Container Service for Kubernetes:Integrate Simple Log Service with a registered cluster

Configure by using onectl

1. Install and configure onectl on your local machine. For more information, see Manage registered clusters using onectl.

2. Configure RAM permissions for the logtail-ds add-on:

   onectl ram-user grant --addon logtail-ds

   Expected output:

   Ram policy ack-one-registered-cluster-policy-logtail-ds granted to ram user ack-one-user-ce313528c3 successfully.

Configure by using the console

Before you install add-ons in a registered cluster, you must configure an AccessKey pair in the registered cluster so that the cluster can access cloud services. Before you configure the AccessKey pair, you must create a Resource Access Management (RAM) user and grant it the permissions to access the required cloud resources.

1. Create a RAM user.

2. Create a custom policy. Use the following policy content:

   Expand to view the permission policy required by the logtail-ds add-on

   {
       "Version": "1",
       "Statement": [
           {
               "Action": [
                   "log:CreateProject",
                   "log:GetProject",
                   "log:DeleteProject",
                   "log:CreateLogStore",
                   "log:GetLogStore",
                   "log:UpdateLogStore",
                   "log:DeleteLogStore",
                   "log:CreateConfig",
                   "log:UpdateConfig",
                   "log:GetConfig",
                   "log:DeleteConfig",
                   "log:CreateMachineGroup",
                   "log:UpdateMachineGroup",
                   "log:GetMachineGroup",
                   "log:DeleteMachineGroup",
                   "log:ApplyConfigToGroup",
                   "log:GetAppliedMachineGroups",
                   "log:GetAppliedConfigs",
                   "log:RemoveConfigFromMachineGroup",
                   "log:CreateIndex",
                   "log:GetIndex",
                   "log:UpdateIndex",
                   "log:DeleteIndex",
                   "log:CreateSavedSearch",
                   "log:GetSavedSearch",
                   "log:UpdateSavedSearch",
                   "log:DeleteSavedSearch",
                   "log:CreateDashboard",
                   "log:GetDashboard",
                   "log:UpdateDashboard",
                   "log:DeleteDashboard",
                   "log:CreateJob",
                   "log:GetJob",
                   "log:DeleteJob",
                   "log:UpdateJob",
                   "log:PostLogStoreLogs",
                   "log:CreateSortedSubStore",
                   "log:GetSortedSubStore",
                   "log:ListSortedSubStore",
                   "log:UpdateSortedSubStore",
                   "log:DeleteSortedSubStore",
                   "log:CreateApp",
                   "log:UpdateApp",
                   "log:GetApp",
                   "log:DeleteApp",
                   "cs:DescribeTemplates",
                   "cs:DescribeTemplateAttribute"
               ],
               "Resource": [
                   "*"
               ],
               "Effect": "Allow"
           }
       ]
   }

3. Manage RAM user permissions.

4. Create an AccessKey for the RAM user.

   Warning

   For enhanced security, configure a network access control policy for the AccessKey to restrict access to trusted network environments and improve security. For more information, see AccessKey-based network access restriction policies.

5. Use the AccessKey pair to create a Secret named alibaba-addon-secret in the registered cluster.

   Create the Secret used by the logtail-ds add-on:

   kubectl -n kube-system create secret generic alibaba-addon-secret --from-literal='access-key-id=<your AccessKey ID>' --from-literal='access-key-secret=<your AccessKey Secret>'

   <your AccessKey ID> and <your AccessKey Secret> are the AccessKey ID and AccessKey secret that you obtained in the previous step.

Install by using onectl

Install the logtail-ds add-on:

onectl addon install logtail-ds

Expected output:

Addon logtail-ds, version **** installed.

Install by using the console

1. Log on to the ACK console. In the left navigation pane, click Clusters.

2. On the Clusters page, click the name of your cluster. In the left navigation pane, click Add-ons .

3. On the Add-ons page, click the Logs and Monitoring tab. Find the logtail-ds add-on and click Install in the lower-right corner of the card.

4. In the Note dialog box, click OK.

Text logs

To collect text logs from all pods in the cluster, connect to the registered cluster by using kubectl and then deploy the following configuration:

apiVersion: log.alibabacloud.com/v1alpha1
kind: AliyunLogConfig
metadata:
  name: test-file                  # The name of the resource. The name must be unique in the current Kubernetes cluster.
spec:
  project: k8s-log-c326bc86****    # Optional. The name of the project. The name can be customized. (Recommended) Name the project in the [k8s-log-<cluster ID>] format.
  logstore: test-file              # Required. The name of the Logstore. If the Logstore does not exist, SLS automatically creates it.
  logtailConfig:                   # Logtail configuration.
    inputType: file                # The type of the data source to collect. The value file indicates text logs, and the value plugin indicates stdout.
    configName: test-file          # Logtail configuration name. The name must be the same as the resource name specified by metadata.name.
    inputDetail:                   # Logtail configuration details.
      logType: common_reg_log      # Collects text logs in simple mode.
      logPath: /log/               # The path where the log files are stored.
      filePattern: "*.log"         # The name of the log file. Wildcards are supported: asterisks (*) and question marks (?). Example: log_*.log.
      dockerFile: true             # To collect files in containers, set dockerFile to true.
      advanced:                    # The conditions used to filter containers.
        k8s:
          # Optional. The following filters are for demonstration only. To collect text logs from all pods in the cluster, delete these filters or replace them with your own rules.
          K8sNamespaceRegex: ^(default)$
          K8sPodRegex: '^(nginx-log-demo.*)$'
          K8sContainerRegex: ^(nginx-log-demo-0)$
          IncludeK8sLabel:
            job-name: "^(nginx-log-demo.*)$"

For more information about the parameters, see Logtail configurations (Legacy).

Stdout

To collect stdout from all pods in the cluster, connect to the registered cluster by using kubectl and then deploy the following configuration. After the configuration is deployed, a Logstore named stdout-logstore is automatically created and logs are collected into the Logstore.

apiVersion: log.alibabacloud.com/v1alpha1
kind: AliyunLogConfig
metadata:
  # The name of your configuration. The name must be unique in your Kubernetes cluster.
  name: stdout-collector
spec:
  # The name of the Logstore to which logs are uploaded.
  logstore: stdout-logstore
  # The details of the Logtail configuration.
  logtailConfig:
    # The input type for Docker stdout. Must be 'plugin'.
    inputType: plugin
    # The name of the Logtail configuration. Must match metadata.name.
    configName: stdout-collector
    inputDetail:
      plugin:
        inputs:
          -
            type: service_docker_stdout
            detail:
              # Collects stdout and stderr.
              Stdout: true
              Stderr: true
              # Collects the stdout of all containers except for those with the COLLECT_STDOUT_FLAG:false environment variable.