98 lines
2.7 KiB
YAML
98 lines
2.7 KiB
YAML
# One collector per node tails only Nereus container logs.
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: nereus-otel-log-collector
|
|
labels:
|
|
app.kubernetes.io/name: nereus-otel-log-collector
|
|
data:
|
|
config.yaml: |
|
|
receivers:
|
|
filelog/nereus:
|
|
include:
|
|
- /var/log/pods/nereus_*/*/*.log
|
|
include_file_path: true
|
|
start_at: beginning
|
|
operators:
|
|
- type: container
|
|
id: parse-container-log
|
|
|
|
processors:
|
|
memory_limiter:
|
|
check_interval: 1s
|
|
limit_mib: 96
|
|
batch:
|
|
timeout: 5s
|
|
# Loki's internal gRPC push limit is 4 MiB. start_at: beginning replays
|
|
# whole files after a restart, so an uncapped batch exceeds it and the
|
|
# exporter retries the same oversized request forever.
|
|
send_batch_size: 1000
|
|
send_batch_max_size: 2000
|
|
|
|
exporters:
|
|
otlphttp/loki:
|
|
endpoint: http://loki.observability.svc.cluster.local:3100/otlp
|
|
|
|
service:
|
|
pipelines:
|
|
logs:
|
|
receivers: [filelog/nereus]
|
|
processors: [memory_limiter, batch]
|
|
exporters: [otlphttp/loki]
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: DaemonSet
|
|
metadata:
|
|
name: nereus-otel-log-collector
|
|
labels:
|
|
app.kubernetes.io/name: nereus-otel-log-collector
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: nereus-otel-log-collector
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: nereus-otel-log-collector
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
securityContext:
|
|
runAsUser: 10001
|
|
runAsGroup: 10001
|
|
runAsNonRoot: true
|
|
# k3s: /var/log/pods is 0750 root:root, container logs 0640 root:root.
|
|
# Group root has r-x / r--, so gid 0 is enough to tail them as non-root.
|
|
supplementalGroups: [0]
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: otel-collector
|
|
image: otel/opentelemetry-collector-contrib:0.159.0
|
|
args: ["--config=/conf/config.yaml"]
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /conf
|
|
readOnly: true
|
|
- name: pod-logs
|
|
mountPath: /var/log/pods
|
|
readOnly: true
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
readOnlyRootFilesystem: true
|
|
resources:
|
|
requests:
|
|
cpu: 20m
|
|
memory: 64Mi
|
|
limits:
|
|
memory: 128Mi
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: nereus-otel-log-collector
|
|
- name: pod-logs
|
|
hostPath:
|
|
path: /var/log/pods
|
|
type: Directory
|