aws-samples / amazon-cloudwatch-container-insights

CloudWatch Agent Dockerfile and K8s YAML templates for CloudWatch Container Insights.
MIT No Attribution
162 stars 106 forks source link

Fluent-bit : Use Kubelet_Host and avoid enabling host networking #147

Open madappa-sharath opened 1 year ago

madappa-sharath commented 1 year ago

https://github.com/fluent/fluent-bit/issues/5143 added ability to communicate over host's IP and avoid using host networking feature. This a secure way where in network policies will be respected. The fluent-bit daemonset manifests at https://github.com/aws-samples/amazon-cloudwatch-container-insights/tree/main/k8s-deployment-manifest-templates/deployment-mode/daemonset/container-insights-monitoring/fluent-bit needs to be updated to use Kubelet_Host and disable host networking.

[FILTER]
    Name          kubernetes
    Match         kube.*
    Use_Kubelet   true
    Kubelet_Host  ${KUBELET_HOST}
 apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: fluent-bit
spec:
  template:
    spec:
      hostNetwork: false
      containers:
      - name: fluent-bit
         image: fluent/fluent-bit
         env:
         - name: KUBELET_HOST
            valueFrom:
              fieldRef:
                fieldPath: status.hostIP