This page covers what Collectord runs as, what it touches on the host and the cluster, and what you can lock down. If you’re walking through a security review, this is the short version of the answers.
Collectord
Image
We build our image from scratch - a 0-size base. The Collectord image ships only what’s required to run: the collectord binary, the system libraries it links against, a set of root certificates, and a timezone database, all taken from Debian 13. It also carries the glibc compatibility libraries (libpthread, librt, libanl, libutil) that runtime security agents injected into a container expect; Collectord itself doesn’t use them. There’s no shell, no package manager, no interpreter to pivot from. The certified OpenShift image on registry.connect.redhat.com is built on Red Hat’s UBI 9 instead.
Container configuration
To collect logs from the cluster, Collectord needs access to the host filesystem - that’s why the DaemonSet requires privileged access. The addon Deployment runs without privileges. Collectord treats the host as read-only. The only thing it writes back is acknowledgement state in the form of a small database, which by default lives under /var/lib/collectorforkubernetes-syslog (Kubernetes) or /var/lib/collectorforopenshift-syslog (OpenShift). If you configure a volume database, it goes in the volume root instead.
If you skip the volume database, you can drop the host filesystem to read-only - but you’ll still need write access to Collectord’s primary database directory (the data folder).
Collectord also reads from the API Server. We scope that access with RBAC so it only has the read permissions it needs, nothing more. The ClusterRole grants nothing on Secrets.
Before 26.10, the ClusterRole granted
get,listandwatchon Secrets, and the manifests’ ClusterRole granted them on every resource in the cluster.
Internet access
The default license requires internet access so license clients can verify against our license server. If your environment doesn’t allow outbound traffic, we can issue a license that doesn’t require verification - reach out and we’ll set you up.
Collectord also forwards anonymous telemetry to our license server. You can turn that off in the configuration (Kubernetes / OpenShift).
Connection to the syslog server
The [output.syslog] block sends plain TCP or UDP: it has only network (tcp or udp) and address, and no TLS settings. To encrypt the connection - most security and audit deployments need it - send to a syslog relay on a trusted network, and have the relay forward to your SIEM over TLS.
UDP is faster on a clean network but offers no delivery guarantees. Use it only when the syslog server is on the same trusted network as the cluster nodes.