kubernetes-fluentd-deamonset.sh

envs

LOG_GROUP_NAME=xxxxxxxxxxx
AWS_ACCESS_KEY_ID=xxxxxxxxxxx
AWS_SECRET_ACCESS_KEY=xxxxxxxxxxx
AWS_REGION=ap-northeast-1

kubernetes-fluentd-deamonset.sh

#!/bin/bash -xe

# url: https://github.com/fluent/fluentd-kubernetes-daemonset
# github: https://github.com/fluent/fluentd-kubernetes-daemonset

namespace=${1:-kube-system}
aggregator=${2:-syslog} # s3|papertrail|elasticsearch|...

cat <<EOF | kubectl apply -f -
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: fluentd
  namespace: ${namespace}

---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: fluentd
  namespace: ${namespace}
rules:
- apiGroups:
  - ""
  resources:
  - pods
  - namespaces
  verbs:
  - get
  - list
  - watch

---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: fluentd
roleRef:
  kind: ClusterRole
  name: fluentd
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  name: fluentd
  namespace: ${namespace}
EOF

cat <<EOF | rq -y -J | jq ".spec.template.spec.containers[0].env = "$(\
        cat envs | \
            jq -r -s -R 'split("\n")|map(split("="))| [map({"name": .[0], "value": .[1]})| .[] | select(.name != null)]' | \
            tr -d '\n ') | tee /dev/stderr | kubectl apply -f -
apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  name: fluentd
  namespace: ${namespace}
spec:
  template:
    metadata:
      labels:
        kubernetes.io/cluster-service: "true"
    spec:
      tolerations:
      - key: node-role.kubernetes.io/master
        effect: NoSchedule
      serviceAccount: fluentd
      serviceAccountName: fluentd
      containers:
      - name: fluentd
        image: fluent/fluentd-kubernetes-daemonset:v1.2-debian-${aggregator}
        resources:
          limits:
            memory: 200Mi
          requests:
            cpu: 100m
            memory: 200Mi
        volumeMounts:
        - name: varlog
          mountPath: /var/log
        - name: varlibdockercontainers
          mountPath: /var/lib/docker/containers
          readOnly: true
      terminationGracePeriodSeconds: 30
      volumes:
      - name: varlog
        hostPath:
          path: /var/log
      - name: varlibdockercontainers
        hostPath:
          path: /var/lib/docker/containers
EOF

kubernetes-fluentd.sh

#!/bin/bash -xe

# url: https://github.com/fluent/fluentd-kubernetes-daemonset
# github: https://github.com/fluent/fluentd-kubernetes-daemonset

namespace=${1:-kube-system}
aggregator=${2:-syslog} # s3|papertrail|elasticsearch|...

cat <<EOF | kubectl apply -f -
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: fluentd
  namespace: ${namespace}

---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: fluentd
  namespace: ${namespace}
rules:
- apiGroups:
  - ""
  resources:
  - pods
  - namespaces
  verbs:
  - get
  - list
  - watch

---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: fluentd
roleRef:
  kind: ClusterRole
  name: fluentd
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  name: fluentd
  namespace: ${namespace}
EOF

kubectl run --image=fluent/fluentd-kubernetes-daemonset:v1.2-debian-${aggregator} \
        --dry-run \
        -o json \
        --namespace=${namespace} \
        --serviceaccount=fluentd \
        $(cat envs | xargs -I{} echo "--env={}") \
        fluentd |
    jq '.spec.template.spec.volumes = '$(\
        jo -a $(jo name=varlog hostPath=$(jo path=/var/log))) |
    jq '.spec.template.spec.containers[0] += '$(\
        jo volumeMounts=$(jo -a $(jo name=varlog mountPath=/var/log)) securityContext=$(jo privileged=true)) |
    tee /dev/stderr |
    kubectl apply -f -