517332653f
PodSecurityPolicies were removed in favour of Pod security standards
that are configured on a cluster or namespace level [1].
[1] https://kubernetes.io/blog/2022/08/25/pod-security-admission-stable/
Change-Id: Ia1e55c09bfad30fd209e96b3eddbda339edc31aa
301 lines
7.5 KiB
YAML
301 lines
7.5 KiB
YAML
#@ load("@ytt:data", "data")
|
|
|
|
## Affinity for pod assignment
|
|
## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
|
|
affinity: {}
|
|
|
|
annotations: {}
|
|
|
|
# The update strategy to apply to the DaemonSet
|
|
##
|
|
deploymentStrategy: {}
|
|
# rollingUpdate:
|
|
# maxUnavailable: 1
|
|
# type: RollingUpdate
|
|
|
|
initContainer:
|
|
enabled: false
|
|
fsInotifyMaxUserInstances: 128
|
|
|
|
image:
|
|
repository: grafana/promtail
|
|
tag: v1.3.0
|
|
pullPolicy: IfNotPresent
|
|
|
|
livenessProbe: {}
|
|
|
|
loki:
|
|
serviceName: #@ "loki-{}".format(data.values.namespace)
|
|
servicePort: 3100
|
|
serviceScheme: http
|
|
user:
|
|
password:
|
|
|
|
nameOverride: #@ "promtail-{}".format(data.values.namespace, data.values.namespace)
|
|
|
|
## Node labels for pod assignment
|
|
## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
|
|
nodeSelector: {}
|
|
|
|
pipelineStages:
|
|
- docker: {}
|
|
|
|
## Pod Labels
|
|
podLabels: {}
|
|
|
|
podAnnotations:
|
|
prometheus.io/scrape: "true"
|
|
prometheus.io/port: "http-metrics"
|
|
|
|
## Assign a PriorityClassName to pods if set
|
|
# priorityClassName:
|
|
|
|
rbac:
|
|
create: true
|
|
pspEnabled: false
|
|
|
|
readinessProbe:
|
|
failureThreshold: 5
|
|
httpGet:
|
|
path: /ready
|
|
port: http-metrics
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
successThreshold: 1
|
|
timeoutSeconds: 1
|
|
|
|
resources:
|
|
limits:
|
|
cpu: 200m
|
|
memory: 128Mi
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
|
|
# Custom scrape_configs to override the default ones in the configmap
|
|
scrapeConfigs:
|
|
- job_name: kubernetes-pods-monitoring
|
|
pipeline_stages:
|
|
- docker: {}
|
|
kubernetes_sd_configs:
|
|
- role: pod
|
|
relabel_configs:
|
|
- action: labeldrop
|
|
regex: '__meta_kubernetes_pod_label_app_kubernetes_io_.*'
|
|
- action: labeldrop
|
|
regex: '__meta_kubernetes_pod_label_statefulset_kubernetes_io_.*'
|
|
- action: labeldrop
|
|
regex: '__meta_kubernetes_pod_label_controller_revision_hash'
|
|
- action: labeldrop
|
|
regex: '__meta_kubernetes_pod_label_pod_template_.*'
|
|
- source_labels:
|
|
- __meta_kubernetes_pod_label_name
|
|
target_label: __service__
|
|
- source_labels:
|
|
- __meta_kubernetes_pod_node_name
|
|
target_label: __host__
|
|
- action: labelmap
|
|
regex: __meta_kubernetes_pod_label_(.+)
|
|
- action: replace
|
|
replacement: $1
|
|
separator: /
|
|
source_labels:
|
|
- __meta_kubernetes_namespace
|
|
- __meta_kubernetes_pod_label_app
|
|
- __service__
|
|
target_label: job
|
|
- action: replace
|
|
source_labels:
|
|
- __meta_kubernetes_namespace
|
|
target_label: namespace
|
|
- action: keep
|
|
regex: #@ data.values.namespace
|
|
source_labels:
|
|
- namespace
|
|
- action: replace
|
|
source_labels:
|
|
- release
|
|
target_label: chart_release
|
|
- action: replace
|
|
source_labels:
|
|
- __meta_kubernetes_pod_name
|
|
target_label: instance
|
|
- action: replace
|
|
source_labels:
|
|
- __meta_kubernetes_pod_container_name
|
|
target_label: container_name
|
|
- replacement: /var/log/pods/*$1/*.log
|
|
separator: /
|
|
source_labels:
|
|
- __meta_kubernetes_pod_uid
|
|
- __meta_kubernetes_pod_container_name
|
|
target_label: __path__
|
|
#@ for gerrit in data.values.gerritServers.kubernetes:
|
|
- job_name: #@ "kubernetes-pods-gerrit-{}".format(gerrit.namespace)
|
|
pipeline_stages:
|
|
- docker: {}
|
|
kubernetes_sd_configs:
|
|
- role: pod
|
|
relabel_configs:
|
|
- action: labeldrop
|
|
regex: '__meta_kubernetes_pod_label_pod_template_.*'
|
|
- source_labels:
|
|
- __meta_kubernetes_pod_label_name
|
|
target_label: __service__
|
|
- source_labels:
|
|
- __meta_kubernetes_pod_node_name
|
|
target_label: __host__
|
|
- action: labelmap
|
|
regex: __meta_kubernetes_pod_label_(.+)
|
|
- action: replace
|
|
replacement: $1
|
|
separator: /
|
|
source_labels:
|
|
- __meta_kubernetes_namespace
|
|
- __meta_kubernetes_pod_label_app
|
|
- __service__
|
|
target_label: job
|
|
- action: replace
|
|
source_labels:
|
|
- __meta_kubernetes_namespace
|
|
target_label: namespace
|
|
- action: keep
|
|
regex: #@ gerrit.namespace
|
|
source_labels:
|
|
- namespace
|
|
- source_labels:
|
|
- #@ "__meta_kubernetes_pod_label_{}".format(gerrit.label.name)
|
|
regex: #@ gerrit.label.value
|
|
action: keep
|
|
- action: replace
|
|
source_labels:
|
|
- release
|
|
target_label: chart_release
|
|
- action: replace
|
|
source_labels:
|
|
- __meta_kubernetes_pod_name
|
|
target_label: instance
|
|
- action: replace
|
|
source_labels:
|
|
- __meta_kubernetes_pod_container_name
|
|
target_label: container_name
|
|
- replacement: /var/log/pods/*$1/*.log
|
|
separator: /
|
|
source_labels:
|
|
- __meta_kubernetes_pod_uid
|
|
- __meta_kubernetes_pod_container_name
|
|
target_label: __path__
|
|
#@ end
|
|
|
|
# Custom scrape_configs together with the default ones in the configmap
|
|
extraScrapeConfigs: []
|
|
|
|
securityContext:
|
|
readOnlyRootFilesystem: true
|
|
runAsGroup: 0
|
|
runAsUser: 0
|
|
|
|
serviceAccount:
|
|
create: true
|
|
name: promtail
|
|
|
|
## Tolerations for pod assignment
|
|
## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/master
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
|
|
# Extra volumes to scrape logs from
|
|
volumes:
|
|
- name: docker
|
|
hostPath:
|
|
path: /var/lib/docker/containers
|
|
- name: pods
|
|
hostPath:
|
|
path: /var/log/pods
|
|
|
|
# Custom volumes together with the default ones
|
|
extraVolumes: []
|
|
|
|
volumeMounts:
|
|
- name: docker
|
|
mountPath: /var/lib/docker/containers
|
|
readOnly: true
|
|
- name: pods
|
|
mountPath: /var/log/pods
|
|
readOnly: true
|
|
|
|
# Custom volumeMounts together with the default ones
|
|
extraVolumeMounts: []
|
|
|
|
# Add extra Commandline args while starting up promtail.
|
|
# more info : https://github.com/grafana/loki/pull/1530
|
|
|
|
extraCommandlineArgs: []
|
|
# example:
|
|
# extraCommandlineArgs:
|
|
# - -client.external-labels=hostname=$(HOSTNAME)
|
|
|
|
config:
|
|
client:
|
|
# Maximum wait period before sending batch
|
|
batchwait: 1s
|
|
# Maximum batch size to accrue before sending, unit is byte
|
|
batchsize: 102400
|
|
|
|
# Maximum time to wait for server to respond to a request
|
|
timeout: 10s
|
|
|
|
backoff_config:
|
|
# Initial backoff time between retries
|
|
minbackoff: 100ms
|
|
# Maximum backoff time between retries
|
|
maxbackoff: 5s
|
|
# Maximum number of retries when sending batches, 0 means infinite retries
|
|
maxretries: 20
|
|
|
|
# The labels to add to any time series or alerts when communicating with loki
|
|
external_labels: {}
|
|
|
|
server:
|
|
http_listen_port: 3101
|
|
|
|
positions:
|
|
filename: /run/promtail/positions.yaml
|
|
target_config:
|
|
# Period to resync directories being watched and files being tailed
|
|
sync_period: 10s
|
|
|
|
serviceMonitor:
|
|
enabled: false
|
|
interval: ""
|
|
additionalLabels: {}
|
|
# scrapeTimeout: 10s
|
|
|
|
# Extra env variables to pass to the promtail container
|
|
env: []
|
|
|
|
# enable and configure if using the syslog scrape config
|
|
syslogService:
|
|
enabled: false
|
|
type: ClusterIP
|
|
port: 1514
|
|
## Specify the nodePort value for the LoadBalancer and NodePort service types.
|
|
## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport
|
|
##
|
|
# nodePort:
|
|
## Provide any additional annotations which may be required. This can be used to
|
|
## set the LoadBalancer service type to internal only.
|
|
## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer
|
|
##
|
|
annotations: {}
|
|
labels: {}
|
|
## Use loadBalancerIP to request a specific static IP,
|
|
## otherwise leave blank
|
|
##
|
|
loadBalancerIP:
|
|
# loadBalancerSourceRanges: []
|
|
## Set the externalTrafficPolicy in the Service to either Cluster or Local
|
|
# externalTrafficPolicy: Cluster
|