Syslog (QRadar)

Collectord configuration for OpenShift (RHEL)

Download

collectorforopenshift-rhel-syslog.yaml

CURL

bash
1curl -O https://www.outcoldsolutions.com/docs/syslog-kubernetes/collectorforopenshift-rhel-syslog.yaml

WGET

bash
1wget https://www.outcoldsolutions.com/docs/syslog-kubernetes/collectorforopenshift-rhel-syslog.yaml

collectorforopenshift-rhel-syslog.yaml

  1apiVersion: v1
  2kind: Project
  3metadata:
  4  labels:
  5    app: collectorforopenshift-syslog
  6  name: collectorforopenshift-syslog
  7  annotations:
  8    openshift.io/node-selector: ''
  9    openshift.io/description: 'Forwarding logs to Syslog, built by Outcold Solutions'
 10    openshift.io/display-name: 'Collectord for OpenShift (Syslog)'
 11---
 12apiVersion: apiextensions.k8s.io/v1beta1
 13kind: CustomResourceDefinition
 14metadata:
 15  name: configurations.collectord.io
 16spec:
 17  group: collectord.io
 18  versions:
 19    - name: v1
 20      served: true
 21      storage: true
 22  scope: Cluster
 23  names:
 24    plural: configurations
 25    singular: configuration
 26    kind: Configuration
 27---
 28apiVersion: scheduling.k8s.io/v1beta1
 29kind: PriorityClass
 30metadata:
 31  name: collectorforopenshift-syslog-critical
 32value: 1000000000
 33---
 34apiVersion: v1
 35kind: ServiceAccount
 36metadata:
 37  labels:
 38    app: collectorforopenshift-syslog
 39  name: collectorforopenshift-syslog
 40  namespace: collectorforopenshift-syslog
 41---
 42apiVersion: v1
 43kind: ClusterRole
 44metadata:
 45  labels:
 46    app: collectorforopenshift-syslog
 47  name: collectorforopenshift-syslog
 48rules:
 49- apiGroups:
 50  - '*'
 51  resources:
 52  - '*'
 53  verbs:
 54  - get
 55  - list
 56  - watch
 57---
 58apiVersion: v1
 59kind: ClusterRoleBinding
 60metadata:
 61  labels:
 62    app: collectorforopenshift-syslog
 63  name: collectorforopenshift-syslog
 64  namespace: collectorforopenshift-syslog
 65roleRef:
 66  kind: ClusterRole
 67  name: collectorforopenshift-syslog
 68subjects:
 69  - kind: ServiceAccount
 70    name: collectorforopenshift-syslog
 71    namespace: collectorforopenshift-syslog
 72---
 73apiVersion: v1
 74kind: ConfigMap
 75metadata:
 76  name: collectorforopenshift-syslog
 77  namespace: collectorforopenshift-syslog
 78  labels:
 79    app: collectorforopenshift-syslog
 80data:
 81  001-general.conf: |
 82    # The general configuration is used for all deployments
 83    #
 84    # Run collectord with the flag `-conf` and specify location of the configuration files.
 85    #
 86    # You can override all the values using environment variables with the format like
 87    #   COLLECTOR__<ANYNAME>=<section>__<key>=<value>
 88    # As an example you can set `dataPath` in the `[general]` section as
 89    #   COLLECTOR__DATAPATH=general__dataPath=C:\\some\\path\\data.db
 90    # This parameter can be configured using -env-override, set it to empty string to disable this feature
 91
 92    [general]
 93
 94    # Review License https://www.outcoldsolutions.com/legal/license-agreement/
 95    # and accept License by changing the value to *true*
 96    acceptLicense = false
 97
 98    # Location for the database
 99    # Collectord stores positions of the files and internal state
100    dataPath = ./data/
101
102    # log level (accepted values are trace, debug, info, warn, error, fatal)
103    logLevel = info
104
105    # http server gives access to two endpoints
106    # /healthz
107    # /metrics
108    httpServerBinding =
109
110    # telemetry report endpoint, set it to empty string to disable telemetry
111    telemetryEndpoint = https://license.outcold.solutions/telemetry/
112
113    # license check endpoint
114    licenseEndpoint = https://license.outcold.solutions/license/
115
116    # license server through proxy
117    licenseServerProxyUrl =
118
119    # authentication with basic authorization (user:password)
120    licenseServerProxyBasicAuth =
121
122    # license key
123    license =
124
125    # Environment variable $KUBERNETES_NODENAME is used by default to setup hostname
126    # Use value below to override specific name
127    hostname =
128
129    # Default output for events, logs and metrics
130    # valid values: syslog and devnull
131    # Use devnull by default if you don't want to redirect data
132    defaultOutput = syslog
133
134    # Buffer size for file reads. 8k matches the common filesystem block size and
135    # cuts the number of read syscalls substantially versus the historical 256b.
136    fileInputBufferSize = 8k
137
138    # Maximum size of one line the file reader can read
139    fileInputLineMaxSize = 1mb
140
141    # Include custom fields to attach to every event, in example below every event sent to Syslog will have
142    # indexed field my_environment=dev. Fields names should match to ^[a-z][_a-z0-9]*$
143    # Better way to configure that is to specify labels for OpenShift Nodes.
144    # ; fields.my_environment = dev
145    # Identify the cluster if you are planning to monitor multiple clusters
146    fields.cluster = -
147
148    # Include EC2 Metadata (see list of possible fields https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html)
149    # Should be in format ec2Metadata.{desired_field_name} = {url path to read the value}
150    # ec2Metadata.ec2_instance_id = /latest/meta-data/instance-id
151    # ec2Metadata.ec2_instance_type = /latest/meta-data/instance-type
152
153    # subdomain for the annotations added to the pods, workloads, namespaces or containers, like syslog.collectord.io/..
154    annotationsSubdomain = syslog
155
156    # Configure acknowledgement database.
157    # - force fsync on every write to Write-Ahead-Log
158    db.fsync = false
159    # - maximum size of the Write-Ahead-Log
160    db.compactAt = 1M
161
162    # configure global thruput per second for forwarded logs (metrics are not included)
163    # for example if you set `thruputPerSecond = 512Kb`, that will limit amount of logs forwarded
164    # from the single Collectord instance to 512Kb per second.
165    # You can configure thruput individually for the logs (including specific for container logs) below
166    thruputPerSecond =
167
168    # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
169    # older than 7 days
170    tooOldEvents =
171
172    # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
173    tooNewEvents =
174    
175    # Multi-output async publishing. When enabled (default), events routed to
176    # non-default outputs are published asynchronously so that a slow or down
177    # output does not block events destined for other outputs.
178    ; multioutput.async = true
179    # Buffer size for the async proxy (default 100). Absorbs transient bursts.
180    # When this buffer and the output's own queue are both full, events are
181    # dropped immediately without blocking the pipeline.
182    ; multioutput.asyncBufferSize = 100
183
184    # connection to kubernetes api
185    [general.kubernetes]
186
187    # Environment variable $KUBERNETES_NODENAME is used by default to setup nodeName
188    # Use it only when you need to override it
189    nodeName =
190
191    # Configuration to access the API server,
192    # see https://kubernetes.io/docs/tasks/access-application-cluster/access-cluster/#accessing-the-api-from-a-pod
193    # for details
194    tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
195    certPath = /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
196
197    # Default timeout for http responses. The streaming/watch requests depend on this timeout.
198    timeout = 30m
199
200    # (obsolete) In case if pod metadata was not retrievied. how often collectord should retry to reload the pod metadata
201    # metadataFetchRetry = 5s
202
203    # (obsolete) In case if event is recent, how long pipeline should wait for the metadata to be available in Kubernetes API
204    # metadataFetchWait = 30s
205
206    # How long to keep the cache for the recent calls to API server (to limit number of calls when collectord discovers new pods)
207    metadataTTL = 30s
208
209    # regex to find pods
210    podsCgroupFilter = ^/([^/\s]+/)*kubepods(\.slice)?/((kubepods-)?(burstable|besteffort)(\.slice)?/)?([^/]*)pod([0-9a-f]{32}|[0-9a-f\-_]{36})(\.slice)?$
211
212    # regex to find containers in the pods
213    containersCgroupFilter = ^/([^/\s]+/)*kubepods(\.slice)?/((kubepods-)?(burstable|besteffort)(\.slice)?/)?([^/]*)pod([0-9a-f]{32}|[0-9a-f\-_]{36})(\.slice)?/(docker-|crio-)?[0-9a-f]{64}(\.scope)?(\/.+)?$
214
215    # path to the kubelet root location (use it to discover application logs for emptyDir)
216    # the expected format is `pods/{pod-id}/volumes/kubernetes.io~empty-dir/{volume-name}/_data/`
217    volumesRootDir = /rootfs/var/lib/kubelet/
218    # You can attach annotations as a metadata, using the format
219    #   includeAnnotations.{key} = {regexp}
220    # For example if you want to include all annotations that starts with `prometheus.io` or `example.com` you can include
221    # the following format:
222    #   includeAnnotations.1 = ^prometheus\.io.*
223    #   includeAnnotations.2 = ^example\.com.*
224
225    # watch for changes (annotations) in the objects
226    watch.namespaces = v1/namespace
227    watch.deploymentconfigs = apis/v1/apps.openshift.io/deploymentconfig
228    watch.configurations = apis/v1/collectord.io/configuration
229
230    # Syslog output
231    [output.syslog]
232
233    # tcp or udp
234    network = tcp
235    # syslog destination
236    address =
237
238  002-daemonset.conf: |
239    # DaemonSet configuration is used for Nodes and Masters.
240
241    # Connection to the docker host
242    [general.docker]
243
244    # url for docker API, only unix socket is supported
245    url = unix:///rootfs/var/run/docker.sock
246
247    # path to docker root folder (can fallback to use folder structure to read docker metadata)
248    dockerRootFolder = /rootfs/var/lib/docker/
249
250    # (obsolete) In case if pod metadata was not retrievied. how often collectord should retry to reload the pod metadata
251    # metadataFetchRetry = 5s
252
253    # (obsolete) In case if event is recent, how long pipeline should wait for the metadata to be available in Kubernetes API
254    # metadataFetchWait = 30s
255
256    # (obsolete) In case if collectord does not see new events for specific container and with the last metadata refresh
257    # We have not found this container - fow how long we should keep this metadata in cache.
258    # metadataTTL = 5s
259
260    # Timeout for http responses to docker client. The streaming requests depend on this timeout.
261    timeout = 1m
262
263    # in case of Kubernetes/OpenShift if you schedule some containers with Docker, but not with the Kubernetes
264    # that allows us to find them (by default finding all containers with name not starting with k8s_)
265    containersNameFilter = ^(([^k])|(k[^8])|(k8[^s])|(k8s[^_])).*$
266
267    # regex to find docker container cgroups (helps excluding other cgroups with matched ID)
268    containersCgroupFilter = ^(/([^/\s]+/)*(docker-|docker/)[0-9a-f]{64}(\.scope)?)$
269
270
271    // connection to CRIO
272    [general.cri-o]
273
274    # url for CRIO API, only unix socket is supported
275    url = unix:///rootfs/var/run/crio/crio.sock
276
277    # Timeout for http responses to docker client. The streaming requests depend on this timeout.
278    timeout = 1m
279
280
281    # Container Log files
282    [input.files]
283
284    # disable container logs monitoring
285    disabled = false
286
287    # root location of docker log files
288    # logs are expected in standard docker format like {containerID}/{containerID}-json.log
289    # rotated files
290    path = /rootfs/var/lib/docker/containers/
291    # root location of CRI-O files
292    # logs are expected in Kubernetes format, like {podID}/{containerName}/0.log
293    crioPath = /rootfs/var/log/pods/
294
295    # (obsolete) glob matching pattern for log files
296    # glob = */*-json.log*
297
298    # files are read using polling schema, when reach the EOF how often to check if files got updated
299    pollingInterval = 250ms
300
301    # how often to look for the new files under logs path
302    walkingInterval = 5s
303
304    # include verbose fields in events (file offset)
305    verboseFields = false
306
307    # docker splits events when they are larger than 10-100k (depends on the docker version)
308    # we join them together by default and forward to syslog as one event
309    joinPartialEvents = true
310
311    # In case if your containers report messages with terminal colors or other escape sequences
312    # you can enable strip for all the containers in one place.
313    # Better is to enable it only for required container with the label collectord.io/strip-terminal-escape-sequences=true
314    stripTerminalEscapeSequences = false
315    # Regexp used for stripping terminal colors, it does not stip all the escape sequences
316    # Read https://man7.org/linux/man-pages/man4/console_codes.4.html for more information
317    stripTerminalEscapeSequencesRegex = (\x1b\[\d{1,3}(;\d{1,3})*m)|(\x07)|(\x1b]\d+(\s\d)?;[^\x07]+\x07)|(.*\x1b\[K)
318
319    # set output (syslog or devnull, default is [general]defaultOutput)
320    output =
321
322    # configure default thruput per second for for each container log
323    # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
324    # from the single container to 128Kb per second.
325    thruputPerSecond =
326
327    # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
328    # older than 7 days
329    tooOldEvents =
330
331    # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
332    tooNewEvents =
333
334    # Syslog format
335    type = k8s_logs
336    syslog.format = {type}|{timestamp::format(2006-01-02T15:04:05.999999999Z07:00)}|{cluster}|{host}|{namespace}|{pod_id}|{pod_name}|{container_name}|{stream}|{message}
337
338
339    # Application Logs
340    [input.app_logs]
341
342    # disable container application logs monitoring
343    disabled = false
344
345    # root location of mounts (applies to hostPath mounts only), if the hostPath differs inside container from the path on host
346    root = /rootfs/
347
348    # how often to review list of available volumes
349    syncInterval = 5s
350
351    # glob matching pattern for log files
352    glob = *.log*
353
354    # files are read using polling schema, when reach the EOF how often to check if files got updated
355    pollingInterval = 250ms
356
357    # how often to look for the new files under logs path
358    walkingInterval = 5s
359
360    # include verbose fields in events (file offset)
361    verboseFields = false
362
363    # we split files using new line character, with this configuration you can specify what defines the new event
364    # after new line
365    eventPatternRegex = ^[^\s]
366    # Maximum interval of messages in pipeline
367    eventPatternMaxInterval = 100ms
368    # Maximum time to wait for the messages in pipeline
369    eventPatternMaxWait = 1s
370    # Maximum message size
371    eventPatternMaxSize = 1MB
372
373    # set output (syslog or devnull, default is [general]defaultOutput)
374    output =
375
376    # configure default thruput per second for for each container log
377    # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
378    # from the single container to 128Kb per second.
379    thruputPerSecond =
380
381    # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
382    # older than 7 days
383    tooOldEvents =
384
385    # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
386    tooNewEvents =
387
388    # Syslog format
389    type = k8s_logs
390    syslog.format = {type}|{timestamp::format(2006-01-02T15:04:05.999999999Z07:00)}|{cluster}|{host}|{namespace}|{pod_id}|{pod_name}|{container_name}|{file_name}|{message}
391
392
393    [input.journald]
394
395    # disable host level logs
396    disabled = false
397
398    # root location of log files
399    path.persistent = /rootfs/var/log/journal/
400    path.volatile = /rootfs/run/log/journal/
401
402    # when reach end of journald, how often to pull
403    pollingInterval = 250ms
404
405    # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
406    samplingPercent = -1
407
408    # sampling key (should be regexp with the named match pattern `key`)
409    samplingKey =
410
411    # how often to reopen the journald to free old files
412    reopenInterval = 1h
413
414    # set output (syslog or devnull, default is [general]defaultOutput)
415    output =
416
417    # configure default thruput per second for this files group
418    # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
419    # from the files in this group to 128Kb per second.
420    thruputPerSecond =
421
422    # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
423    # older than 7 days
424    tooOldEvents =
425
426    # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
427    tooNewEvents =
428
429    # syslog format
430    type = k8s_host_logs
431    syslog.format = {type}|{timestamp::format(2006-01-02T15:04:05.999999999Z07:00)}|{cluster}|{host}|journald|{message}
432
433
434    # Pipe to join events (container logs only)
435    [pipe.join]
436
437    # disable joining event
438    disabled = false
439
440    # Maximum interval of messages in pipeline
441    maxInterval = 100ms
442
443    # Maximum time to wait for the messages in pipeline
444    maxWait = 1s
445
446    # Maximum message size
447    maxSize = 1MB
448
449    # Default pattern to indicate new message (should start not from space)
450    patternRegex = ^[^\s]
451
452  003-daemonset-master.conf: |
453
454    # Audit logs
455    [input.files::audit-logs]
456
457    # disable host level logs
458    disabled = false
459
460    # root location of for audit logs
461    path = /rootfs/var/log/kube-apiserver/
462
463    # glob matching files
464    glob = audit*.log
465
466    # files are read using polling schema, when reach the EOF how often to check if files got updated
467    pollingInterval = 250ms
468
469    # how often o look for the new files under logs path
470    walkingInterval = 5s
471
472    # include verbose fields in events (file offset)
473    verboseFields = false
474
475    # field extraction
476    extraction =
477    # extractionMessageField =
478
479    # timestamp field
480    timestampField =
481
482    # format for timestamp
483    # the layout defines the format by showing how the reference time, defined to be `Mon Jan 2 15:04:05 -0700 MST 2006`
484    timestampFormat =
485
486    # timestamp location (if not defined by format)
487    timestampLocation =
488
489    # set output (syslog or devnull, default is [general]defaultOutput)
490    output =
491
492    # configure default thruput per second for this files group
493    # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
494    # from the files in this group to 128Kb per second.
495    thruputPerSecond =
496
497    # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
498    # older than 7 days
499    tooOldEvents =
500
501    # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
502    tooNewEvents =
503
504    type = k8s_audit_logs
505    syslog.format = {type}|{timestamp::format(2006-01-02T15:04:05.999999999Z07:00)}|{cluster}|{message}
506
507
508  004-addon.conf: |
509    [general]
510    # addons can be run in parallel with agents
511    addon = true
512
513
514    [input.kubernetes_events]
515
516    # disable collecting kubernetes events
517    disabled = false
518
519    # (obsolete, depends on kubernetes timeout)
520    # Set the timeout for how long request to watch events going to hang reading.
521    # eventsWatchTimeout = 30m
522
523    # (obsolete, depends on kubernetes timeout)
524    # Ignore events last seen later that this duration.
525    # eventsTTL = 12h
526
527    # set output (syslog or devnull, default is [general]defaultOutput)
528    output =
529
530    # syslog format
531    type = k8s_events
532    syslog.format = {type}|{timestamp::format(2006-01-02T15:04:05.999999999Z07:00)}|{cluster}|{message}
533
534---
535apiVersion: extensions/v1beta1
536kind: DaemonSet
537metadata:
538  name: collectorforopenshift-syslog
539  namespace: collectorforopenshift-syslog
540  labels:
541    app: collectorforopenshift-syslog
542spec:
543  # Default updateStrategy is OnDelete. For collectord RollingUpdate is suitable
544  # When you update configuration
545  updateStrategy:
546    type: RollingUpdate
547
548  selector:
549    matchLabels:
550      daemon: collectorforopenshift-syslog
551
552  template:
553    metadata:
554      name: collectorforopenshift-syslog
555      labels:
556        daemon: collectorforopenshift-syslog
557    spec:
558      priorityClassName: collectorforopenshift-syslog-critical
559      dnsPolicy: ClusterFirstWithHostNet
560      hostNetwork: true
561      serviceAccountName: collectorforopenshift-syslog
562      # We run this DaemonSet only for Non-Masters
563      affinity:
564        nodeAffinity:
565          requiredDuringSchedulingIgnoredDuringExecution:
566            nodeSelectorTerms:
567            - matchExpressions:
568              - key: node-role.kubernetes.io/master
569                operator: DoesNotExist
570      tolerations:
571      - operator: "Exists"
572        effect: "NoSchedule"
573      - operator: "Exists"
574        effect: "NoExecute"
575      containers:
576      - name: collectorforopenshift-syslog
577        # Stick to specific version
578        image: registry.connect.redhat.com/outcoldsolutions/collectorforopenshift:26.04.4
579        securityContext:
580          privileged: true
581          runAsUser: 0
582        # Define your resources if you need. Defaults should be fine for most.
583        resources:
584          limits:
585            cpu: 2
586            memory: 512Mi
587          requests:
588            cpu: 200m
589            memory: 192Mi
590        env:
591        - name: KUBERNETES_NODENAME
592          valueFrom:
593            fieldRef:
594              fieldPath: spec.nodeName
595        - name: POD_NAME
596          valueFrom:
597            fieldRef:
598              fieldPath: metadata.name
599        volumeMounts:
600        # We store state in /data folder (file positions)
601        - name: collectorforopenshift-syslog-state
602          mountPath: /data
603        # Configuration file deployed with ConfigMap
604        - name: collectorforopenshift-syslog-config
605          mountPath: /config/
606          readOnly: true
607        # Cgroup filesystem to get metrics
608        - name: cgroup
609          mountPath: /rootfs/sys/fs/cgroup
610          readOnly: true
611        # Proc filesystem to get metrics
612        - name: proc
613          mountPath: /rootfs/proc
614          readOnly: true
615        # Location of docker root (for container logs and metadata)
616        - name: docker-root
617          mountPath: /rootfs/var/lib/docker/
618          readOnly: true
619          mountPropagation: HostToContainer
620        # Docker socket
621        - name: docker-unix-socket
622          mountPath: /rootfs/var/run/docker.sock
623          readOnly: true
624        # CRI-O socket (if using CRI-O runtime)
625        - name: crio-unix-socket
626          mountPath: /rootfs/var/run/crio/
627          readOnly: true
628        # Host logs location (including CRI-O logs)
629        - name: logs
630          mountPath: /rootfs/var/log/
631          readOnly: true
632        - name: run-logs
633          mountPath: /rootfs/run/log/
634          readOnly: true
635        # Application logs
636        - name: volumes-root
637          mountPath: /rootfs/var/lib/kubelet/
638          readOnly: true
639          mountPropagation: HostToContainer
640        # correct timezone
641        - name: localtime
642          mountPath: /etc/localtime
643          readOnly: true
644      volumes:
645      # We store state directly on host, change this location, if
646      # your persistent volume is somewhere else
647      - name: collectorforopenshift-syslog-state
648        hostPath:
649          path: /var/lib/collectorforopenshift-syslog/data/
650      # Location of docker root (for container logs and metadata)
651      - name: docker-root
652        hostPath:
653          path: /var/lib/docker/
654      # Location of cgroups file system
655      - name: cgroup
656        hostPath:
657          path: /sys/fs/cgroup
658      # Location of proc file system
659      - name: proc
660        hostPath:
661          path: /proc
662      # Host logs location (including CRI-O logs)
663      - name: logs
664        hostPath:
665          path: /var/log
666      - name: run-logs
667        hostPath:
668          path: /run/log
669      # Docker socket
670      - name: docker-unix-socket
671        hostPath:
672          path: /var/run/docker.sock
673      # CRI-O socket (if using CRI-O runtime)
674      - name: crio-unix-socket
675        hostPath:
676          path: /var/run/crio/
677      # Location for origin mounts, to autodiscover application logs
678      - name: volumes-root
679        hostPath:
680          path: /var/lib/kubelet/
681      # correct timezone
682      - name: localtime
683        hostPath:
684          path: /etc/localtime
685      # configuration from ConfigMap
686      - name: collectorforopenshift-syslog-config
687        configMap:
688          name: collectorforopenshift-syslog
689          items:
690          - key: 001-general.conf
691            path: 001-general.conf
692          - key: 002-daemonset.conf
693            path: 002-daemonset.conf
694---
695apiVersion: extensions/v1beta1
696kind: DaemonSet
697metadata:
698  name: collectorforopenshift-syslog-master
699  namespace: collectorforopenshift-syslog
700  labels:
701    app: collectorforopenshift-syslog
702spec:
703  updateStrategy:
704    type: RollingUpdate
705
706  selector:
707    matchLabels:
708      daemon: collectorforopenshift-syslog
709
710  template:
711    metadata:
712      name: collectorforopenshift-syslog-master
713      labels:
714        daemon: collectorforopenshift-syslog
715    spec:
716      priorityClassName: collectorforopenshift-syslog-critical
717      dnsPolicy: ClusterFirstWithHostNet
718      hostNetwork: true
719      serviceAccountName: collectorforopenshift-syslog
720      # Deploy only on master
721      affinity:
722        nodeAffinity:
723          requiredDuringSchedulingIgnoredDuringExecution:
724            nodeSelectorTerms:
725            - matchExpressions:
726              - key: node-role.kubernetes.io/master
727                operator: Exists
728      tolerations:
729      - operator: "Exists"
730        effect: "NoSchedule"
731      - operator: "Exists"
732        effect: "NoExecute"
733      containers:
734      - name: collectorforopenshift-syslog
735        image: registry.connect.redhat.com/outcoldsolutions/collectorforopenshift:26.04.4
736        securityContext:
737          privileged: true
738          runAsUser: 0
739        resources:
740          limits:
741            cpu: 1
742            memory: 512Mi
743          requests:
744            cpu: 200m
745            memory: 192Mi
746        env:
747        - name: KUBERNETES_NODENAME
748          valueFrom:
749            fieldRef:
750              fieldPath: spec.nodeName
751        - name: POD_NAME
752          valueFrom:
753            fieldRef:
754              fieldPath: metadata.name
755        volumeMounts:
756        - name: collectorforopenshift-syslog-state
757          mountPath: /data
758        - name: collectorforopenshift-syslog-config
759          mountPath: /config/
760          readOnly: true
761        - name: cgroup
762          mountPath: /rootfs/sys/fs/cgroup
763          readOnly: true
764        - name: proc
765          mountPath: /rootfs/proc
766          readOnly: true
767        - name: docker-logs
768          mountPath: /rootfs/var/lib/docker/
769          readOnly: true
770          mountPropagation: HostToContainer
771        - name: docker-unix-socket
772          mountPath: /rootfs/var/run/docker.sock
773          readOnly: true
774        - name: crio-unix-socket
775          mountPath: /rootfs/var/run/crio/
776          readOnly: true
777        - name: logs
778          mountPath: /rootfs/var/log/
779          readOnly: true
780        - name: run-logs
781          mountPath: /rootfs/run/log/
782          readOnly: true
783        - name: etcd-certs
784          mountPath: /rootfs/etc/kubernetes/static-pod-resources/etcd-member/
785          readOnly: true
786        - name: volumes-root
787          mountPath: /rootfs/var/lib/kubelet/
788          readOnly: true
789          mountPropagation: HostToContainer
790        - name: localtime
791          mountPath: /etc/localtime
792          readOnly: true
793      volumes:
794      - name: collectorforopenshift-syslog-state
795        hostPath:
796          path: /var/lib/collectorforopenshift-syslog/data/
797      - name: docker-logs
798        hostPath:
799          path: /var/lib/docker/
800      - name: cgroup
801        hostPath:
802          path: /sys/fs/cgroup
803      - name: proc
804        hostPath:
805          path: /proc
806      - name: logs
807        hostPath:
808          path: /var/log
809      - name: run-logs
810        hostPath:
811          path: /run/log
812      - name: docker-unix-socket
813        hostPath:
814          path: /var/run/docker.sock
815      - name: crio-unix-socket
816        hostPath:
817          path: /var/run/crio/
818      - name: etcd-certs
819        hostPath:
820          path: /etc/kubernetes/static-pod-resources/etcd-member/
821      - name: volumes-root
822        hostPath:
823          path: /var/lib/kubelet/
824      - name: localtime
825        hostPath:
826          path: /etc/localtime
827      - name: collectorforopenshift-syslog-config
828        configMap:
829          name: collectorforopenshift-syslog
830          items:
831          - key: 001-general.conf
832            path: 001-general.conf
833          - key: 002-daemonset.conf
834            path: 002-daemonset.conf
835          - key: 003-daemonset-master.conf
836            path: 003-daemonset-master.conf
837---
838apiVersion: apps/v1beta1
839kind: Deployment
840metadata:
841  name: collectorforopenshift-syslog-addon
842  namespace: collectorforopenshift-syslog
843  labels:
844    app: collectorforopenshift-syslog
845spec:
846  replicas: 1
847  selector:
848    matchLabels:
849      daemon: collectorforopenshift-syslog
850  template:
851    metadata:
852      name: collectorforopenshift-syslog-addon
853      labels:
854        daemon: collectorforopenshift-syslog
855    spec:
856      priorityClassName: collectorforopenshift-syslog-critical
857      serviceAccountName: collectorforopenshift-syslog
858      containers:
859      - name: collectorforopenshift-syslog
860        image: registry.connect.redhat.com/outcoldsolutions/collectorforopenshift:26.04.4
861        securityContext:
862          privileged: true
863          runAsUser: 0
864        resources:
865          limits:
866            cpu: 500m
867            memory: 256Mi
868          requests:
869            cpu: 50m
870            memory: 64Mi
871        env:
872        - name: KUBERNETES_NODENAME
873          valueFrom:
874            fieldRef:
875              fieldPath: spec.nodeName
876        - name: POD_NAME
877          valueFrom:
878            fieldRef:
879              fieldPath: metadata.name
880        volumeMounts:
881        - name: collectorforopenshift-syslog-state
882          mountPath: /data
883        - name: collectorforopenshift-syslog-config
884          mountPath: /config/
885          readOnly: true
886      volumes:
887      - name: collectorforopenshift-syslog-state
888        hostPath:
889          path: /var/lib/collectorforopenshift-syslog/data/
890      - name: collectorforopenshift-syslog-config
891        configMap:
892          name: collectorforopenshift-syslog
893          items:
894          - key: 001-general.conf
895            path: 001-general.conf
896          - key: 004-addon.conf
897            path: 004-addon.conf