Configuration

Using the standard images

These images are built on top of Scratch images.

collectorforopenshift-syslog.yaml

Using certified images on registry.connect.redhat.com

These images are built on top of RHEL images - see outcoldsolutions/collectorforopenshift. Pulling from this registry requires authentication; the steps below walk through it.

collectorforopenshift-rhel-syslog.yaml

registry.connect.redhat.com authentication

registry.connect.redhat.com is not the same as registry.access.redhat.com. The latter hosts Red Hat’s own images and works with OpenShift out of the box; the former hosts certified partner images and requires authentication.

The certified image is built for amd64 only. On arm64 nodes, use the standard image.

On OpenShift 4, the cluster’s global pull secret - the one you installed the cluster with - usually holds credentials for registry.connect.redhat.com, and the pods pull the certified image without further steps. If they fail with ImagePullBackOff, create a pull secret in the Collectord project and link it to its service account:

1oc create secret docker-registry rhcc -n collectorforopenshift-syslog \
2    --docker-server=registry.connect.redhat.com \
3    --docker-username=<user_name> --docker-password=<password>
4oc secrets link collectorforopenshift-syslog rhcc --for=pull -n collectorforopenshift-syslog

Use your Red Hat username here, not your email. Both will let you log in, but only username-based logins can actually pull images. The first command has your password on the command line, so keep it out of your shell history - export HISTFILE=/dev/null for the session is the simplest way.

Pods created before you linked the secret don’t pick it up - delete them and the workloads recreate them with the right credentials:

1oc delete --namespace collectorforopenshift-syslog pods --all

Created OpenShift Objects

collectorforopenshift-syslog.yaml provisions everything Collectord needs to run on the cluster:

• Project collectorforopenshift-syslog - where the ServiceAccount, ConfigMap, workloads and ResourceQuota below live.
• CustomResourceDefinition configurations.collectord.io - the cluster-level Configuration resource that applies annotations by selector (see Annotations).
• CustomResourceDefinition splunkoutputs.collectord.io - the SplunkOutput resource of Collectord for Splunk; the syslog configuration doesn’t use it.
• ClusterRole collectorforopenshift-syslog - grants get, list, and watch on the API objects Collectord uses to enrich logs and metrics with OpenShift metadata.
• ServiceAccount collectorforopenshift-syslog - the identity Collectord uses to call the OpenShift API.
• ClusterRoleBinding collectorforopenshift-syslog - binds the ServiceAccount to the ClusterRole.
• SecurityContextConstraints collectorforopenshift-syslog - admits the DaemonSet’s privileged, host-network pods for the ServiceAccount.
• ResourceQuota collectorforopenshift-syslog-critical-pods admits the two workloads’ priority classes (system-node-critical, system-cluster-critical) in the project. It limits nothing.
• ConfigMap collectorforopenshift-syslog - delivers the configuration files Collectord reads at startup.
• DaemonSet collectorforopenshift-syslog - runs Collectord on the Linux nodes, masters included.
• Deployment collectorforopenshift-syslog-addon - a single Collectord that forwards cluster-scoped data (OpenShift events, watched objects) once for the whole cluster.

The collectorforopenshift-syslog.yaml file itself is heavily commented - read through it for the full breakdown of every input and configuration option.