torrent.yaml

apiVersion: v1
kind: Namespace
metadata:
  name: logging

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: torrent
  namespace: logging

---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: torrent
  namespace: logging
rules:
- apiGroups: [""]
  resources:
  - nodes
  - nodes/proxy
  - services
  - endpoints
  - pods
  verbs: ["get", "list", "watch"]

---

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: torrent
roleRef:
  kind: ClusterRole
  name: torrent
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  name: torrent
  namespace: logging
---

apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-config
  namespace: logging
  labels:
    k8s-app: torrent-logging
data:
  filebeat.yml: |-
    filebeat.autodiscover:
      providers:
        - type: kubernetes
          include_annotations: ['torrent/stream', 'torrent/module_name']
          templates:
            - condition:
                equals:
                  kubernetes.annotations.torrent/stream: 'true'
              config:
                - type: docker
                  fields:
                    module_name: "${data.kubernetes.annotations.torrent/module_name}"
                  containers:
                    stream: all
                    ids:
                    - "${data.kubernetes.container.id}"
    queue.mem:
      events: 4096
      flush.min_events: 512
      flush.timeout: 5s
    logging.level: info
    logging.metrics.enabled: true
    filebeat.config:
      inputs:
        # Mounted `filebeat-inputs` configmap:
        path: ${path.config}/inputs.d/*.yml
        # Reload inputs configs as they change:
        reload.enabled: true
        reload.period: 10s
      modules:
        path: ${path.config}/modules.d/*.yml
        # Reload module configs as they change:
        reload.enabled: true
        reload.period: 10s
    output.console:
      enabled: true

---
apiVersion: v1
kind: ConfigMap
metadata:
    name: torrent-input-tpl
    namespace: logging
    labels:
        k8s-app: torrent-logging
data:
    filebeat-input-log.tpl: |-
        - type: log
          enabled: true
          harvester_buffer_size: 10485760
          paths:
            - {{ .logPath }}/{{ .logFiles }}
          fields:
            module_name: {{ .moduleName }}
            log_type: {{ .logType }}
          tail_files: true
          max_bytes: 1048576
          close_inactive: 1h
          close_renamed: true
          close_removed: true
          close_eof: false
          close_timeout: 3600

---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: torrent-filebeat
  namespace: logging
  labels:
    k8s-app: torrent-logging
spec:
  selector:
    matchLabels:
      name: torrent-filebeat
  template:
    metadata:
      labels:
        name: torrent-filebeat
    spec:
      serviceAccountName: torrent
      containers:
      - name: torrent
        image: rand01ph/torrent:v2.0
        imagePullPolicy: IfNotPresent
        resources:
          limits:
            cpu: 300m
            memory: 300Mi
          requests:
            cpu: 100m
            memory: 100Mi
        volumeMounts:
          - name: docker-sock-volume
            mountPath: /var/run/docker.sock
          # mount for generate log inputs
          - name: inputs
            mountPath: /tmp
          # torrent for filebeat input template
          - name: torrent-input-tpl
            mountPath: /tpl

      - name: filebeat
        image: elastic/filebeat:6.8.2
        imagePullPolicy: IfNotPresent
        args: [
          "-c", "/etc/filebeat.yml",
          "-e",
        ]
        securityContext:
          runAsUser: 0
          # If using Red Hat OpenShift uncomment this:
          #privileged: true
        resources:
          limits:
            cpu: 300m
            memory: 300Mi
          requests:
            cpu: 100m
            memory: 100Mi
        volumeMounts:
          - name: filebeat-config
            mountPath: /etc/filebeat.yml
            readOnly: true
            subPath: filebeat.yml
          - name: inputs
            mountPath: /usr/share/filebeat/inputs.d
            readOnly: true
          - name: data
            mountPath: /usr/share/filebeat/data
          - name: root
            mountPath: /host
            readOnly: true
            mountPropagation: HostToContainer
      volumes:
        - name: filebeat-config
          configMap:
            defaultMode: 0600
            name: filebeat-config
        # data folder stores a registry of read status for all files, so we don't send everything again on a Filebeat pod restart
        - name: data
          hostPath:
            path: /var/lib/filebeat-data
            type: DirectoryOrCreate
        # use for collect emptyDir log
        - name: root
          hostPath:
            path: /
        # shared for input file
        - name: inputs
          emptyDir: {}
        - name: docker-sock-volume
          hostPath:
            path: /var/run/docker.sock
            type: File
        - name: torrent-input-tpl
          configMap:
            name: torrent-input-tpl