在侧车模式下使用Kubernetes的Splunk转发器 [英] Splunk forwarder with Kubernetes in side car pattern

问题描述

我已经创建了一个自定义的Splunk转发器映像.

I have created a custom Splunk forwarder image.

图片名称:vrathore/splunkuniversalforwarder

我已验证日志已推送到服务器.我正在使用主机(c/Users/var/log)中存在的虚拟日志.如果我运行此Docker命令:

I have verified that the log is pushing to the server. I am using dummy log present in my host (c/Users/var/log). If I run this Docker command:

docker run --name splunkforwarder -d -v /c/Users/var/log://var/log/messages -p 8089:8089 -p 8088:8088 -e SPLUNK_SERVER_HOST=splunk-prodtest-gsp.test.com:9997 -e
FORWARD_HOSTNAME=kubernetes vrathore/splunkuniversalforwarder

现在我想在Kubernetes容器中使用相同的图像，其中2个容器将与我的Splunk转发器图像共享其日志文件夹.

Now I wanted to use the same image in Kubernetes pod, where 2 container will share their log folder with my Splunk forwarder image.

spec:
  revisionHistoryLimit: 5
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 10%
      maxSurge: 10%
  replicas: 1
  template:
    metadata:
      name: %APP_FULL_NAME%-pod
      labels:
        appname: %APP_FULL_NAME%
        stage: %APP_ENV%
        component: app-kube-pod-object
    spec:
      containers:
      - name: %APP_FULL_NAME%-service
        image: %DOCKER_IMAGE%
        imagePullPolicy: Always
        envFrom:
        - configMapRef:
            name: %APP_CONFIG_MAP%
        command: ["catalina.sh", "run"]
        ports:
        - containerPort: 8080
      imagePullSecrets:
      - name: %DOCKER_REPO_REGKEY%
  selector:
    matchLabels:
      appname: %APP_FULL_NAME%
      stage: %APP_ENV%

Kubernetes对我来说是新的.如何在容器之间共享日志文件夹?

Kubernetes is new to me. How can I share the log folder between the containers?

推荐答案

您需要定义一个emptyDir类型的卷并将其附加到两个容器.假设该应用的日志位于/var/log/myapp/下(我也添加了第二个容器)

You need to define an emptyDir type volume and attach it to both containers. Assuming that the logs from the app are under /var/log/myapp/ (I have added the second container as well)

spec:
  revisionHistoryLimit: 5
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 10%
      maxSurge: 10%
  replicas: 1
  template:
    metadata:
      name: %APP_FULL_NAME%-pod
      labels:
        appname: %APP_FULL_NAME%
        stage: %APP_ENV%
        component: app-kube-pod-object
    spec:
      containers:
      - name: %APP_FULL_NAME%-service
        image: %DOCKER_IMAGE%
        imagePullPolicy: Always
        envFrom:
        - configMapRef:
            name: %APP_CONFIG_MAP%
        command: ["catalina.sh", "run"]
        ports:
        - containerPort: 8080
        volumeMounts:
        - name: logs
          mountPath: /var/log/myapp/
      - name: uf
        image: vrathore/splunkuniversalforwarder
        ...
        volumeMounts:
        - name: logs
          mountPath: /var/log/myapp/
      imagePullSecrets:
      - name: %DOCKER_REPO_REGKEY%
      volumes:
      - name: logs
        emptyDir: {}
  selector:
    matchLabels:
      appname: %APP_FULL_NAME%
      stage: %APP_ENV%

此外，我建议您寻找一种替代解决方案，借助Collectord和Monitoring Kubernetes/OpenShift，您可以告诉Collectord在哪里寻找日志，而您不需要运行Sidecar容器

Also, I would recommend looking for an alternative solution, with Collectord and Monitoring Kubernetes/OpenShift you can tell Collectord where to look for logs and you don't need to run a sidecar container https://www.outcoldsolutions.com/docs/monitoring-kubernetes/v5/annotations/#application-logs, just one Collectord daemon will do the work.

这篇关于在侧车模式下使用Kubernetes的Splunk转发器的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！