Docker & Kubernetes
DaemonSet logging
Learn to deploy Fluentd as a DaemonSet.
Logging with a DaemonSet
For a collector DaemonSet to access node logs, three things are needed: mounting the node's /var/log directory read-only with hostPath, RBAC permission to read pod metadata, and a toleration for the control-plane taint to run on all nodes:
spec:
serviceAccountName: fluent-bit
tolerations:
- operator: Exists
volumes:
- name: varlog
hostPath:
path: /var/log
containers:
- name: fluent-bit
image: fluent/fluent-bit:3.1
volumeMounts:
- name: varlog
mountPath: /var/log
readOnly: true
The collector's permissions
The kubernetes filter reads pod labels and namespaces from the API; that's why the collector's ServiceAccount is given cluster-wide read permission:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: fluent-bit
rules:
- apiGroups: [""]
resources: ["pods", "namespaces"]
verbs: ["get", "list", "watch"]
Exercise The collector DaemonSet
Write a DaemonSet template's spec section (starting with spec:): serviceAccountName: fluent-bit; operator: Exists under tolerations; a varlog volume with hostPath /var/log; container named fluent-bit, image fluent/fluent-bit:3.1; mount varlog at /var/log with readOnly: true.
Show example solution
spec:
serviceAccountName: fluent-bit
tolerations:
- operator: Exists
volumes:
- name: varlog
hostPath:
path: /var/log
containers:
- name: fluent-bit
image: fluent/fluent-bit:3.1
volumeMounts:
- name: varlog
mountPath: /var/log
readOnly: true
Test yourself
-
What does writing only operator: Exists under tolerations mean?
- No tolerations at all
- Only control-plane
- It's invalid
- Tolerating all taints; the pod can be placed on every node
Show answer
Tolerating all taints; the pod can be placed on every node — Exists without a key matches every taint; it's used for infrastructure agents.
-
Mount the node's log directory.
volumes:
- name: varlog
hostPath:
path: ____
Show answer
volumes:
- name: varlog
hostPath:
path: /var/log
-
Match.
- hostPath /var/log
- Node log files
- readOnly: true
- Read only
- operator: Exists
- Tolerate all taints
- ClusterRole
- Reading pod metadata
Next lesson: Summary - Logging
