K8S部署ELK

部署es

1. 下载es镜像

[root@k8s231.oldboyedu.com ~/elk]$ docker pull elasticsearch:7.17.5
[root@k8s231.oldboyedu.com ~/elk]$ docker images | grep elasticsearch
elasticsearch                                                       7.17.5          11df7a62573d   23 months ago   610MB
harbor.oldboyedu.com/project/elasticsearch                          7.17.5          11df7a62573d   23 months ago   610MB
[root@k8s231.oldboyedu.com ~/elk]$ docker save elasticsearch:7.17.5 -o elasticsearch_7_17_5.tar.gz # docker save ... -o ... 将镜像打包
[root@k8s231.oldboyedu.com ~/elk]$ ls
deploy-es.yaml  deploy-filebeat.yaml  deploy-kibana.yaml  elasticsearch_7_17_5.tar.gz  oldboyedu-elasticstack-es_7_17_5.tar.gz
[root@k8s231.oldboyedu.com ~/elk]$

2. 编写es资源

[root@k8s231.oldboyedu.com ~/elk]$ cat > deploy-es.yaml <<'EOF'
apiVersion: v1
kind: Namespace
metadata:
  name: oldboyedu-efk

---

apiVersion: apps/v1
kind: Deployment
metadata:
  name: elasticsearch
  namespace: oldboyedu-efk
  labels:
    k8s-app: elasticsearch
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: elasticsearch
  template:
    metadata:
      labels:
        k8s-app: elasticsearch
    spec:
      containers:
      # 指定需要安装的ES版本号
      # - image: elasticsearch:7.17.5
      - image: harbor.oldboyedu.com/project/elasticsearch:7.17.5
        name: elasticsearch
        resources:
          limits:
            cpu: 2
            memory: 3Gi
          requests:
            cpu: 0.5
            memory: 500Mi
        env:
          # 配置集群部署模式，此处我由于是实验，配置的是单点
          - name: "discovery.type"
            value: "single-node"
          - name: ES_JAVA_OPTS
            value: "-Xms512m -Xmx512m"
        ports:
        - containerPort: 9200
          name: db
          protocol: TCP
        volumeMounts:
        - name: elasticsearch-data
          mountPath: /usr/share/elasticsearch/data
      volumes:
      - name: elasticsearch-data
        persistentVolumeClaim:
          claimName: es-pvc

---

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: es-pvc
  namespace: oldboyedu-efk
spec:
  storageClassName: "managed-nfs-storage"
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 10Gi

---

apiVersion: v1
kind: Service
metadata:
  name: elasticsearch
  namespace: oldboyedu-efk
spec:
  ports:
  - port: 9200
    protocol: TCP
    targetPort: 9200
  selector:
    k8s-app: elasticsearch
EOF
[root@k8s231.oldboyedu.com ~/elk]$
[root@k8s231.oldboyedu.com ~/elk]$ kubectl apply -f deploy-es.yaml
[root@k8s231.oldboyedu.com ~/elk]$ cat deploy-es.yaml | grep namespace
  namespace: oldboyedu-efk
...
[root@k8s231.oldboyedu.com ~/elk]$ kubectl get pods -o wide -n oldboyedu-efk
NAME                            READY   STATUS    RESTARTS   AGE   IP            NODE                   NOMINATED NODE   READINESS GATES
elasticsearch-b648dd97f-zpwgf   1/1     Running   0          42s   10.100.1.33   k8s232.oldboyedu.com   <none>           <none>
[root@k8s231.oldboyedu.com ~/elk]$

部署kibana

1. 下载kibana镜像

[root@k8s231.oldboyedu.com ~/elk]$ docker pull kibana:7.17.5

2. 编写kibana资源

[root@k8s231.oldboyedu.com ~/elk]$ cat > deploy-kibana.yaml <<'EOF'
apiVersion: apps/v1
kind: Deployment
metadata:
  name: kibana
  namespace: oldboyedu-efk
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: kibana
  template:
    metadata:
      labels:
        k8s-app: kibana
    spec:
      containers:
      - name: kibana
        # image:  kibana:7.17.5
        image: harbor.oldboyedu.com/project/kibana:7.17.5
        resources:
          limits:
            cpu: 2
            memory: 2Gi
          requests:
            cpu: 0.5
            memory: 500Mi
        env:
          - name: ELASTICSEARCH_HOSTS
            value: http://elasticsearch.oldboyedu-efk.svc.oldboyedu.com:9200
          - name: I18N_LOCALE
            value: zh-CN
        ports:
        - containerPort: 5601
          name: ui
          protocol: TCP

---
apiVersion: v1
kind: Service
metadata:
  name: oldboyedu-kibana
  namespace: oldboyedu-efk
spec:
  # type: NodePort
  ports:
  - port: 5601
    protocol: TCP
    targetPort: ui
    # nodePort: 35601
  selector:
    k8s-app: kibana

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: oldboyedu-kibana-ing
  namespace: oldboyedu-efk
  annotations:
    kubernetes.io/ingress.class: traefik
spec:
  rules:
  - host: kibana.oldboyedu.com
    http:
      paths:
      - backend:
          service:
            name: oldboyedu-kibana
            port:
              number: 5601
        path: "/"
        pathType: "Prefix"
EOF
[root@k8s231.oldboyedu.com ~/elk]$
[root@k8s231.oldboyedu.com ~/elk]$ kubectl apply -f deploy-kibana.yaml
deployment.apps/kibana created
service/oldboyedu-kibana created
ingress.networking.k8s.io/oldboyedu-kibana-ing created

3. 验证及排错

[root@k8s231.oldboyedu.com ~/elk]$ kubectl get pods -o wide -n oldboyedu-efk # 查看pod信息

[root@k8s231.oldboyedu.com ~/elk]$ kubectl get svc -n oldboyedu-efk # 查看svc概要信息
[root@k8s231.oldboyedu.com ~/elk]$ kubectl describe svc -n oldboyedu-efk oldboyedu-kibana # 查看指定svc的具体信息

[root@k8s231.oldboyedu.com ~/elk]$ kubectl get ing -n oldboyedu-efk # 查看Ingress
[root@k8s231.oldboyedu.com ~/elk]$ kubectl describe ing -n oldboyedu-efk oldboyedu-kibana-ing

[root@k8s231.oldboyedu.com ~/elk]$

4. 网页验证
   须先修改hosts文件
   

部署filebeat

1. 下载filebeat镜像

[root@k8s231.oldboyedu.com ~/elk]$ docker pull elastic/filebeat:7.10.2

2. 编写filebeat资源

[root@k8s231.oldboyedu.com ~/elk]$ cat > deploy-filebeat.yaml <<'EOF'
apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-config
  namespace: oldboyedu-efk
  labels:
    k8s-app: filebeat
data:
  filebeat.yml: |-
    filebeat.config:
      inputs:
        # Mounted `filebeat-inputs` configmap:
        path: ${path.config}/inputs.d/*.yml
        # Reload inputs configs as they change:
        reload.enabled: false
      modules:
        path: ${path.config}/modules.d/*.yml
        # Reload module configs as they change:
        reload.enabled: false

    output.elasticsearch:
      # hosts: ['elasticsearch.oldboyedu-efk:9200']
      # hosts: ['elasticsearch.oldboyedu-efk.svc.oldboyedu.com:9200']
      hosts: ['elasticsearch:9200']
      # 不建议修改索引，因为索引名称该成功后，pod的数据也将收集不到啦!
      # 除非你明确知道自己不收集Pod日志且需要自定义索引名称的情况下，可以打开下面的注释哟~
      # index: 'oldboyedu-linux-elk-%{+yyyy.MM.dd}'

    # 配置索引模板
    # setup.ilm.enabled: false
    # setup.template.name: "oldboyedu-linux-elk"
    # setup.template.pattern: "oldboyedu-linux-elk*"
    # setup.template.overwrite: true
    # setup.template.settings:
    #   index.number_of_shards: 3
    #   index.number_of_replicas: 0

---

# 注意，官方在filebeat 7.2就已经废弃docker类型，建议后期更换为container.
apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-inputs
  namespace: oldboyedu-efk
  labels:
    k8s-app: filebeat
data:
  kubernetes.yml: |-
    - type: docker
      containers.ids:
      - "*"
      processors:
        - add_kubernetes_metadata:
            in_cluster: true

---

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: filebeat
  namespace: oldboyedu-efk
  labels:
    k8s-app: filebeat
spec:
  selector:
    matchLabels:
      k8s-app: filebeat
  template:
    metadata:
      labels:
        k8s-app: filebeat
    spec:
      tolerations:
      - key: node-role.kubernetes.io/master
        effect: NoSchedule
        operator: Exists
      serviceAccountName: filebeat
      terminationGracePeriodSeconds: 30
      containers:
      - name: filebeat
        # 注意官方的filebeat版本推荐使用"elastic/filebeat:7.10.2",
        # 如果高于该版本("elastic/filebeat:7.10.2")可能收集不到K8s集群的Pod相关日志指标哟~
        # 经过我测试，直到2022-04-01开源的7.12.2版本依旧没有解决该问题!
        # filebeat和ES版本可以不一致哈，因为我测试ES的版本是7.17.2
        #
        # 待完成: 后续可以尝试更新最新的镜像，并将输入的类型更换为container，因为docker输入类型官方在filebeat 7.2已废弃！
        # image: elastic/filebeat:7.10.2
        image: harbor.oldboyedu.com/project/filebeat:7.10.2
        args: [
          "-c", "/etc/filebeat.yml",
          "-e",
        ]
        # 出问题后可以用作临时调试，注意需要将args注释哟
        # command: ["sleep","3600"]
        securityContext:
          runAsUser: 0
          # If using Red Hat OpenShift uncomment this:
          #privileged: true
        resources:
          limits:
            memory: 200Mi
          requests:
            cpu: 100m
            memory: 100Mi
        volumeMounts:
        - name: config
          mountPath: /etc/filebeat.yml
          readOnly: true
          subPath: filebeat.yml
        - name: inputs
          mountPath: /usr/share/filebeat/inputs.d
          readOnly: true
        - name: data
          mountPath: /usr/share/filebeat/data
        - name: varlibdockercontainers
          mountPath: /var/lib/docker/containers
          readOnly: true
      volumes:
      - name: config
        configMap:
          defaultMode: 0600
          name: filebeat-config
      - name: varlibdockercontainers
        hostPath:
          path: /var/lib/docker/containers
      - name: inputs
        configMap:
          defaultMode: 0600
          name: filebeat-inputs
      # data folder stores a registry of read status for all files, so we don't send everything again on a Filebeat pod restart
      - name: data
        hostPath:
          path: /var/lib/filebeat-data
          type: DirectoryOrCreate

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: filebeat
subjects:
- kind: ServiceAccount
  name: filebeat
  namespace: oldboyedu-efk
roleRef:
  kind: ClusterRole
  name: filebeat
  apiGroup: rbac.authorization.k8s.io

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: filebeat
  labels:
    k8s-app: filebeat
rules:
- apiGroups: [""] # "" indicates the core API group
  resources:
  - namespaces
  - pods
  verbs:
  - get
  - watch
  - list

---

apiVersion: v1
kind: ServiceAccount
metadata:
  name: filebeat
  namespace: oldboyedu-efk
  labels:
    k8s-app: filebeat
EOF
[root@k8s231.oldboyedu.com ~/elk]$
[root@k8s231.oldboyedu.com ~/elk]$ kubectl apply -f deploy-filebeat.yaml
[root@k8s231.oldboyedu.com ~/elk]$ kubectl get pods -o wide -n oldboyedu-efk | grep filebeat
filebeat-dwwfb                  1/1     Running   0               13m    10.100.1.35   k8s232.oldboyedu.com   <none>           <none>
filebeat-gs6g8                  1/1     Running   0               13m    10.100.0.36   k8s231.oldboyedu.com   <none>           <none>
filebeat-l8vdk                  1/1     Running   0               103s   10.100.3.87   k8s233.oldboyedu.com   <none>           <none>
# 能看到每个节点都起了一个filebeat的pod，这就是ds资源的作用

3. 访问测试
   页面输出