#发文福利#
一、前言
kubernetes 1.23搭建EFK所用到的yaml文件，本帖均来自kubernetes官方，且没做修改。
https://github.com/kubernetes/kubernetes/tree/release-1.23/cluster/addons/fluentd-elasticsearch
二、EFK 原版yaml
1、create-logging-namespace.yaml
kind: Namespace
apiVersion: v1
metadata:name: logginglabels:k8s-app: loggingkubernetes.io/cluster-service: "true"addonmanager.kubernetes.io/mode: Reconcile2、es-service.yaml
apiVersion: v1
kind: Service
metadata:name: elasticsearch-loggingnamespace: logginglabels:k8s-app: elasticsearch-loggingkubernetes.io/cluster-service: "true"addonmanager.kubernetes.io/mode: Reconcilekubernetes.io/name: "Elasticsearch"
spec:clusterIP: Noneports:- name: dbport: 9200protocol: TCPtargetPort: 9200- name: transportport: 9300protocol: TCPtargetPort: 9300publishNotReadyAddresses: trueselector:k8s-app: elasticsearch-loggingsessionAffinity: Nonetype: ClusterIP3、es-statefulset.yaml
# RBAC authn and authz
apiVersion: v1
kind: ServiceAccount
metadata:name: elasticsearch-loggingnamespace: logginglabels:k8s-app: elasticsearch-loggingaddonmanager.kubernetes.io/mode: Reconcile
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:name: elasticsearch-logginglabels:k8s-app: elasticsearch-loggingaddonmanager.kubernetes.io/mode: Reconcile
rules:- apiGroups:- ""resources:- "services"- "namespaces"- "endpoints"verbs:- "get"
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:name: elasticsearch-logginglabels:k8s-app: elasticsearch-loggingaddonmanager.kubernetes.io/mode: Reconcile
subjects:- kind: ServiceAccountname: elasticsearch-loggingnamespace: loggingapiGroup: ""
roleRef:kind: ClusterRolename: elasticsearch-loggingapiGroup: ""
---
# Elasticsearch deployment itself
apiVersion: apps/v1
kind: StatefulSet
metadata:name: elasticsearch-loggingnamespace: logginglabels:k8s-app: elasticsearch-loggingversion: v7.10.2addonmanager.kubernetes.io/mode: Reconcile
spec:serviceName: elasticsearch-loggingreplicas: 2selector:matchLabels:k8s-app: elasticsearch-loggingversion: v7.10.2template:metadata:labels:k8s-app: elasticsearch-loggingversion: v7.10.2spec:serviceAccountName: elasticsearch-loggingcontainers:- image: quay.io/fluentd_elasticsearch/elasticsearch:v7.10.2name: elasticsearch-loggingimagePullPolicy: Alwaysresources:# need more cpu upon initialization, therefore burstable classlimits:cpu: 1000mmemory: 3Girequests:cpu: 100mmemory: 3Giports:- containerPort: 9200name: dbprotocol: TCP- containerPort: 9300name: transportprotocol: TCPlivenessProbe:tcpSocket:port: transportinitialDelaySeconds: 5timeoutSeconds: 10readinessProbe:tcpSocket:port: transportinitialDelaySeconds: 5timeoutSeconds: 10volumeMounts:- name: elasticsearch-loggingmountPath: /dataenv:- name: "NAMESPACE"valueFrom:fieldRef:fieldPath: metadata.namespace- name: "MINIMUM_MASTER_NODES"value: "1"volumes:- name: elasticsearch-loggingemptyDir: {}# Elasticsearch requires vm.max_map_count to be at least 262144.# If your OS already sets up this number to a higher value, feel free# to remove this init container.initContainers:- image: alpine:3.6command: ["/sbin/sysctl", "-w", "vm.max_map_count=262144"]name: elasticsearch-logging-initsecurityContext:privileged: true4、fluentd-es-configmap.yaml
kind: ConfigMap
apiVersion: v1
metadata:name: fluentd-es-config-v0.2.1namespace: logginglabels:addonmanager.kubernetes.io/mode: Reconcile
data:system.conf: |-<system>root_dir /tmp/fluentd-buffers/</system>containers.input.conf: |-# This configuration file for Fluentd / td-agent is used# to watch changes to Docker log files. The kubelet creates symlinks that# capture the pod name, namespace, container name & Docker container ID# to the docker logs for pods in the /var/log/containers directory on the host.# If running this fluentd configuration in a Docker container, the /var/log# directory should be mounted in the container.## These logs are then submitted to Elasticsearch which assumes the# installation of the fluent-plugin-elasticsearch & the# fluent-plugin-kubernetes_metadata_filter plugins.# See https://github.com/uken/fluent-plugin-elasticsearch &# https://github.com/fabric8io/fluent-plugin-kubernetes_metadata_filter for# more information about the plugins.## Example# =======# A line in the Docker log file might look like this JSON:## {"log":"2014/09/25 21:15:03 Got request with path wombat\n",# "stream":"stderr",# "time":"2014-09-25T21:15:03.499185026Z"}## The time_format specification below makes sure we properly# parse the time format produced by Docker. This will be# submitted to Elasticsearch and should appear like:# $ curl 'http://elasticsearch-logging:9200/_search?pretty'# ...# {# "_index" : "logstash-2014.09.25",# "_type" : "fluentd",# "_id" : "VBrbor2QTuGpsQyTCdfzqA",# "_score" : 1.0,# "_source":{"log":"2014/09/25 22:45:50 Got request with path wombat\n",# "stream":"stderr","tag":"docker.container.all",# "@timestamp":"2014-09-25T22:45:50+00:00"}# },# ...## The Kubernetes fluentd plugin is used to write the Kubernetes metadata to the log# record & add labels to the log record if properly configured. This enables users# to filter & search logs on any metadata.# For example a Docker container's logs might be in the directory:## /var/lib/docker/containers/997599971ee6366d4a5920d25b79286ad45ff37a74494f262e3bc98d909d0a7b## and in the file:## 997599971ee6366d4a5920d25b79286ad45ff37a74494f262e3bc98d909d0a7b-json.log## where 997599971ee6... is the Docker ID of the running container.# The Kubernetes kubelet makes a symbolic link to this file on the host machine# in the /var/log/containers directory which includes the pod name and the Kubernetes# container name:## synthetic-logger-0.25lps-pod_default_synth-lgr-997599971ee6366d4a5920d25b79286ad45ff37a74494f262e3bc98d909d0a7b.log# -># /var/lib/docker/containers/997599971ee6366d4a5920d25b79286ad45ff37a74494f262e3bc98d909d0a7b/997599971ee6366d4a5920d25b79286ad45ff37a74494f262e3bc98d909d0a7b-json.log## The /var/log directory on the host is mapped to the /var/log directory in the container# running this instance of Fluentd and we end up collecting the file:## /var/log/containers/synthetic-logger-0.25lps-pod_default_synth-lgr-997599971ee6366d4a5920d25b79286ad45ff37a74494f262e3bc98d909d0a7b.log## This results in the tag:## var.log.containers.synthetic-logger-0.25lps-pod_default_synth-lgr-997599971ee6366d4a5920d25b79286ad45ff37a74494f262e3bc98d909d0a7b.log## The Kubernetes fluentd plugin is used to extract the namespace, pod name & container name# which are added to the log message as a kubernetes field object & the Docker container ID# is also added under the docker field object.# The final tag is:## kubernetes.var.log.containers.synthetic-logger-0.25lps-pod_default_synth-lgr-997599971ee6366d4a5920d25b79286ad45ff37a74494f262e3bc98d909d0a7b.log## And the final log record look like:## {# "log":"2014/09/25 21:15:03 Got request with path wombat\n",# "stream":"stderr",# "time":"2014-09-25T21:15:03.499185026Z",# "kubernetes": {# "namespace": "default",# "pod_name": "synthetic-logger-0.25lps-pod",# "container_name": "synth-lgr"# },# "docker": {# "container_id": "997599971ee6366d4a5920d25b79286ad45ff37a74494f262e3bc98d909d0a7b"# }# }## This makes it easier for users to search for logs by pod name or by# the name of the Kubernetes container regardless of how many times the# Kubernetes pod has been restarted (resulting in a several Docker container IDs).# Json Log Example:# {"log":"[info:2016-02-16T16:04:05.930-08:00] Some log text here\n","stream":"stdout","time":"2016-02-17T00:04:05.931087621Z"}# CRI Log Example:# 2016-02-17T00:04:05.931087621Z stdout F [info:2016-02-16T16:04:05.930-08:00] Some log text here<source>@id fluentd-containers.log@type tailpath /var/log/containers/*.logpos_file /var/log/es-containers.log.postag raw.kubernetes.*read_from_head true<parse>@type multi_format<pattern>format jsontime_key timetime_format %Y-%m-%dT%H:%M:%S.%NZ</pattern><pattern>format /^(?<time>.+) (?<stream>stdout|stderr) [^ ]* (?<log>.*)$/time_format %Y-%m-%dT%H:%M:%S.%N%:z</pattern></parse></source># Detect exceptions in the log output and forward them as one log entry.<match raw.kubernetes.**>@id raw.kubernetes@type detect_exceptionsremove_tag_prefix rawmessage logstream streammultiline_flush_interval 5max_bytes 500000max_lines 1000</match># Concatenate multi-line logs<filter **>@id filter_concat@type concatkey messagemultiline_end_regexp /\n$/separator ""</filter># Enriches records with Kubernetes metadata<filter kubernetes.**>@id filter_kubernetes_metadata@type kubernetes_metadata</filter># Fixes json fields in Elasticsearch<filter kubernetes.**>@id filter_parser@type parserkey_name logreserve_data trueremove_key_name_field true<parse>@type multi_format<pattern>format json</pattern><pattern>format none</pattern></parse></filter>system.input.conf: |-# Example:# 2015-12-21 23:17:22,066 [salt.state ][INFO ] Completed state [net.ipv4.ip_forward] at time 23:17:22.066081<source>@id minion@type tailformat /^(?<time>[^ ]* [^ ,]*)[^\[]*\[[^\]]*\]\[(?<severity>[^ \]]*) *\] (?<message>.*)$/time_format %Y-%m-%d %H:%M:%Spath /var/log/salt/minionpos_file /var/log/salt.postag salt</source># Example:# Dec 21 23:17:22 gke-foo-1-1-4b5cbd14-node-4eoj startupscript: Finished running startup script /var/run/google.startup.script<source>@id startupscript.log@type tailformat syslogpath /var/log/startupscript.logpos_file /var/log/es-startupscript.log.postag startupscript</source># Examples:# time="2016-02-04T06:51:03.053580605Z" level=info msg="GET /containers/json"# time="2016-02-04T07:53:57.505612354Z" level=error msg="HTTP Error" err="No such image: -f" statusCode=404# TODO(random-liu): Remove this after cri container runtime rolls out.<source>@id docker.log@type tailformat /^time="(?<time>[^"]*)" level=(?<severity>[^ ]*) msg="(?<message>[^"]*)"( err="(?<error>[^"]*)")?( statusCode=($<status_code>\d+))?/path /var/log/docker.logpos_file /var/log/es-docker.log.postag docker</source># Example:# 2016/02/04 06:52:38 filePurge: successfully removed file /var/etcd/data/member/wal/00000000000006d0-00000000010a23d1.wal<source>@id etcd.log@type tail# Not parsing this, because it doesn't have anything particularly useful to# parse out of it (like severities).format nonepath /var/log/etcd.logpos_file /var/log/es-etcd.log.postag etcd</source># Multi-line parsing is required for all the kube logs because very large log# statements, such as those that include entire object bodies, get split into# multiple lines by glog.# Example:# I0204 07:32:30.020537 3368 server.go:1048] POST /stats/container/: (13.972191ms) 200 [[Go-http-client/1.1] 10.244.1.3:40537]<source>@id kubelet.log@type tailformat multilinemultiline_flush_interval 5sformat_firstline /^\w\d{4}/format1 /^(?<severity>\w)(?<time>\d{4} [^\s]*)\s+(?<pid>\d+)\s+(?<source>[^ \]]+)\] (?<message>.*)/time_format %m%d %H:%M:%S.%Npath /var/log/kubelet.logpos_file /var/log/es-kubelet.log.postag kubelet</source># Example:# I1118 21:26:53.975789 6 proxier.go:1096] Port "nodePort for kube-system/default-http-backend:http" (:31429/tcp) was open before and is still needed<source>@id kube-proxy.log@type tailformat multilinemultiline_flush_interval 5sformat_firstline /^\w\d{4}/format1 /^(?<severity>\w)(?<time>\d{4} [^\s]*)\s+(?<pid>\d+)\s+(?<source>[^ \]]+)\] (?<message>.*)/time_format %m%d %H:%M:%S.%Npath /var/log/kube-proxy.logpos_file /var/log/es-kube-proxy.log.postag kube-proxy</source># Example:# I0204 07:00:19.604280 5 handlers.go:131] GET /api/v1/nodes: (1.624207ms) 200 [[kube-controller-manager/v1.1.3 (linux/amd64) kubernetes/6a81b50] 127.0.0.1:38266]<source>@id kube-apiserver.log@type tailformat multilinemultiline_flush_interval 5sformat_firstline /^\w\d{4}/format1 /^(?<severity>\w)(?<time>\d{4} [^\s]*)\s+(?<pid>\d+)\s+(?<source>[^ \]]+)\] (?<message>.*)/time_format %m%d %H:%M:%S.%Npath /var/log/kube-apiserver.logpos_file /var/log/es-kube-apiserver.log.postag kube-apiserver</source># Example:# I0204 06:55:31.872680 5 servicecontroller.go:277] LB already exists and doesn't need update for service kube-system/kube-ui<source>@id kube-controller-manager.log@type tailformat multilinemultiline_flush_interval 5sformat_firstline /^\w\d{4}/format1 /^(?<severity>\w)(?<time>\d{4} [^\s]*)\s+(?<pid>\d+)\s+(?<source>[^ \]]+)\] (?<message>.*)/time_format %m%d %H:%M:%S.%Npath /var/log/kube-controller-manager.logpos_file /var/log/es-kube-controller-manager.log.postag kube-controller-manager</source># Example:# W0204 06:49:18.239674 7 reflector.go:245] pkg/scheduler/factory/factory.go:193: watch of *api.Service ended with: 401: The event in requested index is outdated and cleared (the requested history has been cleared [2578313/2577886]) [2579312]<source>@id kube-scheduler.log@type tailformat multilinemultiline_flush_interval 5sformat_firstline /^\w\d{4}/format1 /^(?<severity>\w)(?<time>\d{4} [^\s]*)\s+(?<pid>\d+)\s+(?<source>[^ \]]+)\] (?<message>.*)/time_format %m%d %H:%M:%S.%Npath /var/log/kube-scheduler.logpos_file /var/log/es-kube-scheduler.log.postag kube-scheduler</source># Example:# I0603 15:31:05.793605 6 cluster_manager.go:230] Reading config from path /etc/gce.conf<source>@id glbc.log@type tailformat multilinemultiline_flush_interval 5sformat_firstline /^\w\d{4}/format1 /^(?<severity>\w)(?<time>\d{4} [^\s]*)\s+(?<pid>\d+)\s+(?<source>[^ \]]+)\] (?<message>.*)/time_format %m%d %H:%M:%S.%Npath /var/log/glbc.logpos_file /var/log/es-glbc.log.postag glbc</source># Example:# I0603 15:31:05.793605 6 cluster_manager.go:230] Reading config from path /etc/gce.conf<source>@id cluster-autoscaler.log@type tailformat multilinemultiline_flush_interval 5sformat_firstline /^\w\d{4}/format1 /^(?<severity>\w)(?<time>\d{4} [^\s]*)\s+(?<pid>\d+)\s+(?<source>[^ \]]+)\] (?<message>.*)/time_format %m%d %H:%M:%S.%Npath /var/log/cluster-autoscaler.logpos_file /var/log/es-cluster-autoscaler.log.postag cluster-autoscaler</source># Logs from systemd-journal for interesting services.# TODO(random-liu): Remove this after cri container runtime rolls out.<source>@id journald-docker@type systemdmatches [{ "_SYSTEMD_UNIT": "docker.service" }]<storage>@type localpersistent truepath /var/log/journald-docker.pos</storage>read_from_head truetag docker</source><source>@id journald-container-runtime@type systemdmatches [{ "_SYSTEMD_UNIT": "{{ fluentd_container_runtime_service }}.service" }]<storage>@type localpersistent truepath /var/log/journald-container-runtime.pos</storage>read_from_head truetag container-runtime</source><source>@id journald-kubelet@type systemdmatches [{ "_SYSTEMD_UNIT": "kubelet.service" }]<storage>@type localpersistent truepath /var/log/journald-kubelet.pos</storage>read_from_head truetag kubelet</source><source>@id journald-node-problem-detector@type systemdmatches [{ "_SYSTEMD_UNIT": "node-problem-detector.service" }]<storage>@type localpersistent truepath /var/log/journald-node-problem-detector.pos</storage>read_from_head truetag node-problem-detector</source><source>@id kernel@type systemdmatches [{ "_TRANSPORT": "kernel" }]<storage>@type localpersistent truepath /var/log/kernel.pos</storage><entry>fields_strip_underscores truefields_lowercase true</entry>read_from_head truetag kernel</source>forward.input.conf: |-# Takes the messages sent over TCP<source>@id forward@type forward</source>monitoring.conf: |-# Prometheus Exporter Plugin# input plugin that exports metrics<source>@id prometheus@type prometheus</source><source>@id monitor_agent@type monitor_agent</source># input plugin that collects metrics from MonitorAgent<source>@id prometheus_monitor@type prometheus_monitor<labels>host ${hostname}</labels></source># input plugin that collects metrics for output plugin<source>@id prometheus_output_monitor@type prometheus_output_monitor<labels>host ${hostname}</labels></source># input plugin that collects metrics for in_tail plugin<source>@id prometheus_tail_monitor@type prometheus_tail_monitor<labels>host ${hostname}</labels></source>output.conf: |-<match **>@id elasticsearch@type elasticsearch@log_level infotype_name _docinclude_tag_key truehost elasticsearch-loggingport 9200logstash_format true<buffer>@type filepath /var/log/fluentd-buffers/kubernetes.system.bufferflush_mode intervalretry_type exponential_backoffflush_thread_count 2flush_interval 5sretry_foreverretry_max_interval 30chunk_limit_size 2Mtotal_limit_size 500Moverflow_action block</buffer></match>5、fluentd-es-ds.yaml
apiVersion: v1
kind: ServiceAccount
metadata:name: fluentd-esnamespace: logginglabels:k8s-app: fluentd-esaddonmanager.kubernetes.io/mode: Reconcile
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:name: fluentd-eslabels:k8s-app: fluentd-esaddonmanager.kubernetes.io/mode: Reconcile
rules:
- apiGroups:- ""resources:- "namespaces"- "pods"verbs:- "get"- "watch"- "list"
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:name: fluentd-eslabels:k8s-app: fluentd-esaddonmanager.kubernetes.io/mode: Reconcile
subjects:
- kind: ServiceAccountname: fluentd-esnamespace: loggingapiGroup: ""
roleRef:kind: ClusterRolename: fluentd-esapiGroup: ""
---
apiVersion: apps/v1
kind: DaemonSet
metadata:name: fluentd-es-v3.1.1namespace: logginglabels:k8s-app: fluentd-esversion: v3.1.1addonmanager.kubernetes.io/mode: Reconcile
spec:selector:matchLabels:k8s-app: fluentd-esversion: v3.1.1template:metadata:labels:k8s-app: fluentd-esversion: v3.1.1spec:securityContext:seccompProfile:type: RuntimeDefaultpriorityClassName: system-node-criticalserviceAccountName: fluentd-escontainers:- name: fluentd-esimage: quay.io/fluentd_elasticsearch/fluentd:v3.1.0env:- name: FLUENTD_ARGSvalue: --no-supervisor -qresources:limits:memory: 500Mirequests:cpu: 100mmemory: 200MivolumeMounts:- name: varlogmountPath: /var/log- name: varlibdockercontainersmountPath: /var/lib/docker/containersreadOnly: true- name: config-volumemountPath: /etc/fluent/config.dports:- containerPort: 24231name: prometheusprotocol: TCPlivenessProbe:tcpSocket:port: prometheusinitialDelaySeconds: 5timeoutSeconds: 10readinessProbe:tcpSocket:port: prometheusinitialDelaySeconds: 5timeoutSeconds: 10terminationGracePeriodSeconds: 30volumes:- name: varloghostPath:path: /var/log- name: varlibdockercontainershostPath:path: /var/lib/docker/containers- name: config-volumeconfigMap:name: fluentd-es-config-v0.2.16、kibana-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:name: kibana-loggingnamespace: logginglabels:k8s-app: kibana-loggingaddonmanager.kubernetes.io/mode: Reconcile
spec:replicas: 1selector:matchLabels:k8s-app: kibana-loggingtemplate:metadata:labels:k8s-app: kibana-loggingspec:securityContext:seccompProfile:type: RuntimeDefaultcontainers:- name: kibana-loggingimage: docker.elastic.co/kibana/kibana-oss:7.10.2resources:# need more cpu upon initialization, therefore burstable classlimits:cpu: 1000mrequests:cpu: 100menv:- name: ELASTICSEARCH_HOSTSvalue: http://elasticsearch-logging:9200- name: SERVER_NAMEvalue: kibana-logging- name: SERVER_BASEPATHvalue: /api/v1/namespaces/logging/services/kibana-logging/proxy- name: SERVER_REWRITEBASEPATHvalue: "false"ports:- containerPort: 5601name: uiprotocol: TCPlivenessProbe:httpGet:path: /api/statusport: uiinitialDelaySeconds: 5timeoutSeconds: 10readinessProbe:httpGet:path: /api/statusport: uiinitialDelaySeconds: 5timeoutSeconds: 107、kibana-service.yaml
apiVersion: apps/v1
kind: Deployment
metadata:name: kibana-loggingnamespace: logginglabels:k8s-app: kibana-loggingaddonmanager.kubernetes.io/mode: Reconcile
spec:replicas: 1selector:matchLabels:k8s-app: kibana-loggingtemplate:metadata:labels:k8s-app: kibana-loggingspec:securityContext:seccompProfile:type: RuntimeDefaultcontainers:- name: kibana-loggingimage: docker.elastic.co/kibana/kibana-oss:7.10.2resources:# need more cpu upon initialization, therefore burstable classlimits:cpu: 1000mrequests:cpu: 100menv:- name: ELASTICSEARCH_HOSTSvalue: http://elasticsearch-logging:9200- name: SERVER_NAMEvalue: kibana-logging- name: SERVER_BASEPATHvalue: /api/v1/namespaces/logging/services/kibana-logging/proxy- name: SERVER_REWRITEBASEPATHvalue: "false"ports:- containerPort: 5601name: uiprotocol: TCPlivenessProbe:httpGet:path: /api/statusport: uiinitialDelaySeconds: 5timeoutSeconds: 10readinessProbe:httpGet:path: /api/statusport: uiinitialDelaySeconds: 5timeoutSeconds: 10无约束优化问题——最优性条件)
：XSS攻击—存储式XSS漏洞)
