fluentd-daemonset.yml

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: fluentd
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: fluentd
  namespace: kube-system
rules:
- apiGroups:
  - ""
  resources:
  - pods
  - namespaces
  verbs:
  - get
  - list
  - watch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: fluentd
roleRef:
  kind: ClusterRole
  name: fluentd
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  name: fluentd
  namespace: kube-system
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: fluentd-logging-config
  namespace: kube-system
data:
  systemd.conf: ""
  kubernetes.conf: |-
    <match fluent.**>
      @type null
    </match>
    # https://github.com/paulczar/cfcr-efk/blob/master/fluentd/fluentd-cm.yaml
    <source>
     @id fluentd-containers.log
     @type tail
     @log_level error
     path /var/log/containers/*.log
     pos_file /var/log/es-containers.log.pos
     time_format %Y-%m-%dT%H:%M:%S.%NZ
     tag kubernetes.*
     format json
     read_from_head true
    </source>
    <source>
      @id docker.log
      @type tail
      format /^time="(?<time>[^)]*)" level=(?<severity>[^ ]*) msg="(?<message>[^"]*)"( err="(?<error>[^"]*)")?( statusCode=($<status_code>\d+))?/
      path /var/vcap/sys/log/docker/*.log
      pos_file /var/log/es-docker.log.pos
      tag docker
    </source>
    <source>
      @id kubelet.log
      @type tail
      format multiline
      multiline_flush_interval 5s
      format_firstline /^\w\d{4}/
      format1 /^(?<severity>\w)(?<time>\d{4} [^\s]*)\s+(?<pid>\d+)\s+(?<source>[^ \]]+)\] (?<message>.*)/
      time_format %m%d %H:%M:%S.%N
      path /var/vcap/sys/log/kubelet/*.log
      pos_file /var/log/es-kubelet.log.pos
      tag kubelet
    </source>
    <source>
      @id kube-proxy.log
      @type tail
      format multiline
      multiline_flush_interval 5s
      format_firstline /^\w\d{4}/
      format1 /^(?<severity>\w)(?<time>\d{4} [^\s]*)\s+(?<pid>\d+)\s+(?<source>[^ \]]+)\] (?<message>.*)/
      time_format %m%d %H:%M:%S.%N
      path /var/vcap/sys/log/kube-proxy/*.log
      pos_file /var/log/es-kube-proxy.log.pos
      tag kube-proxy
    </source>
    <source>
      @id flanneld.log
      @type tail
      format multiline
      multiline_flush_interval 5s
      format_firstline /^\w\d{4}/
      format1 /^(?<severity>\w)(?<time>\d{4} [^\s]*)\s+(?<pid>\d+)\s+(?<source>[^ \]]+)\] (?<message>.*)/
      time_format %m%d %H:%M:%S.%N
      path /var/vcap/sys/log/flanneld/*.log
      pos_file /var/log/es-flanneld.log.pos
      tag flanneld
    </source>
    <filter kubernetes.**>
      @type kubernetes_metadata
      @id filter_kube_metadata
    </filter>
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: fluentd
  namespace: kube-system
  labels:
    k8s-app: fluentd-logging
    kubernetes.io/cluster-service: "true"
spec:
  selector:
    matchLabels:
      k8s-app: fluentd-logging
  template:
    metadata:
      labels:
        k8s-app: fluentd-logging
        kubernetes.io/cluster-service: "true"
    spec:
      serviceAccountName: fluentd
      tolerations:
      - key: node-role.kubernetes.io/master
        effect: NoSchedule
      containers:
      - name: fluentd
        image: fluent/fluentd-kubernetes-daemonset:v1.2-debian-syslog
        env:
        - name: SYSLOG_HOST
          value: "fiordland.udcp.info"
        - name: SYSLOG_PORT
          value: "5140"
        - name: FLUENT_UID # https://github.com/fluent/fluentd-kubernetes-daemonset/issues/173
          value: "0"
        - name: FLUENTD_OPT
          value: "-q"
        resources:
          limits:
            memory: 200Mi
          requests:
            cpu: 100m
            memory: 200Mi
        volumeMounts:
        - name: varlogpods
          mountPath: /var/log/pods
          readOnly: true
        - name: varlogcontainers
          mountPath: /var/log/containers
          readOnly: true
        - name: dockercontainers
          mountPath: /var/vcap/store/docker/docker/containers
          readOnly: true
        - name: varvcapsyslog
          mountPath: /var/vcap/sys/log
          readOnly: true
        - name: kubernetes-conf
          mountPath: /fluentd/etc/kubernetes.conf
          subPath: kubernetes.conf
          readOnly: true
        - name: systemd-conf
          mountPath: /fluentd/etc/systemd.conf
          subPath: systemd.conf
          readOnly: true
      volumes:
      - name: varlogpods
        hostPath:
          path: /var/log/pods
      - name: varlogcontainers
        hostPath:
          path: /var/log/containers
      - name: dockercontainers
        hostPath:
          path: /var/vcap/store/docker/docker/containers
      - name: varvcapsyslog
        hostPath:
          path: /var/vcap/sys/log
      - name: kubernetes-conf
        configMap:
          name: fluentd-logging-config
          items:
          - key: kubernetes.conf
            path: kubernetes.conf
      - name: systemd-conf
        configMap:
          name: fluentd-logging-config
          items:
          - key: systemd.conf
            path: systemd.conf