# One collector per node tails only Nereus container logs.
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: nereus-otel-log-collector
  labels:
    app.kubernetes.io/name: nereus-otel-log-collector
data:
  config.yaml: |
    receivers:
      file_log/nereus:
        include:
          - /var/log/pods/nereus_*/*/*.log
        include_file_path: true
        start_at: beginning
        operators:
          - type: container
            id: parse-container-log

    processors:
      memory_limiter:
        check_interval: 1s
        limit_mib: 96
      batch:
        timeout: 5s

    exporters:
      otlp_http/loki:
        endpoint: http://loki.observability.svc.cluster.local:3100/otlp

    service:
      pipelines:
        logs:
          receivers: [file_log/nereus]
          processors: [memory_limiter, batch]
          exporters: [otlp_http/loki]
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: nereus-otel-log-collector
  labels:
    app.kubernetes.io/name: nereus-otel-log-collector
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: nereus-otel-log-collector
  template:
    metadata:
      labels:
        app.kubernetes.io/name: nereus-otel-log-collector
    spec:
      automountServiceAccountToken: false
      securityContext:
        runAsUser: 10001
        runAsGroup: 10001
        runAsNonRoot: true
        # k3s: /var/log/pods is 0750 root:root, container logs 0640 root:root.
        # Group root has r-x / r--, so gid 0 is enough to tail them as non-root.
        supplementalGroups: [0]
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: otel-collector
          image: otel/opentelemetry-collector-contrib:0.159.0
          args: ["--config=/conf/config.yaml"]
          volumeMounts:
            - name: config
              mountPath: /conf
              readOnly: true
            - name: pod-logs
              mountPath: /var/log/pods
              readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
            readOnlyRootFilesystem: true
          resources:
            requests:
              cpu: 20m
              memory: 64Mi
            limits:
              memory: 128Mi
      volumes:
        - name: config
          configMap:
            name: nereus-otel-log-collector
        - name: pod-logs
          hostPath:
            path: /var/log/pods
            type: Directory