EFK简单部署收集K8S日志

docker pull  elasticsearch:8.11.0
docker pull kibana:8.11.0

mkdir -p /data/es/{config,data,plugins}
chmod 777 /data/es/{config,data,plugins}

cat > /data/es/config/elasticsearch.yml <<EOF
cluster.name: "docker-cluster"
network.host: 0.0.0.0
xpack.security.enabled: false
EOF

安装ES

docker run -d \
 --name elasticsearch \
 --network es-network \
 --restart=always \
 -p 9200:9200 \
 -p 9300:9300 \
 -v /data/es/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml \
 -v /data/es/data:/usr/share/elasticsearch/data \
 -v /data/es/plugins:/usr/share/elasticsearch/plugins \
 -e "discovery.type=single-node" \
 -e "ES_JAVA_OPTS=-Xms512m -Xmx512m" \
 elasticsearch:8.11.0

kibana

mkdir -p  /data/kibana/{config,data}
chmod 777 /data/kibana/{config,data}
cat > /data/kibana/config/kibana.yml << EOF
server.host: "0.0.0.0"
server.shutdownTimeout: "5s"
elasticsearch.hosts: [ "http://elasticsearch:9200" ]
monitoring.ui.container.elasticsearch.enabled: true
EOF

docker run -d \
--name kibana \
--network es-network \
--restart=always \
-p 5601:5601 \
-v /data/kibana/config/kibana.yml:/usr/share/kibana/config/kibana.yml \
kibana:8.11.0

Ｋ８S部署

cat > fluentd.yaml << EOF
apiVersion: v1
kind: ServiceAccount
metadata:
  name: fluentd
  namespace: demon
  labels:
    app: fluentd
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: fluentd
  labels:
    app: fluentd
rules:
- apiGroups:
  - ""
  resources:
  - pods
  - namespaces
  verbs:
  - get
  - list
  - watch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: fluentd
roleRef:
  kind: ClusterRole
  name: fluentd
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  name: fluentd
  namespace: demon
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: fluentd
  namespace: demon
  labels:
    app: fluentd
spec:
  selector:
    matchLabels:
      app: fluentd
  template:
    metadata:
      labels:
        app: fluentd
    spec:
      serviceAccount: fluentd
      serviceAccountName: fluentd
      tolerations:
      - key: node-role.kubernetes.io/control-plane
        effect: NoSchedule
      containers:
      - name: fluentd
        image: fluentd-kubernetes-daemonset:v1.16-debian-elasticsearch8-1
        imagePullPolicy: IfNotPresent
        env:
          - name:  FLUENT_ELASTICSEARCH_HOST
            value: "192.168.0.12"
          - name:  FLUENT_ELASTICSEARCH_PORT
            value: "9200"
          - name: FLUENT_ELASTICSEARCH_SCHEME
            value: "http"
          - name: FLUENTD_SYSTEMD_CONF
            value: disable
          - name: FLUENT_CONTAINER_TAIL_PARSER_TYPE
            value: "cri"
          - name: FLUENT_CONTAINER_TAIL_PARSER_TIME_FORMAT
            value: "%Y-%m-%dT%H:%M:%S.%L%z"
        resources:
          limits:
            memory: 4024Mi
          requests:
            cpu: 100m
            memory: 200Mi
        volumeMounts:
        - name: varlog
          mountPath: /var/log
        - name: containers
          mountPath: /var/log/containers
          readOnly: true
      terminationGracePeriodSeconds: 30
      volumes:
      - name: varlog
        hostPath:
          path: /var/log
      - name: containers
        hostPath:
          path: /var/log/containers
EOF