loki + promtail new monitoring services

monitoring/promtail.yaml

@@ -0,0 +1,138 @@
+# Promtail — DaemonSet that tails pod logs on every node and ships them to Loki.
+#
+# Runs on ALL nodes (amd64 + arm). Multi-arch image. Reads /var/log/pods/*,
+# attaches k8s labels (namespace, pod, container), ships to loki.monitoring:3100.
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: promtail
+  namespace: monitoring
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: promtail
+rules:
+  - apiGroups: [""]
+    resources:
+      - nodes
+      - nodes/proxy
+      - services
+      - endpoints
+      - pods
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: promtail
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: promtail
+subjects:
+  - kind: ServiceAccount
+    name: promtail
+    namespace: monitoring
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: promtail-config
+  namespace: monitoring
+data:
+  promtail.yaml: |
+    server:
+      http_listen_port: 9080
+      grpc_listen_port: 0
+
+    positions:
+      filename: /tmp/positions.yaml
+
+    clients:
+      - url: http://loki.monitoring:3100/loki/api/v1/push
+
+    scrape_configs:
+      # Tail all container logs via /var/log/containers/*.log (symlinks to
+      # /var/log/pods/<ns>_<pod>_<uid>/<container>/<N>.log). Extract namespace,
+      # pod, container labels from the filename via pipeline_stages regex.
+      - job_name: kubernetes-containers
+        static_configs:
+          - targets:
+              - localhost
+            labels:
+              job: kube-containers
+              __path__: /var/log/containers/*.log
+        pipeline_stages:
+          - cri: {}
+          # k3s filename: <pod>_<namespace>_<container>-<hash>.log
+          - regex:
+              expression: '/var/log/containers/(?P<pod>[^_]+)_(?P<namespace>[^_]+)_(?P<container>[^-]+)-.*\.log'
+              source: filename
+          - labels:
+              pod:
+              namespace:
+              container:
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: promtail
+  namespace: monitoring
+  labels:
+    app: promtail
+spec:
+  selector:
+    matchLabels:
+      app: promtail
+  template:
+    metadata:
+      labels:
+        app: promtail
+    spec:
+      serviceAccountName: promtail
+      tolerations:
+        - operator: Exists   # run on every node including tainted Pis
+      containers:
+      - name: promtail
+        image: grafana/promtail:3.4.4
+        args:
+          - -config.file=/etc/promtail/promtail.yaml
+          - -config.expand-env=true
+        env:
+        - name: NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        volumeMounts:
+        - name: config
+          mountPath: /etc/promtail
+          readOnly: true
+        - name: positions
+          mountPath: /tmp
+        - name: pods-logs
+          mountPath: /var/log/pods
+          readOnly: true
+        - name: containers-logs
+          mountPath: /var/log/containers
+          readOnly: true
+        resources:
+          requests:
+            memory: "64Mi"
+            cpu: "50m"
+          limits:
+            memory: "256Mi"
+            cpu: "250m"
+      volumes:
+      - name: config
+        configMap:
+          name: promtail-config
+      - name: positions
+        emptyDir: {}
+      - name: pods-logs
+        hostPath:
+          path: /var/log/pods
+      - name: containers-logs
+        hostPath:
+          path: /var/log/containers