在 Openshift 集群上使用 日志记录代理 图表部署 Helm 的模板

metadata:
  name: "logs-agent"
image:
  version: "1.3.0"  # required

clusterName: ""     # Enter the name of your cluster. This information is used to improve the metadata and help with your filtering.

env:
  # ingestionHost is a required field. For example:
  # ingestionHost: "<logs instance>.ingress.us-east.logs.cloud.ibm.com"
  ingestionHost: "" # required

  # If you are using private CSE proxy, then use port number "3443"
  # If you are using private VPE Gateway, then use port number "443"
  # If you are using the public endpoint, then use port number "443"
  ingestionPort: "" # required

  iamMode: "TrustedProfile"
  # trustedProfileID - trusted profile id - required if iamMode is set to "TrustedProfile"
  trustedProfileID: ""

  # Configure this parameter to control the IAM endpoint used by the agent to exchange the tokens.
  # If omitted, the default value is "Production".
  # Valid values are :
  # "Production" to use the iam.cloud.ibm.com default endpoint
  # "PrivateProduction" to use the private.iam.cloud.ibm.com endpoint
  # "Custom" to use a custom provided IAM endpoint
  iamEnvironment: "Production"
  # iamHost - custom IAM endpoint (for example: private.eu-de.iam.cloud.ibm.com) - required if iamEnvironment is set to "Custom"
  iamHost: ""

scc:
  # true enables creation of Security Context Constraints in Openshift clusters
  create: true

defaultMetadata:
  # Configure to override the default subsystemName and applicationName that are used in the environment.
  subsystemName: ""  # The default value is set to the namespace that generated the log
  applicationName: ""  # The default value is set to the container name that generated the log

resources:
  # Configure this section to change the resources that are assigned to the agent container.
  limits:
    cpu: 500m
    ephemeral_storage: 10Gi
    memory: 3Gi
  requests:
    cpu: 100m
    ephemeral_storage: 2Gi
    memory: 1Gi

# Configure these parameters to include, exclude or restrict the set of logs that are processed by the agent
# By default, the agent will collect the logs from `/var/log/containers/*.log`.
# Each field is set as comma separated list, for example “/var/log/abc/*.log,/var/log/xyz/*.log”
additionalLogSourcePaths: "" # adds locations to the default set of logs that will be processed.
excludeLogSourcePaths: "" # ignores logs in the specified locations.
selectedLogSourcePaths: ""  # overrides the default path `/var/log/containers/*.log` and ignores the `additionalLogSourcePaths` configurations

# Configure this parameter to change the setting for the Kubernetes filter to include the annotations from Kubernetes with the log records.
# The default value for this setting is `false`.
includeAnnotations: true

# Configure this parameter to control the number of times the agent will retry sending data if an error occurs that is considered to be retryable.
# The default is `False`.
# For more information, see the [Fluentbit documentation about retries](https://docs.fluentbit.io/manual/administration/scheduling-and-retries) to understand the implications of setting this value.
retryLimit: False

# Configure additional tags as key/value pair tags that can be added as metadata to every log line.
additionalMetadata:
#  region: ca-tor
#  env: production

# Configure the level of logging
# Default value is info
# Valid values are: debug, info, or error
loggingLevel: info

使用 Helm 图表在 Kubernetes 集群上部署 日志记录代理 的模板

metadata:
  name: "logs-agent"
image:
  version: "1.3.0"  # required

clusterName: ""     # Enter the name of your cluster. This information is used to improve the metadata and help with your filtering.

env:
  # ingestionHost is a required field. For example:
  # ingestionHost: "<logs instance>.ingress.us-east.logs.cloud.ibm.com"
  ingestionHost: "" # required

  # If you are using private CSE proxy, then use port number "3443"
  # If you are using private VPE Gateway, then use port number "443"
  # If you are using the public endpoint, then use port number "443"
  ingestionPort: "" # required

  iamMode: "TrustedProfile"
  # trustedProfileID - trusted profile id - required for iam trusted profile mode
  trustedProfileID: "" # required if iamMode is set to TrustedProfile

  # Configure this parameter to control the IAM endpoint used by the agent to exchange the tokens.
  # If omitted, the default value is "Production".
  # Valid values are :
  # "Production" to use the iam.cloud.ibm.com default endpoint
  # "PrivateProduction" to use the private.iam.cloud.ibm.com endpoint
  # "Custom" to use a custom provided IAM endpoint
  iamEnvironment: "Production"
  # iamHost - custom IAM endpoint (for example: private.eu-de.iam.cloud.ibm.com) - required if iamEnvironment is set to "Custom"
  iamHost: ""

scc:
  # true enables creation of Security Context Constraints in Openshift clusters
  # set to false for Kubernetes clusters
  create: false

defaultMetadata:
  # Configure to override the default subsystemName and applicationName that are used in the environment.
  subsystemName: ""  # The default value is set to the namespace that generated the log
  applicationName: ""  # The default value is set to the container name that generated the log

resources:
  # Configure this section to change the resources that are assigned to the agent container.
  limits:
    cpu: 500m
    ephemeral_storage: 10Gi
    memory: 3Gi
  requests:
    cpu: 100m
    ephemeral_storage: 2Gi
    memory: 1Gi

# Configure these parameters to include, exclude or restrict the set of logs that are processed by the agent
# By default, the agent will collect the logs from `/var/log/containers/*.log`.
# Each field is set as comma separated list, for example “/var/log/abc/*.log,/var/log/xyz/*.log”
additionalLogSourcePaths: "" # adds locations to the default set of logs that will be processed.
excludeLogSourcePaths: "" # ignores logs in the specified locations.
selectedLogSourcePaths: ""  # overrides the default path `/var/log/containers/*.log` and ignores the `additionalLogSourcePaths` configurations

# Configure this parameter to change the setting for the Kubernetes filter to include the annotations from Kubernetes with the log records.
# The default value for this setting is `false`.
includeAnnotations: true

# Configure this parameter to control the number of times the agent will retry sending data if an error occurs that is considered to be retryable.
# The default is `False`.
# For more information, see the [Fluentbit documentation about retries](https://docs.fluentbit.io/manual/administration/scheduling-and-retries) to understand the implications of setting this value.
retryLimit: False

# Configure additional tags as key/value pair tags that can be added as metadata to every log line.
additionalMetadata:
#  region: ca-tor
#  env: production

# Configure the level of logging
# Default value is info
# Valid values are: debug, info, or error
loggingLevel: info

Helm 图表配置选项

下表包含您可以在 logs-values.yaml 文件中配置的参数列表，用于调整 日志记录代理 配置：

env.iamMode

配置此参数可选择代理向 IBM Cloud Logs 实例发送日志时使用的身份验证方法。

• 您可以选择 IAM APIKey 或受信任的配置文件配置。
• 有效值为 TrustedProfile 或 IAMAPIKey
• 默认值为可信配置文件配置。

logs-values.yaml 文件中的条目如下：

env:
  iamMode: IAMAPIKey

设置该参数时应考虑以下信息：

• 如果设置了 env.iamMode: "TrustedProfile"，则还必须提供 env.trustedProfileID 变量。

• 如果设置了 env.iamMode: "IAMAPIKey"，则配置希望定义一个包含 IAM Apikey 和权限的秘密。

  如果helm命令中提供了 secret.iamAPIKey 变量（例如 --set secret.iamAPIKey=<your iamAPIKey> ），则helm chart将创建 Kubernetes 密钥。

  或者，您也可以使用该命令提前创建秘密：(确保已连接到群集）

  kubectl create secret generic <helm install-name> -n ibm-observe --from-literal=IAM_API_KEY=<apikey>
  

defaultMetadata

该部分允许用户覆盖环境中使用的默认 subsystemName 和 applicationName。 默认情况下不设置这些值，输出插件将动态设置这些值：

• subsystemName: 生成日志的 Kubernetes 命名空间
• applicationName: 生成日志的容器名称

logs-values.yaml 文件中的条目如下：

defaultMetadata:
  subsystemName: ""
  applicationName: ""

资源

本节允许用户更改分配给 日志记录代理 容器的资源。

logs-values.yaml 文件中的条目如下，并设置了以下默认值：

resources:
  limits:
    cpu: 500m
    ephemeral_storage: 10Gi
    memory: 3Gi
  requests:
    cpu: 100m
    ephemeral_storage: 2Gi
    memory: 1Gi

如果需要更新任何值，即使不更新所有值，也必须提供整个配置。

日志源路径配置

默认情况下，代理将从 /var/log/containers/*.log 收集日志。

可提供以下附加变量来包含、排除或限制要处理的日志集：

• additionalLogSourcePaths 将位置添加到要处理的默认日志集中。
• excludeLogSourcePaths 忽略指定位置的日志。
• selectedLogSourcePaths 覆盖默认路径 /var/log/containers/*.log 并忽略 additionalLogSourcePaths 配置。 代理只收集通过该参数设置的文件。

您可以使用逗号分隔的列表定义多个路径，例如"/var/log/abc/.log,/var/log/xyz/.log"。

logs-values.yaml 文件中的条目如下：

# comma separated list, for example “/var/log/abc/*.log,/var/log/xyz/*.log”
additionalLogSourcePaths: ""
excludeLogSourcePaths: ""
selectedLogSourcePaths: ""

env.iamEnvironment

此配置可控制代理用来交换令牌的 IAM 端点。

默认值为 Production。

有效值为：

• 设置 Production 以使用 iam.cloud.ibm.com 默认端点
• 设置 PrivateProduction 以使用 private.iam.cloud.ibm.com 端点
• 设置 Custom 以使用自定义IAM终端（例如 private.eu-de.iam.cloud.ibm.com ）

logs-values.yaml 文件中的条目如下：

env:
  iamEnvironment: "Production"

对于 Custom iamEnvironment 设置，还必须提供 iamHost。

env:
  iamEnvironment: "Custom"
  iamHost: "private.eu-de.iam.cloud.ibm.com"

includeAnnotations

此配置可更改 Kubernetes 过滤器的设置，以便在日志记录中包含来自 Kubernetes 的注释。

该设置的默认值为 false。

logs-values.yaml 文件中的条目如下：

includeAnnotations: true

retryLimit

如果出现可重试的错误，该配置会限制代理重试发送数据的次数。

缺省值为 False。

有关更多信息，请参阅 Fluentbit 有关重试的文档，以了解设置此值的意义。

在某些情况下，该设置可能会导致代理因无法发送而丢弃日志数据。

logs-values.yaml 文件中的条目如下：

retryLimit: 8

additionalMetadata

这是一个键/值对列表，将添加到 meta 对象下，以允许附加标记。

logs-values.yaml 文件中的条目如下：

additionalMetadata:
  region: ca-tor
  env: production

上述示例将导致在 IBM Cloud Logs 中的每行日志中添加以下附加字段：

{
  "meta": {
    "region": "ca-tor",
    "env": "production"
  }
}