DaemonSet logging
- Docker & Kubernetes course
- Advanced
- Lesson 59/70
- 4 min
Learn to deploy Fluentd as a DaemonSet.
Logging with a DaemonSet
For a collector DaemonSet to access node logs, three things are needed: mounting the node's /var/log directory read-only with hostPath, RBAC permission to read pod metadata, and a toleration for the control-plane taint to run on all nodes:
spec:
serviceAccountName: fluent-bit
tolerations:
- operator: Exists
volumes:
- name: varlog
hostPath:
path: /var/log
containers:
- name: fluent-bit
image: fluent/fluent-bit:3.1
volumeMounts:
- name: varlog
mountPath: /var/log
readOnly: trueThe collector's permissions
The kubernetes filter reads pod labels and namespaces from the API; that's why the collector's ServiceAccount is given cluster-wide read permission:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: fluent-bit
rules:
- apiGroups: [""]
resources: ["pods", "namespaces"]
verbs: ["get", "list", "watch"]Practice The collector DaemonSet
Write a DaemonSet template's spec section (starting with spec:): serviceAccountName: fluent-bit; operator: Exists under tolerations; a varlog volume with hostPath /var/log; container named fluent-bit, image fluent/fluent-bit:3.1; mount varlog at /var/log with readOnly: true.
Starter code
# buraya yazSample solution
spec:
serviceAccountName: fluent-bit
tolerations:
- operator: Exists
volumes:
- name: varlog
hostPath:
path: /var/log
containers:
- name: fluent-bit
image: fluent/fluent-bit:3.1
volumeMounts:
- name: varlog
mountPath: /var/log
readOnly: trueExpected output
daemonset.apps/fluent-bit created
Questions and answers
Review the lesson questions together with their answers. To test yourself, solve the lesson interactively.
1 What does writing only operator: Exists under tolerations mean?
- No tolerations at all
- Only control-plane
- It's invalid
- Tolerating all taints; the pod can be placed on every node Correct answer
Explanation: Exists without a key matches every taint; it's used for infrastructure agents.
2 Mount the node's log directory.
volumes:
- name: varlog
hostPath:
path: ____ volumes:
- name: varlog
hostPath:
path: /var/logExplanation: Container logs are under /var/log/containers and /var/log/pods.
3 Match.
| Term | Meaning |
|---|---|
hostPath /var/log |
Node log files |
readOnly: true |
Read only |
operator: Exists |
Tolerate all taints |
ClusterRole |
Reading pod metadata |