filebeat 边车采集获取pod信息研究

filebeat 边车采集获取pod信息研究

k8s有一个downward API，其目的是容器可以知道一些自己的信息，但又不需要跟k8s过度耦合，有两种方式可以将Pod和Container的信息暴漏给运行中的容器。

• Environment variables
• DownwardAPI Volume Files

可能是觉得环境变量的表达力不够丰富，k8s又引入了第二个Downward API类型的volume，这样可以将信息以文件的形式挂到容器里去，相比环境变量可能会比较啰嗦。

上述两种方式的差异

都支持传递如下信息

• The Node’s name
• The Node’s IP
• The Pod’s name
• The Pod’s namespace
• The Pod’s IP address
• The Pod’s service account name
• The Pod’s UID
• A Container’s CPU limit
• A Container’s CPU request
• A Container’s memory limit
• A Container’s memory request

downwardAPI卷还支持传递如下信息

• The Pod’s labels
• The Pod’s annotations

---

综上可知要想在pod内部获取该pod的labels信息需使用DownwardAPI Volume Files

通过环境变量的方式获取一些信息示例

1.在应用部署文件busi-app.yaml中增加如下配置

env:
    - name: MY_POD_UID
      valueFrom:
        fieldRef:
          fieldPath: metadata.uid
    - name: MY_NODE_NAME
      valueFrom:
        fieldRef:
          fieldPath: spec.nodeName
    - name: MY_NODE_IP
      valueFrom:
        fieldRef:
          fieldPath: status.hostIP
    - name: MY_POD_NAME
      valueFrom:
        fieldRef:
          fieldPath: metadata.name
    - name: MY_POD_NAMESPACE
      valueFrom:
        fieldRef:
          fieldPath: metadata.namespace
    - name: MY_POD_IP
      valueFrom:
        fieldRef:
          fieldPath: status.podIP

2.在filebeat配置文件busi-app-filebeat-configmap.yaml中增加如下配置

     fields:
        POD_NAME: '${MY_POD_NAME}'
        NODE_IP: '${MY_NODE_IP}'
        POD_IP: '${MY_POD_IP}'
        NODE_NAME: '${MY_NODE_NAME}'
        POD_NAMESPACE: '${MY_POD_NAMESPACE}'

3.创建filebeat配置

kubectl apply -f busi-app-filebeat-configmap.yaml

4.创建应用

kubectl apply -f busi-app.yaml

5.观察filebeat发送到kafka队列中的消息包含了如下信息

"fields": {
	"POD_IP": "100.74.51.17",
	"NODE_NAME": "host-172-18-234-34",
	"POD_NAMESPACE": "default",
	"POD_NAME": "busi-app-5f64fc46f9-cl626",
	"NODE_IP": "172.18.234.34"
}

通过DownwardAPI的方式获取pod标签信息示例

1.在应用部署文件busi-app.yaml中增加如下配置


2.创建filebeat配置

kubectl apply -f busi-app-filebeat-configmap.yaml

3.创建应用

kubectl apply -f busi-app.yaml

4.进入到filebeat容器中

docker exec -it 90ec03412985 /bin/sh

5.执行如下命令查看挂载的pod标签信息

more /usr/local/filebeat742/podinfo/labels 

那么最后filebeat怎样获取挂载的labels信息？

1.在filebeat运行前写个脚本把/usr/local/filebeat742/podinfo/labels里的信息处理下放入环境变量，然后filebeat即可通过自定义字段从环境变量里读取到；

2.filebeat自定义字段是否支持其他什么读取自定义字段值的方式呢？不得而知！

附件

1.busi-app-filebeat-configmap.yaml 文件内容

apiVersion: v1
kind: ConfigMap
metadata:
  name: busi-app-filebeat-configmap
data:
  filebeat.yml: |
   filebeat.inputs:
   - type: log
     enabled: true
     paths: '/log/log.log'
     fields:
        POD_NAME: '${MY_POD_NAME}'
        NODE_IP: '${MY_NODE_IP}'
        POD_IP: '${MY_POD_IP}'
        NODE_NAME: '${MY_NODE_NAME}'
        POD_NAMESPACE: '${MY_POD_NAMESPACE}'
   #============================= Filebeat modules ===============================
   filebeat.config.modules:
     path: ${path.config}/modules.d/*.yml
     reload.enabled: false
   #----------------------------- Kafka output --------------------------------
   output.kafka:
     enabled: true
     hosts: ["172.18.234.105:9092", "172.18.234.106:9092", "172.18.234.107:9092"]
     topic: 'in_filelog_01'
     partition.round_robin:
       reachable_only: true
     worker: 2
     required_acks: 1
     compression: gzip
     max_message_bytes: 1000000 # 10MB
   #================================ Processors =====================================
   processors:
     - add_fields:
         target: ulmp
         fields:
           inkey: 'inkey_wjl'
           client_ip: '172.18.234.34'
     - add_locale: ~
     - add_host_metadata:
         netinfo.enabled: true

2.busi-app.yaml 文件内容

apiVersion: apps/v1
kind: Deployment
metadata:
  name: busi-app
  namespace: default
  labels:
     k8s-app: busi-app
     app-timestamp: busi-app
spec:
  selector:
    matchLabels:
      k8s-app: busi-app
      app-timestamp: busi-app
  replicas: 1
  template:
    metadata:
      labels:
        k8s-app: busi-app
        app-timestamp: busi-app
    spec:
      containers:
        - image: '172.18.231.33:5000/yi-yuan/filebeat742:latest'
          resources:
           limits:
            memory: "1Gi"
            cpu: "800m" 
           requests:
            memory: "700Mi"
            cpu: "400m"
          name: filebeat
          volumeMounts:
            - name: app-logs
              mountPath: /log
            - name: filebeat-config
              mountPath: /usr/local/filebeat742/config
            - name: podinfo
              mountPath: /usr/local/filebeat742/podinfo
              readOnly: false
          command:
            - /usr/local/filebeat742/filebeat
            - '-e'
            - '-c'
            - /usr/local/filebeat742/config/filebeat.yml
          env:
            - name: MY_POD_UID
              valueFrom:
                fieldRef:
                  fieldPath: metadata.uid
            - name: MY_NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: MY_NODE_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.hostIP
            - name: MY_POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: MY_POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: MY_POD_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP
        - image: '172.18.231.33:5000/yi-yuan/wsg-log-server-2.2.0:latest'
          resources:
           limits:
            memory: "1Gi"
            cpu: "800m" 
           requests:
            memory: "700Mi"
            cpu: "400m"
          name: app
          volumeMounts:
            - name: app-logs
              mountPath: /var/log/
      volumes:
        - name: app-logs
          emptyDir: {}
        - name: filebeat-config
          configMap:
            name: busi-app-filebeat-configmap
        - name: podinfo
          downwardAPI:
           items:
            - path: "labels"
              fieldRef:
               fieldPath: metadata.labels