Splunk-connect-for-kubernetes: RBAC and Project based log routing to Splunk through HEC.

Created on 7 Aug 2019 · 3Comments · Source: splunk/splunk-connect-for-kubernetes

Hi All,

We have a centralised open shift cluster having many project teams deployment. How can we configure and ensure that only our project specific logs are pushed to the Splunk index that we mapped and not logs from all projects. We are not authorised to view the logs from other projects.
Regards,

Preetam

question

Source

nathpree

Most helpful comment

If you only want it from a specific namespace you can customize the fluentd source config:

https://github.com/splunk/splunk-connect-for-kubernetes/blob/e613504297371c844965c35942129411487aa91e/manifests/splunk-kubernetes-logging/configMap.yaml#L39-L55

The tail input allows you to use regex to define the path to only the files you want:

https://docs.fluentd.org/input/tail

For example, for the namespace foo you might set it like this:

path /var/log/containers/*_foo_*.log

Kubernetes embeds the pod namespace and container id in the path. This should allow you achieve what you want.

matthewmodestino on 7 Aug 2019

👍2

All 3 comments

We do not want the logs from all the projects deployed in a node, we want it only from our Project(Namespace). I am not sure if open shift have a centralized node / cluster level logging and if the logs could be segregated based on Project namespace.

nathpree on 7 Aug 2019

If you only want it from a specific namespace you can customize the fluentd source config:

https://github.com/splunk/splunk-connect-for-kubernetes/blob/e613504297371c844965c35942129411487aa91e/manifests/splunk-kubernetes-logging/configMap.yaml#L39-L55

The tail input allows you to use regex to define the path to only the files you want:

https://docs.fluentd.org/input/tail

For example, for the namespace foo you might set it like this: