# Promtail — DaemonSet that tails pod logs on every node and ships them to Loki.
#
# Runs on ALL nodes (amd64 + arm). Multi-arch image. Reads /var/log/pods/*,
# attaches k8s labels (namespace, pod, container), ships to loki.monitoring:3100.
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: promtail
  namespace: monitoring
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: promtail
rules:
  - apiGroups: [""]
    resources:
      - nodes
      - nodes/proxy
      - services
      - endpoints
      - pods
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: promtail
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: promtail
subjects:
  - kind: ServiceAccount
    name: promtail
    namespace: monitoring
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: promtail-config
  namespace: monitoring
data:
  promtail.yaml: |
    server:
      http_listen_port: 9080
      grpc_listen_port: 0

    positions:
      filename: /tmp/positions.yaml

    clients:
      - url: http://loki.monitoring:3100/loki/api/v1/push

    scrape_configs:
      # Tail all container logs via /var/log/containers/*.log (symlinks to
      # /var/log/pods/<ns>_<pod>_<uid>/<container>/<N>.log). Extract namespace,
      # pod, container labels from the filename via pipeline_stages regex.
      - job_name: kubernetes-containers
        static_configs:
          - targets:
              - localhost
            labels:
              job: kube-containers
              __path__: /var/log/containers/*.log
        pipeline_stages:
          - cri: {}
          # k3s filename: <pod>_<namespace>_<container>-<hash>.log
          - regex:
              expression: '/var/log/containers/(?P<pod>[^_]+)_(?P<namespace>[^_]+)_(?P<container>[^-]+)-.*\.log'
              source: filename
          - labels:
              pod:
              namespace:
              container:
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: promtail
  namespace: monitoring
  labels:
    app: promtail
spec:
  selector:
    matchLabels:
      app: promtail
  template:
    metadata:
      labels:
        app: promtail
    spec:
      serviceAccountName: promtail
      tolerations:
        - operator: Exists   # run on every node including tainted Pis
      containers:
      - name: promtail
        image: grafana/promtail:3.4.4
        args:
          - -config.file=/etc/promtail/promtail.yaml
          - -config.expand-env=true
        env:
        - name: NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        volumeMounts:
        - name: config
          mountPath: /etc/promtail
          readOnly: true
        - name: positions
          mountPath: /tmp
        - name: pods-logs
          mountPath: /var/log/pods
          readOnly: true
        - name: containers-logs
          mountPath: /var/log/containers
          readOnly: true
        resources:
          requests:
            memory: "64Mi"
            cpu: "50m"
          limits:
            memory: "256Mi"
            cpu: "250m"
      volumes:
      - name: config
        configMap:
          name: promtail-config
      - name: positions
        emptyDir: {}
      - name: pods-logs
        hostPath:
          path: /var/log/pods
      - name: containers-logs
        hostPath:
          path: /var/log/containers