = 1800s
891
892
893 [input.journald]
894
895 # disable host level logs
896 disabled = false
897
898 # root location of log files
899 path.persistent = /rootfs/var/log/journal/
900 # only if required
901 # path.volatile = /rootfs/run/log/journal/
902
903 # when reach end of journald, how often to pull
904 pollingInterval = 250ms
905
906 # if you don't want to forward journald from the beginning,
907 # set the oldest event in relative value, like -14h or -30m or -30s (h/m/s supported)
908 startFromRel =
909
910 # override type
911 type = openshift_host_logs
912
913 # specify Splunk index
914 index =
915
916 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
917 samplingPercent = -1
918
919 # sampling key (should be regexp with the named match pattern `key`)
920 samplingKey =
921
922 # how often to reopen the journald to free old files
923 reopenInterval = 1h
924
925 # set output (splunk or devnull, default is [general]defaultOutput)
926 output =
927
928 # configure default thruput per second for this files group
929 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
930 # from the files in this group to 128Kb per second.
931 thruputPerSecond =
932
933 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
934 # older than 7 days
935 tooOldEvents =
936
937 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
938 tooNewEvents =
939
940 # by default every new event should start from not space symbol
941 eventPattern = ^[^\s]
942
943 # By default ignoring verbose hyperkube logs (all INFO messages)
944 blacklist.0 = ^I\d+.*$
945 # whitelist.0 = ^regexp$
946 # blacklist.1 = ^regexp$
947
948 # Move Journald logs reader to a separate process, to prevent process from crashing in case of corrupted log files
949 spawnExternalProcess = false
950
951 # Pipe to join events (container logs only)
952 [pipe.join]
953
954 # disable joining event
955 disabled = false
956
957 # Maximum interval of messages in pipeline
958 maxInterval = 100ms
959
960 # Maximum time to wait for the messages in pipeline
961 maxWait = 1s
962
963 # Maximum message size
964 maxSize = 1MB
965
966 # Default pattern to indicate new message (should start not from space)
967 patternRegex = ^[^\s]
968
969 # (depricated, use annotations for settings up join rules)
970 # Define special event join patterns for matched events
971 # Section consist of [pipe.join::<name>]
972 # [pipe.join::my_app]
973 ## Set match pattern for the fields
974 #; matchRegex.docker_container_image = my_app
975 #; matchRegex.stream = stdout
976 ## All events start from '[<digits>'
977 #; patternRegex = ^\[\d+
978
979 # You can configure global replace rules for the events, which can help to remove sensitive data
980 # from logs before they are sent to Splunk. Those rules will be applied to all pipelines for container logs, host logs,
981 # application logs and events.
982 # In the following example we replace password=TEST with password=********
983 ; [pipe.replace::name]
984 ; patternRegex = (password=)([^\s]+)
985 ; replace = $1********
986
987 # You can configure global hash rules for the events, which can help to hide sensitive data
988 # from logs before they are sent to outputs. Those rules will be applied to all pipelines for container logs, host logs,
989 # application logs and events.
990 # In the following example we hash IP addresses with fnv-1a-64
991 ; [pipe.hash::name]
992 ; match = (\d{1,3}\.){3}\d{1,3}'
993 ; function = fnv-1a-64
994
995
996 [input.prometheus::kubelet]
997
998 # disable prometheus kubelet metrics
999 disabled = false
1000
1001 # override type
1002 type = openshift_prometheus
1003
1004 # specify Splunk index
1005 index =
1006
1007 # Override host (environment variables are supported)
1008 host = ${KUBERNETES_NODENAME}
1009
1010 # Override source
1011 source = kubelet
1012
1013 # how often to collect prometheus metrics
1014 interval = 60s
1015
1016 # request timeout
1017 timeout = 60s
1018
1019 # prometheus endpoint
1020 endpoint = https://127.0.0.1:10250/metrics
1021
1022 # token for "Authorization: Bearer $(cat tokenPath)"
1023 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
1024
1025 # server certificate for certificate validation
1026 certPath = /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
1027
1028 # client certificate for authentication
1029 clientCertPath =
1030
1031 # Allow invalid SSL server certificate
1032 insecure = true
1033
1034 # include metrics help with the events
1035 # can be useful to explore prometheus metrics
1036 includeHelp = false
1037
1038 # set output (splunk or devnull, default is [general]defaultOutput)
1039 output =
1040
1041 # filter only metrics used by dashboards
1042 whitelist.1 = ^(kubernetes|openshift)_build_info$
1043 whitelist.2 = ^kubelet_runtime_operations_duration_seconds_sum$
1044 whitelist.3 = ^kubelet_docker_operations_duration_seconds_sum$
1045 whitelist.4 = ^kubelet_network_plugin_operations_duration_seconds_sum$
1046 whitelist.5 = ^kubelet_cgroup_manager_duration_seconds_sum$
1047 whitelist.6 = ^storage_operation_duration_seconds_sum$
1048 whitelist.7 = ^kubelet_docker_operations_errors_total$
1049 whitelist.8 = ^kubelet_runtime_operations_errors_total$
1050 whitelist.9 = ^rest_client_requests_total$
1051 whitelist.10 = ^process_cpu_seconds_total$
1052 whitelist.11 = ^process_resident_memory_bytes$
1053 whitelist.12 = ^process_virtual_memory_bytes$
1054 whitelist.13 = ^kubelet_volume_stats_.+$
1055
1056 ; # Collectord reports if entropy is low (uncomment to use it)
1057 ; [diagnostics::node-entropy]
1058 ; settings.path = /rootfs/proc/sys/kernel/random/entropy_avail
1059 ; settings.interval = 1h
1060 ; settings.threshold = 800
1061
1062 # Collectord can report if node reboot is required (uncomment to use it)
1063 [diagnostics::node-reboot-required]
1064 settings.path = /rootfs/var/run/reboot-required*
1065 settings.interval = 1h
1066
1067 # See https://www.kernel.org/doc/Documentation/admin-guide/hw-vuln/index.rst
1068 # And https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-devices-system-cpu
1069 [diagnostics::cpu-vulnerabilities]
1070 settings.path = /rootfs/sys/devices/system/cpu/vulnerabilities/*
1071 settings.interval = 1h
1072
1073 003-daemonset-master.conf: |
1074 [input.prometheus::kubernetes-api]
1075
1076 # disable prometheus kubernetes-api input
1077 disabled = false
1078
1079 # override type
1080 type = openshift_prometheus
1081
1082 # specify Splunk index
1083 index =
1084
1085 # override host
1086 host = ${KUBERNETES_NODENAME}
1087
1088 # override source
1089 source = kubernetes-api
1090
1091 # how often to collect prometheus metrics
1092 interval = 60s
1093
1094 # request timeout
1095 timeout = 60s
1096
1097 # prometheus endpoint
1098 # at first trying to get it from localhost (that way avoiding load balancer, if multiple)
1099 # as fallback using proxy
1100 endpoint.1localhost = https://127.0.0.1:8443/metrics
1101 endpoint.2kubeapi = https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}/metrics
1102
1103 # token for "Authorization: Bearer $(cat tokenPath)"
1104 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
1105
1106 # server certificate for certificate validation
1107 certPath = /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
1108
1109 # client certificate for authentication
1110 clientCertPath =
1111
1112 # Allow invalid SSL server certificate
1113 insecure = true
1114
1115 # include metrics help with the events
1116 includeHelp = false
1117
1118 # set output (splunk or devnull, default is [general]defaultOutput)
1119 output =
1120
1121 # filter only metrics used by dashboards
1122 whitelist.1 = ^(kubernetes|openshift)_build_info$
1123 whitelist.2 = ^authenticated_user_requests$
1124 whitelist.3 = ^apiserver_request_total$
1125 whitelist.4 = ^process_cpu_seconds_total$
1126 whitelist.5 = ^process_resident_memory_bytes$
1127 whitelist.6 = ^process_virtual_memory_bytes$
1128
1129
1130 [input.prometheus::controller]
1131
1132 # disable prometheus controller metrics
1133 disabled = false
1134
1135 # override type
1136 type = openshift_prometheus
1137
1138 # specify Splunk index
1139 index =
1140
1141 # override host
1142 host = ${KUBERNETES_NODENAME}
1143
1144 # override source
1145 source = controller
1146
1147 # how often to collect prometheus metrics
1148 interval = 60s
1149
1150 # request timeout
1151 timeout = 60s
1152
1153 # prometheus endpoint
1154 endpoint.https1 = https://:10257/metrics
1155 endpoint.https2 = https://:8444/metrics
1156
1157 # token for "Authorization: Bearer $(cat tokenPath)"
1158 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
1159
1160 # server certificate for certificate validation
1161 certPath =
1162
1163 # client certificate for authentication
1164 clientCertPath =
1165 clientKeyPath =
1166
1167 # Allow invalid SSL server certificate
1168 insecure = true
1169
1170 # include metrics help with the events
1171 includeHelp = false
1172
1173 # set output (splunk or devnull, default is [general]defaultOutput)
1174 output =
1175
1176 # filter only metrics used by dashboards
1177 whitelist.1 = ^(kubernetes|openshift)_build_info$
1178 whitelist.2 = ^process_cpu_seconds_total$
1179 whitelist.3 = ^process_resident_memory_bytes$
1180 whitelist.4 = ^process_virtual_memory_bytes$
1181 whitelist.5 = ^node_collector_zone_size$
1182 whitelist.6 = ^node_collector_zone_health$
1183 whitelist.7 = ^node_collector_unhealthy_nodes_in_zone$
1184
1185 [input.prometheus::scheduler]
1186
1187 # disable prometheus scheduler metrics
1188 disabled = false
1189
1190 # override type
1191 type = openshift_prometheus
1192
1193 # specify Splunk index
1194 index =
1195
1196 # override host
1197 host = ${KUBERNETES_NODENAME}
1198
1199 # override source
1200 source = scheduler
1201
1202 # how often to collect prometheus metrics
1203 interval = 60s
1204
1205 # request timeout
1206 timeout = 60s
1207
1208 # prometheus endpoint
1209 endpoint.https1 = https://:10259/metrics
1210 endpoint.https2 = https://:8444/metrics
1211
1212 # token for "Authorization: Bearer $(cat tokenPath)"
1213 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
1214
1215 # server certificate for certificate validation
1216 certPath =
1217
1218 # client certificate for authentication
1219 clientCertPath =
1220 clientKeyPath =
1221
1222 # Allow invalid SSL server certificate
1223 insecure = true
1224
1225 # include metrics help with the events
1226 includeHelp = false
1227
1228 # set output (splunk or devnull, default is [general]defaultOutput)
1229 output =
1230
1231 # filter only metrics used by dashboards
1232 whitelist.1 = ^(kubernetes|openshift)_build_info$
1233 whitelist.2 = ^scheduler_e2e_scheduling_duration_seconds_sum$
1234 whitelist.3 = ^scheduler_binding_duration_seconds_sum$
1235 whitelist.4 = ^scheduler_scheduling_algorithm_duration_seconds_sum$
1236 whitelist.5 = ^process_cpu_seconds_total$
1237 whitelist.6 = ^process_resident_memory_bytes$
1238 whitelist.7 = ^process_virtual_memory_bytes$
1239
1240
1241 [input.prometheus::etcd]
1242
1243 # disable prometheus etcd metrics
1244 disabled = false
1245
1246 # override type
1247 type = openshift_prometheus
1248
1249 # specify Splunk index
1250 index =
1251
1252 # override host
1253 host = ${KUBERNETES_NODENAME}
1254
1255 # override source
1256 source = etcd
1257
1258 # how often to collect prometheus metricd
1259 interval = 60s
1260
1261 # prometheus endpoint
1262 endpoint.https1 = https://:9979/metrics
1263 endpoint.https2 = https://:9978/metrics
1264
1265 # token for "Authorization: Bearer $(cat tokenPath)"
1266 tokenPath =
1267
1268 # server certificate for certificate validation
1269 certPath = /rootfs/etc/kubernetes/static-pod-resources/etcd-certs/secrets/etcd-all-certs/etcd-serving-*.crt
1270
1271 # client certificate for authentication
1272 clientCertPath = /rootfs/etc/kubernetes/static-pod-resources/etcd-certs/secrets/etcd-all-certs/etcd-peer-*.crt
1273 clientKeyPath = /rootfs/etc/kubernetes/static-pod-resources/etcd-certs/secrets/etcd-all-certs/etcd-peer-*.key
1274
1275 # Allow invalid SSL server certificate
1276 insecure = true
1277
1278 # include metrics help with the events
1279 includeHelp = false
1280
1281 # set output (splunk or devnull, default is [general]defaultOutput)
1282 output =
1283
1284 whitelist.1 = ^etcd_server_leader_changes_seen_total$
1285 whitelist.2 = ^etcd_server_has_leader$
1286 whitelist.3 = ^etcd_server_proposals_committed_total$
1287 whitelist.4 = ^etcd_server_proposals_applied_total$
1288 whitelist.5 = ^etcd_server_proposals_committed_total$
1289 whitelist.6 = ^etcd_server_proposals_pending$
1290 whitelist.7 = ^etcd_server_proposals_failed_total$
1291 whitelist.8 = ^etcd_disk_wal_fsync_duration_seconds_sum$
1292 whitelist.9 = ^etcd_disk_wal_fsync_duration_seconds_count$
1293 whitelist.10 = ^etcd_disk_backend_commit_duration_seconds_sum$
1294 whitelist.11 = ^etcd_disk_backend_commit_duration_seconds_count$
1295 whitelist.12 = ^etcd_network_client_grpc_.*$
1296 whitelist.13 = ^grpc_server_handled_total$
1297 whitelist.14 = ^etcd_network_peer_round_trip_time_seconds_bucket$
1298 whitelist.15 = ^process_cpu_seconds_total$
1299 whitelist.16 = ^process_resident_memory_bytes$
1300 whitelist.17 = ^process_virtual_memory_bytes$
1301 whitelist.18 = ^process_open_fds$
1302 whitelist.19 = ^process_max_fds$
1303 whitelist.20 = ^etcd_disk_backend_commit_duration_seconds_bucket$
1304 whitelist.21 = ^etcd_disk_wal_fsync_duration_seconds_bucket$
1305
1306
1307 # Audit logs
1308 [input.files::audit-logs]
1309
1310 # disable host level logs
1311 disabled = false
1312
1313 # root location of for audit logs
1314 path = /rootfs/var/log/kube-apiserver/
1315
1316 # glob matching files
1317 glob = audit*.log
1318
1319 # files are read using polling schema, when reach the EOF how often to check if files got updated
1320 pollingInterval = 250ms
1321
1322 # how often o look for the new files under logs path
1323 walkingInterval = 5s
1324
1325 # include verbose fields in events (file offset)
1326 verboseFields = false
1327
1328 # override type
1329 type = openshift_host_logs
1330
1331 # specify Splunk index
1332 index =
1333
1334 # field extraction
1335 extraction = (?P<message>.*"stageTimestamp":"(?P<timestamp>[^"]+)".*)
1336 extractionMessageField = message
1337
1338 # timestamp field
1339 timestampField = timestamp
1340
1341 # format for timestamp
1342 # the layout defines the format by showing how the reference time, defined to be `Mon Jan 2 15:04:05 -0700 MST 2006`
1343 timestampFormat = 2006-01-02T15:04:05.999999999Z07:00
1344
1345 # timestamp location (if not defined by format)
1346 timestampLocation =
1347
1348 # set output (splunk or devnull, default is [general]defaultOutput)
1349 output =
1350
1351 # configure default thruput per second for this files group
1352 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
1353 # from the files in this group to 128Kb per second.
1354 thruputPerSecond =
1355
1356 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
1357 # older than 7 days
1358 tooOldEvents =
1359
1360 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
1361 tooNewEvents =
1362
1363 # Blacklisting and whitelisting the logs
1364 # whitelist.0 = ^regexp$
1365 # blacklist.0 = ^regexp$
1366
1367
1368 004-addon.conf: |
1369 [general]
1370 # addons can be run in parallel with agents
1371 addon = true
1372
1373 # The addon runs off the host network, so the kubelet probes /healthz and /readyz
1374 # on the pod IP - bind 0.0.0.0 here (overrides the loopback default in
1375 # 001-general.conf, which would be unreachable). Only health/ready are enabled, so
1376 # this exposes nothing beyond the probes on the cluster-internal pod IP.
1377 httpServerBinding = 0.0.0.0:11888
1378
1379 [input.kubernetes_events]
1380
1381 # disable collecting kubernetes events
1382 disabled = false
1383
1384 # override type
1385 type = openshift_events
1386
1387 # specify Splunk index
1388 index =
1389
1390 # set output (splunk or devnull, default is [general]defaultOutput)
1391 output =
1392
1393 # exclude managed fields from the metadata
1394 excludeManagedFields = true
1395
1396
1397 [input.kubernetes_watch::pods]
1398
1399 # disable events
1400 disabled = false
1401
1402 # Set the timeout for how often watch request should refresh the whole list
1403 refresh = 10m
1404
1405 apiVersion = v1
1406 kind = Pod
1407 namespace =
1408
1409 # override type
1410 type = openshift_objects
1411
1412 # specify Splunk index
1413 index =
1414
1415 # set output (splunk or devnull, default is [general]defaultOutput)
1416 output =
1417
1418 # exclude managed fields from the metadata
1419 excludeManagedFields = true
1420
1421 # you can remove or hash some values in the events (after modifyValues you can define path in the JSON object,
1422 # and the value can be hash:{hashFunction}, or remove to remove the object )
1423 ; modifyValues.object.data.* = hash:sha256
1424 ; modifyValues.object.metadata.annotations.* = remove
1425
1426 # You can exclude events by namespace with blacklist or whitelist only required namespaces
1427 # blacklist.kubernetes_namespace = ^namespace0$
1428 # whitelist.kubernetes_namespace = ^((namespace1)|(namespace2))$
1429
1430 [input.kubernetes_watch::resourcequota]
1431 # disable events
1432 disabled = false
1433
1434 # Set the timeout for how often watch request should refresh the whole list
1435 refresh = 10m
1436
1437 apiVersion = v1
1438 kind = ResourceQuota
1439 namespace =
1440
1441 # override type
1442 type = openshift_objects
1443
1444 # specify Splunk index
1445 index =
1446
1447 # set output (splunk or devnull, default is [general]defaultOutput)
1448 output =
1449
1450 # exclude managed fields from the metadata
1451 excludeManagedFields = true
1452
1453
1454 [input.kubernetes_watch::clusterresourcequota]
1455 # disable events
1456 disabled = false
1457
1458 # Set the timeout for how often watch request should refresh the whole list
1459 refresh = 10m
1460
1461 apiVersion = quota.openshift.io/v1
1462 kind = ClusterResourceQuota
1463 namespace =
1464
1465 # override type
1466 type = openshift_objects
1467
1468 # specify Splunk index
1469 index =
1470
1471 # set output (splunk or devnull, default is [general]defaultOutput)
1472 output =
1473
1474 # exclude managed fields from the metadata
1475 excludeManagedFields = true
1476
1477
1478 [input.kubernetes_watch::nodes]
1479 # disable events
1480 disabled = false
1481
1482 # Set the timeout for how often watch request should refresh the whole list
1483 refresh = 10m
1484
1485 apiVersion = v1
1486 kind = Node
1487 namespace =
1488
1489 # override type
1490 type = openshift_objects
1491
1492 # specify Splunk index
1493 index =
1494
1495 # set output (splunk or devnull, default is [general]defaultOutput)
1496 output =
1497
1498 # exclude managed fields from the metadata
1499 excludeManagedFields = true
1500
1501---
1502apiVersion: apps/v1
1503kind: DaemonSet
1504metadata:
1505 name: collectorforopenshift
1506 namespace: collectorforopenshift
1507 labels:
1508 app: collectorforopenshift
1509spec:
1510 # Default updateStrategy is OnDelete. For collectord RollingUpdate is suitable
1511 # When you update configuration
1512 updateStrategy:
1513 type: RollingUpdate
1514
1515 selector:
1516 matchLabels:
1517 daemon: collectorforopenshift
1518
1519 template:
1520 metadata:
1521 name: collectorforopenshift
1522 labels:
1523 daemon: collectorforopenshift
1524 spec:
1525 priorityClassName: collectorforopenshift-critical
1526 dnsPolicy: ClusterFirstWithHostNet
1527 hostNetwork: true
1528 serviceAccountName: collectorforopenshift
1529 # We run this DaemonSet only for Non-Masters
1530 affinity:
1531 nodeAffinity:
1532 requiredDuringSchedulingIgnoredDuringExecution:
1533 nodeSelectorTerms:
1534 - matchExpressions:
1535 - key: node-role.kubernetes.io/control-plane
1536 operator: DoesNotExist
1537 tolerations:
1538 - operator: "Exists"
1539 effect: "NoSchedule"
1540 - operator: "Exists"
1541 effect: "NoExecute"
1542 containers:
1543 - name: collectorforopenshift
1544 # Stick to specific version
1545 image: registry.connect.redhat.com/outcoldsolutions/collectorforopenshift:26.04.4
1546 livenessProbe:
1547 httpGet:
1548 host: 127.0.0.1
1549 path: /healthz
1550 port: 11888
1551 initialDelaySeconds: 120
1552 periodSeconds: 60
1553 timeoutSeconds: 5
1554 failureThreshold: 3
1555 readinessProbe:
1556 httpGet:
1557 host: 127.0.0.1
1558 path: /readyz
1559 port: 11888
1560 initialDelaySeconds: 10
1561 periodSeconds: 15
1562 timeoutSeconds: 5
1563 failureThreshold: 3
1564 securityContext:
1565 privileged: true
1566 runAsUser: 0
1567 # Define your resources if you need. Defaults should be fine for most.
1568 resources:
1569 limits:
1570 cpu: 2000m
1571 memory: 512Mi
1572 requests:
1573 cpu: 500m
1574 memory: 256Mi
1575 env:
1576 - name: KUBERNETES_NODENAME
1577 valueFrom:
1578 fieldRef:
1579 fieldPath: spec.nodeName
1580 - name: POD_NAME
1581 valueFrom:
1582 fieldRef:
1583 fieldPath: metadata.name
1584 volumeMounts:
1585 # We store state in /data folder (file positions)
1586 - name: collectorforopenshift-state
1587 mountPath: /data
1588 # Configuration file deployed with ConfigMap
1589 - name: collectorforopenshift-config
1590 mountPath: /config/
1591 readOnly: true
1592 # Rootfs
1593 - name: rootfs
1594 mountPath: /rootfs/
1595 readOnly: false
1596 mountPropagation: HostToContainer
1597 # correct timezone
1598 - name: localtime
1599 mountPath: /etc/localtime
1600 readOnly: true
1601 volumes:
1602 # We store state directly on host, change this location, if
1603 # your persistent volume is somewhere else
1604 - name: collectorforopenshift-state
1605 hostPath:
1606 path: /var/lib/collectorforopenshift/data/
1607 type: DirectoryOrCreate
1608 # Location of rootfs
1609 - name: rootfs
1610 hostPath:
1611 path: /
1612 # correct timezone
1613 - name: localtime
1614 hostPath:
1615 path: /etc/localtime
1616 # configuration from ConfigMap
1617 - name: collectorforopenshift-config
1618 configMap:
1619 name: collectorforopenshift
1620 items:
1621 - key: 001-general.conf
1622 path: 001-general.conf
1623 - key: 002-daemonset.conf
1624 path: 002-daemonset.conf
1625---
1626apiVersion: apps/v1
1627kind: DaemonSet
1628metadata:
1629 name: collectorforopenshift-master
1630 namespace: collectorforopenshift
1631 labels:
1632 app: collectorforopenshift
1633spec:
1634 updateStrategy:
1635 type: RollingUpdate
1636 selector:
1637 matchLabels:
1638 daemon: collectorforopenshift
1639 template:
1640 metadata:
1641 name: collectorforopenshift-master
1642 labels:
1643 daemon: collectorforopenshift
1644 spec:
1645 priorityClassName: collectorforopenshift-critical
1646 dnsPolicy: ClusterFirstWithHostNet
1647 hostNetwork: true
1648 serviceAccountName: collectorforopenshift
1649 # Deploy only on master
1650 affinity:
1651 nodeAffinity:
1652 requiredDuringSchedulingIgnoredDuringExecution:
1653 nodeSelectorTerms:
1654 - matchExpressions:
1655 - key: node-role.kubernetes.io/control-plane
1656 operator: Exists
1657 tolerations:
1658 - operator: "Exists"
1659 effect: "NoSchedule"
1660 - operator: "Exists"
1661 effect: "NoExecute"
1662 containers:
1663 - name: collectorforopenshift
1664 image: registry.connect.redhat.com/outcoldsolutions/collectorforopenshift:26.04.4
1665 livenessProbe:
1666 httpGet:
1667 host: 127.0.0.1
1668 path: /healthz
1669 port: 11888
1670 initialDelaySeconds: 120
1671 periodSeconds: 60
1672 timeoutSeconds: 5
1673 failureThreshold: 3
1674 readinessProbe:
1675 httpGet:
1676 host: 127.0.0.1
1677 path: /readyz
1678 port: 11888
1679 initialDelaySeconds: 10
1680 periodSeconds: 15
1681 timeoutSeconds: 5
1682 failureThreshold: 3
1683 securityContext:
1684 privileged: true
1685 runAsUser: 0
1686 resources:
1687 limits:
1688 cpu: 2000m
1689 memory: 1024Mi
1690 requests:
1691 cpu: 500m
1692 memory: 256Mi
1693 env:
1694 - name: KUBERNETES_NODENAME
1695 valueFrom:
1696 fieldRef:
1697 fieldPath: spec.nodeName
1698 - name: POD_NAME
1699 valueFrom:
1700 fieldRef:
1701 fieldPath: metadata.name
1702 volumeMounts:
1703 - name: collectorforopenshift-state
1704 mountPath: /data
1705 - name: collectorforopenshift-config
1706 mountPath: /config/
1707 readOnly: true
1708 # Rootfs
1709 - name: rootfs
1710 mountPath: /rootfs/
1711 readOnly: false
1712 mountPropagation: HostToContainer
1713 - name: localtime
1714 mountPath: /etc/localtime
1715 readOnly: true
1716 volumes:
1717 - name: collectorforopenshift-state
1718 hostPath:
1719 path: /var/lib/collectorforopenshift/data/
1720 type: DirectoryOrCreate
1721 - name: rootfs
1722 hostPath:
1723 path: /
1724 - name: localtime
1725 hostPath:
1726 path: /etc/localtime
1727 - name: collectorforopenshift-config
1728 configMap:
1729 name: collectorforopenshift
1730 items:
1731 - key: 001-general.conf
1732 path: 001-general.conf
1733 - key: 002-daemonset.conf
1734 path: 002-daemonset.conf
1735 - key: 003-daemonset-master.conf
1736 path: 003-daemonset-master.conf
1737---
1738apiVersion: apps/v1
1739kind: Deployment
1740metadata:
1741 name: collectorforopenshift-addon
1742 namespace: collectorforopenshift
1743 labels:
1744 app: collectorforopenshift
1745spec:
1746 replicas: 1
1747 selector:
1748 matchLabels:
1749 daemon: collectorforopenshift
1750 template:
1751 metadata:
1752 name: collectorforopenshift-addon
1753 labels:
1754 daemon: collectorforopenshift
1755 spec:
1756 priorityClassName: collectorforopenshift-critical
1757 serviceAccountName: collectorforopenshift
1758 containers:
1759 - name: collectorforopenshift
1760 image: registry.connect.redhat.com/outcoldsolutions/collectorforopenshift:26.04.4
1761 livenessProbe:
1762 httpGet:
1763 path: /healthz
1764 port: 11888
1765 initialDelaySeconds: 120
1766 periodSeconds: 60
1767 timeoutSeconds: 5
1768 failureThreshold: 3
1769 readinessProbe:
1770 httpGet:
1771 path: /readyz
1772 port: 11888
1773 initialDelaySeconds: 10
1774 periodSeconds: 15
1775 timeoutSeconds: 5
1776 failureThreshold: 3
1777 securityContext:
1778 privileged: true
1779 runAsUser: 0
1780 resources:
1781 limits:
1782 cpu: 1000m
1783 memory: 512Mi
1784 requests:
1785 cpu: 200m
1786 memory: 64Mi
1787 env:
1788 - name: KUBERNETES_NODENAME
1789 valueFrom:
1790 fieldRef:
1791 fieldPath: spec.nodeName
1792 - name: POD_NAME
1793 valueFrom:
1794 fieldRef:
1795 fieldPath: metadata.name
1796 volumeMounts:
1797 - name: collectorforopenshift-state
1798 mountPath: /data
1799 - name: collectorforopenshift-config
1800 mountPath: /config/
1801 readOnly: true
1802 volumes:
1803 - name: collectorforopenshift-state
1804 hostPath:
1805 path: /var/lib/collectorforopenshift/data/
1806 type: Directory
1807 - name: collectorforopenshift-config
1808 configMap:
1809 name: collectorforopenshift
1810 items:
1811 - key: 001-general.conf
1812 path: 001-general.conf
1813 - key: 004-addon.conf
1814 path: 004-addon.conf
