fluent / fluent-operator

Operate Fluent Bit and Fluentd in the Kubernetes way - Previously known as FluentBit Operator
Apache License 2.0
555 stars 229 forks source link

Add kubernetes events input plugin #1209

Closed smallc2009 closed 1 week ago

smallc2009 commented 2 weeks ago

What this PR does / why we need it:

This PR is to support Fluent Bit Kubernetes Event Input Plugin and allow to retrieve these events as logs. Doc: https://docs.fluentbit.io/manual/pipeline/inputs/kubernetes-events

Which issue(s) this PR fixes:

Fixes #1001

Does this PR introduced a user-facing change?

Fluent Operator supports kubernetes_events input plugin

Additional documentation, usage docs, etc.:

To use kubernetes_events input plugin, list permission is required to retrieve the events from API server. Therefore the ClusterRole has been updated. User need to add rbacRules in FluentBit configuration to grant the Fluent Bit ServiceAccount the ability to list Kubernetes events.

Below is an example configuration.

apiVersion: fluentbit.fluent.io/v1alpha2
kind: FluentBit
metadata:
  name: fluent-bit
  labels:
    app.kubernetes.io/name: fluent-bit
spec:
  rbacRules:
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["list"]
  image: kubesphere/fluent-bit:v2.2.2
  positionDB:
    hostPath:
      path: /var/lib/fluent-bit/  
  fluentBitConfigName: fluentbit-config
---
apiVersion: fluentbit.fluent.io/v1alpha2
kind: ClusterInput
metadata:
  name: kubernetes-events
  labels:
    app.kubernetes.io/name: fluent-bit
spec:
  alias: kubernetes-events
  kubernetesEvents:
    tag: kube_event
    intervalSec: 2
    #kubeURL/kubeCAFile/kubeTokenFile can be ignored, the input will use default value. refer to doc.
    kubeURL: https://kubernetes.default.svc:443
    kubeCAFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
    kubeTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
smallc2009 commented 1 week ago

We can see the Kubernetes Events messages in Standout and ElasticSearch respectively.

Stdout

image

Elasticsearch

image

benjaminhuo commented 1 week ago

We can see the Kubernetes Events messages in Standout and ElasticSearch respectively.

Great, thanks @smallc2009