tencent cloud

masukan

tke-log-agent

Terakhir diperbarui:2024-02-05 16:10:58

    Overview

    Component Overview

    tke-log-agent is a Kubernetes cluster log collection component. It allows users to unobtrusively collect standard output logs from containers, log files within the containers, and node logs.

    Resource objects deployed in the cluster

    Kubernetes Object Name
    Type
    Resource Amount
    Namespace
    tke-log-agent
    Daemonset
    0.21C126M
    kube-system
    cls-provisioner
    Deployment
    0.1C64M
    kube-system
    logconfigs.cls.cloud.tencent.com
    CustomResourceDefinition
    -
    -
    cls-provisioner
    ClusterRole
    -
    -
    cls-provisioner
    ClusterRoleBinding
    -
    -
    cls-provisioner
    ServiceAccount
    -
    kube-system
    tke-log-agent
    ClusterRole
    -
    -
    tke-log-agent
    ClusterRoleBinding
    -
    -
    tke-log-agent
    ServiceAccount
    -
    kube-system

    Application scenarios

    When the independent cluster initiates the audit log collection, it will by default install the tke-log-agent and collect the apiserver audit logs.
    You can collect standard output logs from containers, log files within the containers, and node logs via the collection rules.

    Component principle

    1. After detecting that a user has created a collection rule, the cls-provisioner will generate a collection configuration from the CLS side and sync it to the CLS server side based on the configuration information of the collection rule.
    2. The tke-log-agent maps log directories to a unified directory based on the collection rules.
    3. The loglistener syncs with the CLS server side collection configuration, collecting and reporting logs to the CLS side based on the collection configuration.

    Component Permissions Description

    Note:
    The Permission Scenarios section only lists the permissions related to the core features of the components, for a complete permission list, please refer to the Permission Definition.

    Log-Agent Permission

    Permission Description

    The permission of this component is the minimal dependency required for the current feature to operate.
    Only standard clusters with log collection enabled will deploy this component, other types of clusters will not deploy.
    It requires read and write capabilities in the host directory for metadata files, thus the activation of privileged-level containers is required.

    Permission Scenarios

    Feature
    Involved Object
    Involved Operation Permission
    Monitoring changes in the log collection rules
    logconfig/logconfigpro
    watch/patch/get
    Obtaining runtime types of the nodes
    node
    list/watch/get
    When collecting logs within the standard output logs/containers, it is required to collect logs from specific namespace pods.
    namespace/pod
    list/watch/get
    When collecting logs within the containers, it is required to obtain the actual storage path of the container logs.
    PV/PVC
    list/watch/get
    SC
    get
    Collecting relevant logs related to workloads
    Workloads
    list/watch/get

    Permission Definition

    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRole
    metadata:
    name: tke-log-agent
    rules:
    - apiGroups: ["cls.cloud.tencent.com"]
    resources: ["logconfigs","logconfigpros"]
    verbs: ["list", "watch", "patch","get"]
    - apiGroups: [""]
    resources: ["pods", "namespaces", "nodes", "persistentvolumeclaims","configmaps","persistentvolumes"]
    verbs: ["list", "watch", "get"]
    - apiGroups: ["apps"]
    resources: ["daemonsets","replicasets","deployments","statefulsets"]
    verbs: ["list", "watch", "get"]
    - apiGroups: ["batch"]
    resources: ["jobs","cronjobs"]
    verbs: ["list", "watch", "get"]
    - apiGroups: ["storage.k8s.io"]
    resources: ["storageclasses"]
    verbs: ["get"]

    cls-provisioner Permission

    Permission Description

    The permission of this component is the minimal dependency required for the current feature to operate.

    Permission Scenarios

    Feature
    Involved Object
    Involved Operation Permission
    Synchronizing the rule content of log config to the CLS side
    logconfig
    list/watch/patch/update

    Permission Definition

    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRole
    metadata:
    name: cls-provisioner
    rules:
    - apiGroups:
    - cls.cloud.tencent.com
    resources:
    - logconfigs
    verbs:
    - list
    - watch
    - patch
    - update
    - apiGroups:
    - '*'
    resources:
    - events
    - configmaps
    verbs:
    - create
    - patch
    - update

    Related Links

    
    Hubungi Kami

    Hubungi tim penjualan atau penasihat bisnis kami untuk membantu bisnis Anda.

    Dukungan Teknis

    Buka tiket jika Anda mencari bantuan lebih lanjut. Tiket kami tersedia 7x24.

    Dukungan Telepon 7x24