tencent cloud

Tencent Kubernetes Engine

Release Notes and Announcements
Release Notes
Announcements
Release Notes
Product Introduction
Overview
Strengths
Architecture
Scenarios
Features
Concepts
Native Kubernetes Terms
Common High-Risk Operations
Regions and Availability Zones
Service Regions and Service Providers
Open Source Components
Purchase Guide
Purchase Instructions
Purchase a TKE General Cluster
Purchasing Native Nodes
Purchasing a Super Node
Getting Started
Beginner’s Guide
Quickly Creating a Standard Cluster
Examples
Container Application Deployment Check List
Cluster Configuration
General Cluster Overview
Cluster Management
Network Management
Storage Management
Node Management
GPU Resource Management
Remote Terminals
Application Configuration
Workload Management
Service and Configuration Management
Component and Application Management
Auto Scaling
Container Login Methods
Observability Configuration
Ops Observability
Cost Insights and Optimization
Scheduler Configuration
Scheduling Component Overview
Resource Utilization Optimization Scheduling
Business Priority Assurance Scheduling
QoS Awareness Scheduling
Security and Stability
TKE Security Group Settings
Identity Authentication and Authorization
Application Security
Multi-cluster Management
Planned Upgrade
Backup Center
Cloud Native Service Guide
Cloud Service for etcd
TMP
TKE Serverless Cluster Guide
TKE Registered Cluster Guide
Use Cases
Cluster
Serverless Cluster
Scheduling
Security
Service Deployment
Network
Release
Logs
Monitoring
OPS
Terraform
DevOps
Auto Scaling
Containerization
Microservice
Cost Management
Hybrid Cloud
AI
Troubleshooting
Disk Full
High Workload
Memory Fragmentation
Cluster DNS Troubleshooting
Cluster kube-proxy Troubleshooting
Cluster API Server Inaccessibility Troubleshooting
Service and Ingress Inaccessibility Troubleshooting
Common Service & Ingress Errors and Solutions
Engel Ingres appears in Connechtin Reverside
CLB Ingress Creation Error
Troubleshooting for Pod Network Inaccessibility
Pod Status Exception and Handling
Authorizing Tencent Cloud OPS Team for Troubleshooting
CLB Loopback
API Documentation
History
Introduction
API Category
Making API Requests
Elastic Cluster APIs
Resource Reserved Coupon APIs
Cluster APIs
Third-party Node APIs
Relevant APIs for Addon
Network APIs
Node APIs
Node Pool APIs
TKE Edge Cluster APIs
Cloud Native Monitoring APIs
Scaling group APIs
Super Node APIs
Other APIs
Data Types
Error Codes
TKE API 2022-05-01
FAQs
TKE General Cluster
TKE Serverless Cluster
About OPS
Hidden Danger Handling
About Services
Image Repositories
About Remote Terminals
Event FAQs
Resource Management
Service Agreement
TKE Service Level Agreement
TKE Serverless Service Level Agreement
Contact Us
Glossary
DokumentasiTencent Kubernetes EngineApplication ConfigurationComponent and Application Management Add-On Managementtke-log-agent

tke-log-agent

PDF
Mode fokus
Ukuran font
Terakhir diperbarui: 2024-02-05 16:10:58

Overview

Component Overview

tke-log-agent is a Kubernetes cluster log collection component. It allows users to unobtrusively collect standard output logs from containers, log files within the containers, and node logs.

Resource objects deployed in the cluster

Kubernetes Object Name
Type
Resource Amount
Namespace
tke-log-agent
Daemonset
0.21C126M
kube-system
cls-provisioner
Deployment
0.1C64M
kube-system
logconfigs.cls.cloud.tencent.com
CustomResourceDefinition
-
-
cls-provisioner
ClusterRole
-
-
cls-provisioner
ClusterRoleBinding
-
-
cls-provisioner
ServiceAccount
-
kube-system
tke-log-agent
ClusterRole
-
-
tke-log-agent
ClusterRoleBinding
-
-
tke-log-agent
ServiceAccount
-
kube-system

Application scenarios

When the independent cluster initiates the audit log collection, it will by default install the tke-log-agent and collect the apiserver audit logs.
You can collect standard output logs from containers, log files within the containers, and node logs via the collection rules.

Component principle

1. After detecting that a user has created a collection rule, the cls-provisioner will generate a collection configuration from the CLS side and sync it to the CLS server side based on the configuration information of the collection rule.
2. The tke-log-agent maps log directories to a unified directory based on the collection rules.
3. The loglistener syncs with the CLS server side collection configuration, collecting and reporting logs to the CLS side based on the collection configuration.

Component Permissions Description

Note:
The Permission Scenarios section only lists the permissions related to the core features of the components, for a complete permission list, please refer to the Permission Definition.

Log-Agent Permission

Permission Description

The permission of this component is the minimal dependency required for the current feature to operate.
Only standard clusters with log collection enabled will deploy this component, other types of clusters will not deploy.
It requires read and write capabilities in the host directory for metadata files, thus the activation of privileged-level containers is required.

Permission Scenarios

Feature
Involved Object
Involved Operation Permission
Monitoring changes in the log collection rules
logconfig/logconfigpro
watch/patch/get
Obtaining runtime types of the nodes
node
list/watch/get
When collecting logs within the standard output logs/containers, it is required to collect logs from specific namespace pods.
namespace/pod
list/watch/get
When collecting logs within the containers, it is required to obtain the actual storage path of the container logs.
PV/PVC
list/watch/get
SC
get
Collecting relevant logs related to workloads
Workloads
list/watch/get

Permission Definition

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: tke-log-agent
rules:
  - apiGroups: ["cls.cloud.tencent.com"]
    resources: ["logconfigs","logconfigpros"]
    verbs: ["list", "watch", "patch","get"]
  - apiGroups: [""]
    resources: ["pods", "namespaces", "nodes", "persistentvolumeclaims","configmaps","persistentvolumes"]
    verbs: ["list", "watch", "get"]
  - apiGroups: ["apps"]
    resources: ["daemonsets","replicasets","deployments","statefulsets"]
    verbs: ["list", "watch", "get"]
  - apiGroups: ["batch"]
    resources: ["jobs","cronjobs"]
    verbs: ["list", "watch", "get"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["storageclasses"]
    verbs: ["get"]

cls-provisioner Permission

Permission Description

The permission of this component is the minimal dependency required for the current feature to operate.

Permission Scenarios

Feature
Involved Object
Involved Operation Permission
Synchronizing the rule content of log config to the CLS side
logconfig
list/watch/patch/update

Permission Definition

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cls-provisioner
rules:
- apiGroups:
  - cls.cloud.tencent.com
  resources:
  - logconfigs
  verbs:
  - list
  - watch
  - patch
  - update
- apiGroups:
  - '*'
  resources:
  - events
  - configmaps
  verbs:
  - create
  - patch
  - update

Related Links

Enabling Log Collection
Configuring Log Collection via the Console
Configuring Log Collection via Yaml
Using CRD to Collect Logs to Kafka

Topik sebelumnya: Cluster AutoscalerTopik selanjutnya: Description of tke-monitor-agent

Bantuan dan Dukungan

Apakah halaman ini membantu?

masukan