Skip to content

kubernetes-events.md

Latest commit

 

History

History
107 lines (77 loc) · 4.78 KB

kubernetes-events.md

File metadata and controls

107 lines (77 loc) · 4.78 KB
Raw
description Collect Kubernetes events

Kubernetes events

{% hint style="info" %} Supported event types: logs {% endhint %}

Kubernetes exports events through the API server. This input plugin lets you retrieve those events as logs and process them through the pipeline.

Configuration parameters

Key Description Default
db Set a database file to keep track of recorded Kubernetes events. none
db.journal_mode Set the journal mode for databases. Values: DELETE, TRUNCATE, PERSIST, MEMORY, WAL, OFF. WAL
db.locking Specify that the database will be accessed only by Fluent Bit. Enabling this feature helps increase performance when accessing the database but restricts external tools from querying the content. false
db.sync Set a database sync method. Values: extra, full, normal, off. normal
interval_nsec Set the reconnect interval (sub seconds: nanoseconds). 500000000
interval_sec Set the reconnect interval (seconds). 0
kube_ca_file Kubernetes TLS CA file. /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
kube_ca_path Kubernetes TLS CA path. none
kube_namespace Kubernetes namespace to query events from. Gets events from all namespaces by default. none
kube_request_limit Kubernetes limit parameter for events query. No limit applied when set to 0. 0
kube_retention_time Kubernetes retention time for events. 1h
kube_token_file Kubernetes authorization token file. /var/run/secrets/kubernetes.io/serviceaccount/token
kube_token_ttl Kubernetes token time to live, until it's read again from the token file. 10m
kube_url API Server endpoint. https://kubernetes.default.svc
kube_watch_timeout Maximum duration of a Kubernetes watch request, and the read idle timeout applied to the watch connection. Set to 0 to disable both timeouts. Available in Fluent Bit 5.1 and later. 10m
tls.debug Set TLS debug level: 0 (no debug), 1 (error), 2 (state change), 3 (info), and 4 (verbose). 0
tls.verify Enable or disable verification of TLS peer certificate. true
tls.vhost Set optional TLS virtual host. none

In Fluent Bit 3.1 or later, this plugin uses a Kubernetes watch stream instead of polling, and the interval_sec and interval_nsec parameters set how often the watch stream reconnects. In versions earlier than 3.1, the plugin polls the API server, and these parameters set the polling interval.

Watch connection lifetime

A watch connection can stop delivering events without closing, for example when a network device between Fluent Bit and the API server drops an idle connection. Fluent Bit would then hold a connection that never returns data.

To bound this, kube_watch_timeout sets a maximum lifetime for each watch request. Fluent Bit passes the value to the API server as the timeoutSeconds parameter, so the server closes the watch when the timeout elapses. Fluent Bit also applies the same value as a read idle timeout on its own HTTP client. It then opens a new watch and continues from the last resource version it recorded, so the reconnection doesn't miss events.

Setting kube_watch_timeout to 0 disables both timeouts and restores the previous behavior, where a watch connection stays open indefinitely.

Threading

This input always runs in its own thread.

Get started

Kubernetes service account

The Kubernetes service account used by Fluent Bit must have get, list, and watch permissions to namespaces and pods for the namespaces watched in the kube_namespace configuration parameter. If you're using the Helm chart to configure Fluent Bit, this role is included.

Basic configuration file

In the following configuration file, the Kubernetes events plugin collects events and exposes them through the standard output plugin on the console:

{% tabs %} {% tab title="fluent-bit.yaml" %}

service:
  flush: 1
  log_level: info
    
pipeline:
  inputs:
    - name: kubernetes_events
      tag: k8s_events
      kube_url: https://kubernetes.default.svc
      
  outputs:
    - name: stdout
      match: '*'

{% endtab %} {% tab title="fluent-bit.conf" %}

[SERVICE]
  Flush           1
  Log_Level       info

[INPUT]
  Name            kubernetes_events
  Tag             k8s_events
  Kube_URL        https://kubernetes.default.svc

[OUTPUT]
  Name            stdout
  Match           *

{% endtab %} {% endtabs %}

Event timestamp

Event timestamps are created from the first existing field, based on the following order of precedence:

  1. lastTimestamp
  2. firstTimestamp
  3. metadata.creationTimestamp