Container Service for Kubernetes:Integrate Simple Log Service with a registered cluster

Use onectl

1. Install and configure onectl on your local machine. For more information, see Manage registered clusters using onectl.

2. Run the following command to configure RAM permissions for the Simple Log Service component:

   onectl ram-user grant --addon logtail-ds

   Expected output:

   Ram policy ack-one-registered-cluster-policy-logtail-ds granted to ram user ack-one-user-ce313528c3 successfully.

Use the console

Before you install components in a registered cluster, you must create an AccessKey pair to grant the cluster permissions to access cloud services. This requires creating a RAM user and granting it the necessary permissions.

1. Create a RAM user.

2. Create a custom policy. Use the following policy content.

   Show sample code

   {
       "Version": "1",
       "Statement": [
           {
               "Action": [
                   "log:CreateProject",
                   "log:GetProject",
                   "log:DeleteProject",
                   "log:CreateLogStore",
                   "log:GetLogStore",
                   "log:UpdateLogStore",
                   "log:DeleteLogStore",
                   "log:CreateConfig",
                   "log:UpdateConfig",
                   "log:GetConfig",
                   "log:DeleteConfig",
                   "log:CreateMachineGroup",
                   "log:UpdateMachineGroup",
                   "log:GetMachineGroup",
                   "log:DeleteMachineGroup",
                   "log:ApplyConfigToGroup",
                   "log:GetAppliedMachineGroups",
                   "log:GetAppliedConfigs",
                   "log:RemoveConfigFromMachineGroup",
                   "log:CreateIndex",
                   "log:GetIndex",
                   "log:UpdateIndex",
                   "log:DeleteIndex",
                   "log:CreateSavedSearch",
                   "log:GetSavedSearch",
                   "log:UpdateSavedSearch",
                   "log:DeleteSavedSearch",
                   "log:CreateDashboard",
                   "log:GetDashboard",
                   "log:UpdateDashboard",
                   "log:DeleteDashboard",
                   "log:CreateJob",
                   "log:GetJob",
                   "log:DeleteJob",
                   "log:UpdateJob",
                   "log:PostLogStoreLogs",
                   "log:CreateSortedSubStore",
                   "log:GetSortedSubStore",
                   "log:ListSortedSubStore",
                   "log:UpdateSortedSubStore",
                   "log:DeleteSortedSubStore",
                   "log:CreateApp",
                   "log:UpdateApp",
                   "log:GetApp",
                   "log:DeleteApp",
                   "cs:DescribeTemplates",
                   "cs:DescribeTemplateAttribute"
               ],
               "Resource": [
                   "*"
               ],
               "Effect": "Allow"
           }
       ]
   }

3. Attach the policy to the RAM user.

4. Create an AccessKey for the RAM user.

   Warning

   For enhanced security, configure a network access control policy for the AccessKey to restrict access to trusted network environments and improve security. For more information, see AccessKey-based network access restriction policies.

5. Use the AccessKey pair to create a Secret named alibaba-addon-secret in the registered cluster.

   Run the following command to create the Secret used by the Logtail component.

   kubectl -n kube-system create secret generic alibaba-addon-secret --from-literal='access-key-id=<your AccessKey ID>' --from-literal='access-key-secret=<your AccessKey Secret>'

   Note

   Replace <your AccessKey ID> and <your AccessKey Secret> with your AccessKey pair.

Use onectl

Run the following command to install the logtail-ds component:

onectl addon install logtail-ds

Expected output:

Addon logtail-ds, version **** installed.

Use the console

1. Log on to the ACK console. In the left navigation pane, click Clusters.

2. On the Clusters page, click the name of the target cluster. In the left-side navigation pane, click Add-ons.

3. On the Add-ons page, click the Logs and Monitoring tab. Find the logtail-ds component and click Install in the lower-right corner of the card.

4. In the Note dialog box, click OK.

Text logs

To collect text logs from pods, connect to the registered cluster by using kubectl and apply the following AliyunLogConfig configuration.

apiVersion: log.alibabacloud.com/v1alpha1
kind: AliyunLogConfig
metadata:
  name: test-file                  # The name of the resource. The name must be unique in the Kubernetes cluster.
spec:
  project: k8s-log-c326bc86****    # Optional. The name of the project. You can customize the name. We recommend that you name the project in the k8s-log-<cluster-id> format.
  logstore: test-file              # Required. The name of the Logstore. If the specified Logstore does not exist, Simple Log Service automatically creates it.
  logtailConfig:                   # The Logtail configuration.
    inputType: file                # The type of the data source. Set the value to file for text logs or plugin for stdout.
    configName: test-file          # The name of the Logtail configuration. The name must be the same as the resource name specified by metadata.name.
    inputDetail:                   # The details of the Logtail configuration.
      logType: common_reg_log      # Collects text logs in simple mode.
      logPath: /log/               # The path where the log files are stored.
      filePattern: "*.log"         # The name of the log file. You can use asterisks (*) and question marks (?) as wildcards. Example: log_*.log.
      dockerFile: true             # Specifies whether to collect logs from files in containers. Set the value to true.
      advanced:                    # Specifies the conditions to filter containers.
        k8s:
          K8sNamespaceRegex: ^(default)$
          K8sPodRegex: '^(nginx-log-demo.*)$'
          K8sContainerRegex: ^(nginx-log-demo-0)$
          IncludeK8sLabel:
            job-name: "^(nginx-log-demo.*)$"

For more information about the parameters, see Logtail configurations (Legacy).

Stdout

To collect stdout from pods, connect to the registered cluster by using kubectl and apply the following AliyunLogConfig configuration. Applying this configuration automatically creates a Logstore named stdout-logstore and collects logs into it.

apiVersion: log.alibabacloud.com/v1alpha1
kind: AliyunLogConfig
metadata:
  # The name of your configuration. The name must be unique in your Kubernetes cluster.
  name: stdout-collector
spec:
  # The name of the Logstore to which logs are uploaded.
  logstore: stdout-logstore
  # The details of the Logtail configuration.
  logtailConfig:
    # The input type for Docker stdout. Must be 'plugin'.
    inputType: plugin
    # The name of the Logtail configuration. Must match metadata.name.
    configName: stdout-collector
    inputDetail:
      plugin:
        inputs:
          -
            type: service_docker_stdout
            detail:
              # Collects stdout and stderr.
              Stdout: true
              Stderr: true
              # Collects the stdout of all containers except for those with the COLLECT_STDOUT_FLAG:false environment variable.