mirror of
https://github.com/imjasonh/k8sless
synced 2026-07-07 00:23:28 +00:00
5775d33542
- Configure fluent-bit to collect containerd logs from /var/log/containers/ - Add google-logging-enabled and google-monitoring-enabled metadata flags - Add service account scopes for logging.write and monitoring.write - Add labels to VMs for easier log filtering (k8sless=true, pod-name, namespace) - Refactor cloud-init to use go:embed with separate cloud-init.yaml file - Update main.go to delete pod/VM 1 minute after becoming Running - Add .gitignore for k8sless binary Container logs now appear in Cloud Logging under logName k8sless_containers with proper timestamps and content extraction. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
81 lines
No EOL
2.5 KiB
YAML
81 lines
No EOL
2.5 KiB
YAML
#cloud-config
|
|
|
|
write_files:
|
|
- path: /etc/kubernetes/kubelet-config.yaml
|
|
permissions: '0644'
|
|
content: |
|
|
apiVersion: kubelet.config.k8s.io/v1beta1
|
|
kind: KubeletConfiguration
|
|
authentication:
|
|
webhook:
|
|
enabled: false
|
|
anonymous:
|
|
enabled: true
|
|
authorization:
|
|
mode: AlwaysAllow
|
|
staticPodPath: /etc/kubernetes/manifests
|
|
readOnlyPort: 10255
|
|
serverTLSBootstrap: false
|
|
clusterDNS: []
|
|
clusterDomain: ""
|
|
cgroupDriver: systemd
|
|
containerRuntimeEndpoint: unix:///run/containerd/containerd.sock
|
|
imageGCHighThresholdPercent: 85
|
|
imageGCLowThresholdPercent: 50
|
|
imageMinimumGCAge: 2m
|
|
healthzBindAddress: 0.0.0.0
|
|
healthzPort: 10248
|
|
|
|
- path: /etc/fluent-bit/fluent-bit-containerd.conf
|
|
permissions: '0644'
|
|
content: |
|
|
# Collect containerd/kubelet container logs
|
|
[INPUT]
|
|
Name tail
|
|
Tag k8sless_containers
|
|
Path /var/log/containers/*.log
|
|
DB /var/log/google-fluentbit/k8sless-containers.log.db
|
|
Read_from_Head True
|
|
Mem_Buf_Limit 5MB
|
|
Skip_Long_Lines On
|
|
|
|
[FILTER]
|
|
Name modify
|
|
Match k8sless_containers
|
|
Add k8sless true
|
|
Add resource.type gce_instance
|
|
|
|
- path: /etc/systemd/system/k8sless-kubelet.service
|
|
permissions: '0644'
|
|
content: |
|
|
[Unit]
|
|
Description=k8sless kubelet
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=notify
|
|
ExecStartPre=/bin/mkdir -p /etc/kubernetes/manifests
|
|
ExecStartPre=/bin/bash -c 'curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/attributes/podspec" | /usr/bin/python3 -m json.tool > /etc/kubernetes/manifests/pod.yaml'
|
|
ExecStart=/usr/bin/kubelet \
|
|
--config=/etc/kubernetes/kubelet-config.yaml \
|
|
--hostname-override=%H \
|
|
--pod-infra-container-image=gcr.io/google-containers/pause:3.9 \
|
|
--v=2
|
|
Restart=on-failure
|
|
RestartSec=10
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
|
|
runcmd:
|
|
- systemctl daemon-reload
|
|
- systemctl enable k8sless-kubelet.service
|
|
- systemctl start k8sless-kubelet.service
|
|
# Open firewall for kubelet read-only API
|
|
# NOTE: Alternative approaches could include SSH tunneling or a sidecar container
|
|
- iptables -A INPUT -p tcp --dport 10255 -j ACCEPT
|
|
- iptables -A INPUT -p tcp --dport 10248 -j ACCEPT
|
|
# Configure fluent-bit to collect containerd logs
|
|
- echo "@INCLUDE /etc/fluent-bit/fluent-bit-containerd.conf" >> /etc/fluent-bit/fluent-bit.conf
|
|
- systemctl restart fluent-bit |