一键摆设k8s之EFK日记网络系统

一、摆设es

1.下载安装

2. #下载安装
3. https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.13.2-linux-x86_64.tar.gz
4. #解压
5. [root@es software]# tar xf  elasticsearch-8.13.2-linux-x86_64.tar.gz
6. #创建运行elasticsearch服务用户并修改权限
7. [root@es software]# useradd liux
8. [root@es software]# chown liux:liux /data/software/elasticsearch-8.13.2 -R

复制代码

2.修改文件形貌符

 最大及进程数目打开上限 （不修改启动会报错）

2.  [root@es ~]# cat > /etc/security/limits.d/es.conf <<EOF
3. *   soft  nofile 65535
4. *  hard  nofile 131070
5. *  hard  nproc 8192
6. EOF

复制代码

3.修改内核参数

2. [root@es elasticsearch-8.13.2]$ sysctl -q vm.max_map_count
3. vm.max_map_count = 65530
4. [root@es elasticsearch-8.13.2]# cat > /etc/sysctl.d/es.conf <<EOF
5. vm.max_map_count=262144
6. EOF
7. [root@es elasticsearch-8.13.2]# sysctl -f /etc/sysctl.d/es.conf
8. vm.max_map_count = 262144

复制代码

4.修改设置文件

2. [liux@es elasticsearch-8.13.2]$ egrep -v "^#|^$" config/elasticsearch.yml
3. network.host: 0.0.0.0
4. discovery.seed_hosts: ["192.168.91.30"]
5. cluster.initial_master_nodes: ["192.168.91.30"]
6. xpack.security.enabled: false

复制代码

5.设置启动文件

2. [liux@es elasticsearch-8.13.2]$ cat > startES.sh <<EOF
3. #!/bin/bash                                                                           
4. # 设置Elasticsearch的安装目录                                                            ES_HOME="/data/software/elasticsearch-8.13.2"         
5. pid=`ps -ef | grep elasticsearch-8.13.2 | grep -v grep | grep '/data/software/elasticsearch-8.13.2/jdk/bin/ja
6. va' | awk '{print $2}'`                                                                              
7. # 检查Elasticsearch是否已经在运行
8. if ps -ef | grep elasticsearch | grep -v grep > /dev/null; then                           echo "Elasticsearch is running. Stopping..."
9.     kill $pid;                                                                             echo "Elasticsearch stopped."
10. fi                                                                                                        
11. sleep 5s                                                                                                      
12. # 使用nohup重新启动Elasticsearch
13. nohup "$ES_HOME/bin/elasticsearch" -d > "$ES_HOME/es.log" 2>&1 &
14. echo "Elasticsearch is starting in the background..."
15. EOF
17. [liux@es elasticsearch-8.13.2]$ sh startES.sh

复制代码

6.如下所示代表安装乐成

2. [liux@es elasticsearch-8.13.2]$ curl http://192.168.91.30:9200
3. {
4.   "name" : "es",
5.   "cluster_name" : "elasticsearch",
6.   "cluster_uuid" : "f337MT9oRvmL16xom5muBQ",
7.   "version" : {
8.     "number" : "8.13.2",
9.     "build_flavor" : "default",
10.     "build_type" : "tar",
11.     "build_hash" : "16cc90cd2d08a3147ce02b07e50894bc060a4cbf",
12.     "build_date" : "2024-04-05T14:45:26.420424304Z",
13.     "build_snapshot" : false,
14.     "lucene_version" : "9.10.0",
15.     "minimum_wire_compatibility_version" : "7.17.0",
16.     "minimum_index_compatibility_version" : "7.0.0"
17.   },
18.   "tagline" : "You Know, for Search"
19. }

复制代码

7.Elasticsearch天生 TLS 证书

2. #生成 CA 证书
3. [root@es elasticsearch-8.13.2]# bin/elasticsearch-certutil ca --pem --out config/certs/ca.zip
4. [root@es elasticsearch-8.13.2]# unzip config/certs/ca.zip -d config/certs/
5. # 生成节点证书（包含 SAN）
6. [root@es elasticsearch-8.13.2]# bin/elasticsearch-certutil cert --pem \
7.   --ca-cert config/certs/ca/ca.crt \
8.   --ca-key config/certs/ca/ca.key \
9.   --name "es" \
10.   --dns localhost,es,127.0.0.1 \
11.   --ip 192.168.91.30 \
12.   --out config/certs/es-node.zip  
13. [root@es elasticsearch-8.13.2]# unzip config/certs/es-node.zip -d config/certs/

复制代码

8.修改elasticsearch设置文件

2. [root@es elasticsearch-8.13.2]# cat config/elasticsearch.yml
3. # 集群和节点名称
4. cluster.name: my-es
5. node.name: es-node
6. # 网络绑定
7. network.host: 0.0.0.0
8. http.port: 9200
9. # 安全配置
10. xpack.security.enabled: true
11. #配置 HTTP 层 TLS（HTTPS）
12. xpack.security.http.ssl:
13.   enabled: true
14.   key: certs/es/es.key
15.   certificate: certs/es/es.crt
16.   certificate_authorities: certs/ca/ca.crt
17.   verification_mode: full
18. #配置 Transport 层 TLS（节点间通信）
19. xpack.security.transport.ssl:
20.   enabled: true
21.   key: certs/es/es.key
22.   certificate: certs/es/es.crt
23.   certificate_authorities: certs/ca/ca.crt
24.   verification_mode: full
25. # 初始主节点
26. cluster.initial_master_nodes: ["192.168.91.30"]

复制代码

9.设置文件权限

2. [root@es elasticsearch-8.13.2]# chown -R liux:liux /data/software/elasticsearch-8.13.2
3. [root@es elasticsearch-8.13.2]# chmod 600 /data/software/elasticsearch-8.13.2/config/certs/**/*.key
4. [root@es elasticsearch-8.13.2]# chmod 644 /data/software/elasticsearch-8.13.2/config/certs/**/*.crt

复制代码

10.启动（以非root账号）

2. [liux@es elasticsearch-8.13.2]$ ./startES.sh

复制代码

11.为内用用户设置暗码

2. [root@es elasticsearch-8.13.2]# ./bin/elasticsearch-reset-password -u elastic
3. This tool will reset the password of the [elastic] user to an autogenerated value.
4. The password will be printed in the console.
5. Please confirm that you would like to continue [y/N]y
6. Password for the [elastic] user successfully reset.
7. New value: CxL+02hUBIERrlwaXefD

复制代码

12.验证 HTTPS 访问

利用 curl 或浏览器验证 HTTPS 是否收效

2. [liux@es elasticsearch-8.13.2]$ curl -k -u elastic:qgXT6yy*Vmj8FQhO2ein https://192.168.91.30:9200
3. {
4.   "name" : "es",
5.   "cluster_name" : "es8",
6.   "cluster_uuid" : "f337MT9oRvmL16xom5muBQ",
7.   "version" : {
8.     "number" : "8.13.2",
9.     "build_flavor" : "default",
10.     "build_type" : "tar",
11.     "build_hash" : "16cc90cd2d08a3147ce02b07e50894bc060a4cbf",
12.     "build_date" : "2024-04-05T14:45:26.420424304Z",
13.     "build_snapshot" : false,
14.     "lucene_version" : "9.10.0",
15.     "minimum_wire_compatibility_version" : "7.17.0",
16.     "minimum_index_compatibility_version" : "7.0.0"
17.   },
18.   "tagline" : "You Know, for Search"
19. }

复制代码

13.注意事项

验证模式
   verification_mode: certificate：仅验证证书有用性（开发环境适用）。
   verification_mode: full：严酷验证证书和主机名（生产环境必须）。
防火墙和网络
   确保防火墙开放端口 9200（HTTPS）和 9300（节点间通讯）。
集群设置
   多节点集群需确保全部节点利用相同的 CA 证书，并在设置中指定 discovery.seed_hosts。
二、摆设kibana

1.下载安装

2. https://artifacts.elastic.co/downloads/kibana/kibana-8.13.2-x86_64.rpm
3. [root@es software]# rpm -ivh kibana-8.13.2-x86_64.rpm

复制代码

2.设置kibana用户暗码

2. [root@es elasticsearch-8.13.2]# ./bin/elasticsearch-reset-password -u kibana_system
3. This tool will reset the password of the [kibana_system] user to an autogenerated value.
4. The password will be printed in the console.
5. Please confirm that you would like to continue [y/N]y
6. Password for the [kibana_system] user successfully reset.
7. New value: qqjW5tkngBhbWuEydDGW

复制代码

3.修改kibana设置文件

2. [root@es kibana]# cat kibana.yml
3. server.port: 5601
4. server.host: "192.168.91.30"
5. server.publicBaseUrl: "http://192.168.91.30:5601"
6. # Elasticsearch 安全连接
7. elasticsearch.hosts: ["https://192.168.91.30:9200"]
8. elasticsearch.ssl.certificateAuthorities: ["/data/software/elasticsearch-8.13.2/config/certs/ca/ca.crt"]
9. elasticsearch.ssl.verificationMode: full  
10. elasticsearch.username: "kibana_system"
11. elasticsearch.password: "*q-Bc0=m5d*Ev-AcGShm"
12. # 启用 Kibana 安全
13. #用于加密和解密敏感数据的密钥
14. xpack.encryptedSavedObjects.encryptionKey: "1f57078d76aa5c992171a342d7a64d33e56f3a1b832967160bcc568ae43dcf8d"
16. # 如果二进制安装可用  ./bin/kibana-encryption-keys generate生成上面32位的随机字符串
17. # 也可以用openssl rand -hex 32 生成

复制代码

4.设置文件权限

2. [root@es kibana]# chown -R kibana:kibana /etc/kibana
3. # 确保 Kibana 可读 CA 证书
4. [root@es kibana]# chmod 644 /data/software/elasticsearch-8.13.2/config/certs/ca/ca.crt

复制代码

5.启动

2. [root@es software]# systemctl enable --now kibana
3. [root@es software]# systemctl status kibana
4. [root@es kibana]# cat /usr/lib/systemd/system/kibana.service
5. [Unit]
6. Description=Kibana
7. Documentation=https://www.elastic.co
8. Wants=network-online.target
9. After=network-online.target
10. [Service]
11. Type=simple
12. User=kibana
13. Group=kibana
14. PrivateTmp=true
15. Environment=KBN_HOME=/usr/share/kibana
16. Environment=KBN_PATH_CONF=/etc/kibana
17. EnvironmentFile=-/etc/default/kibana
18. EnvironmentFile=-/etc/sysconfig/kibana
19. ExecStart=/usr/share/kibana/bin/kibana
20. Restart=on-failure
21. RestartSec=3
22. StartLimitBurst=3
23. StartLimitInterval=60
24. WorkingDirectory=/usr/share/kibana
25. StandardOutput=journal
26. StandardError=inherit
27. [Install]
28. WantedBy=multi-user.target
30. #页面访问
31. http://192.168.91.30:5601

复制代码

三、摆设filebeat

1.下载filebeat镜像

2.  [root@node-1 ~]# docker pull docker.elastic.co/beats/filebeat:8.13.2

复制代码

2.编写RBAC文件

2. [root@master-1 logs]# vim filebeat-sa.yaml
3. #创建filebeat-sa的服务账号
4. apiVersion: v1
5. kind: ServiceAccount
6. metadata:
7.   name: filebeat-sa
8.   namespace: kube-system
9.   labels:
10.     k8s-app: filebeat
11. ---
12. #集群级权限（ClusterRole）
13. apiVersion: rbac.authorization.k8s.io/v1
14. kind: ClusterRole
15. metadata:
16.   name: filebeat
17.   labels:
18.     k8s-app: filebeat
19. rules:
20. - apiGroups: [""] # "" indicates the core API group
21.   resources: ["namespaces","pods","nodes"]  #用于自动发现容器
22.   verbs: ["get","watch","list"]
23. - apiGroups: ["apps"]  #用于关联 Pod 与 ReplicaSet
24.   resources:
25.     - replicasets
26.   verbs: ["get", "list", "watch"]
27.   
28. ---
29. #集群级权限（ClusterRoleBinding）
30. #将角色与服务账号绑定
31. apiVersion: rbac.authorization.k8s.io/v1
32. kind: ClusterRoleBinding
33. metadata:
34.   name: filebeat
35. subjects:
36. - kind: ServiceAccount
37.   name: filebeat-sa
38.   namespace: kube-system
39. roleRef:
40.   kind: ClusterRole
41.   name: filebeat
42.   apiGroup: rbac.authorization.k8s.io
43.   
44. ---
45. #访问 kubeadm-config 的权限（Role + RoleBinding）
46. #读取 kube-system 命名空间中名为 kubeadm-config 的 ConfigMap（用于获取集群配置信息）
47. #如需要获取data.kubernetes.container.name
48. apiVersion: rbac.authorization.k8s.io/v1
49. kind: Role
50. metadata:
51.   name: filebeat-kubeadm-config
52.   namespace: kube-system
53.   labels:
54.     k8s-app: filebeat
55. rules:
56.   - apiGroups: [""]
57.     resources:
58.       - configmaps
59.     resourceNames:
60.       - kubeadm-config
61.     verbs: ["get"]
63. ---
64. apiVersion: rbac.authorization.k8s.io/v1
65. kind: RoleBinding
66. metadata:
67.   name: filebeat-kubeadm-config
68.   namespace: kube-system
69. subjects:
70.   - kind: ServiceAccount
71.     name: filebeat-sa
72.     namespace: kube-system
73. roleRef:
74.   kind: Role
75.   name: filebeat-kubeadm-config
76.   apiGroup: rbac.authorization.k8s.io
78. [root@master-1 logs]# kubectl apply -f filebeat-sa.yaml

复制代码

3.编写filebeat-config资源

2. [root@master-1 logs]# vim filebeat-config.yaml
3. apiVersion: v1
4. kind: ConfigMap
5. metadata:
6.   name: filebeat-config
7.   namespace: kube-system
8.   labels:
9.     k8s-app: filebeat
10. data:
11.   filebeat.yml: |-
12.     # To enable hints based autodiscover, remove `filebeat.inputs` configuration and uncomment this:
13.     filebeat.autodiscover:
14.       providers:
15.         - type: kubernetes
16.           node: ${NODE_NAME}
17.           hints.enabled: true
18.           conditions:
19.             equals:
20.               data.kubernetes.container.name: "nginx" # 关键条件字段，只收集容器为nginx日志
21.           hints.default_config:
22.             type: container
23.             paths:
24.               - /var/log/containers/*${data.kubernetes.container.id}.log
25.             symlinks: true
26.     processors:
27.       - add_host_metadata:
28.     output.elasticsearch:
29.       hosts: ['${ELASTICSEARCH_HOST:elasticsearch}:${ELASTICSEARCH_PORT:9200}']
30.       username: ${ELASTICSEARCH_USERNAME}
31.       password: ${ELASTICSEARCH_PASSWORD}
32.       # 定义索引名称格式：nginx-logs-当前日期
33.       index: "nginx-logs-%{+yyyy.MM.dd}"
34.     setup.ilm.enabled: false  # 禁用索引生命周期管理
35.     setup.template.enabled: false  # 禁用默认索引模板,开启该选项日志默认会收集到以filebeat+版本号的 数据流模板中
36.     cloud.id: ""   # 清空云ID配置
37.     cloud.auth: ""
39. [root@master-1 logs]# kubectl apply -f filebeat-config.yaml

复制代码

4.编写filebeat的DaemonSet资源

2. [root@master-1 logs]# vim filebeat-ds.yaml
3. apiVersion: apps/v1
4. kind: DaemonSet
5. metadata:
6.   name: filebeat
7.   namespace: kube-system
8.   labels:
9.     k8s-app: filebeat
10. spec:
11.   selector:
12.     matchLabels:
13.       k8s-app: filebeat
14.   template:
15.     metadata:
16.       labels:
17.         k8s-app: filebeat
18.     spec:
19.       serviceAccountName: filebeat-sa   #指定 Pod 使用的服务账户
20.       terminationGracePeriodSeconds: 30
21.       hostNetwork: true   #使用主机网络
22.       dnsPolicy: ClusterFirstWithHostNet  #DNS 解析策略（优先集群 DNS，兼容宿主机网络）
23.       containers:
24.       - name: filebeat
25.         image: docker.elastic.co/beats/filebeat:8.13.2
26.         args: [
27.           "-c", "/etc/filebeat.yml",
28.           "-e","--path.data", "/usr/share/filebeat/data/pod-$(HOSTNAME)"
29.         ]
30.         env:
31.         - name: HOSTNAME
32.           valueFrom:
33.             fieldRef:
34.               fieldPath: metadata.name  # 注入Pod名称作为唯一标识
35.         - name: ELASTICSEARCH_HOST
36.           value: 192.168.91.30
37.         - name: ELASTICSEARCH_PORT
38.           value: "9200"
39.         - name: ELASTICSEARCH_USERNAME
40.           value: elastic
41.         - name: ELASTICSEARCH_PASSWORD
42.           value: "CxL+02hUBIERrlwaXefD"
43.         - name: ELASTIC_CLOUD_ID
44.           value:
45.         - name: ELASTIC_CLOUD_AUTH
46.           value:
47.         - name: NODE_NAME
48.           valueFrom:
49.             fieldRef:
50.               fieldPath: spec.nodeName
51.         #安全上下文
52.         securityContext:
53.           runAsUser: 0  # 以 root 用户运行（需访问宿主机日志文件，但存在安全风险）
54.           # If using Red Hat OpenShift uncomment this:
55.           #privileged: true  # 在 OpenShift 中可能需要开启特权模式
56.         #资源限制
57.         resources:
58.           limits:
59.             memory: 200Mi  # 内存上限为 200MiB
60.           requests:
61.             cpu: 100m
62.             memory: 100Mi
63.         #容器内挂载路径
64.         volumeMounts:
65.         - name: config
66.           mountPath: /etc/filebeat.yml
67.           readOnly: true
68.           subPath: filebeat.yml
69.         - name: data
70.           mountPath: /usr/share/filebeat/data
71.         - name: varlogcontainers
72.           mountPath: /var/log/containers
73.           readOnly: true
74.         - name: varlogpods
75.           mountPath: /var/log/pods
76.           readOnly: true
77.         - name: varlibdockercontainers
78.           mountPath: /var/lib/docker/containers
79.           readOnly: true
80.       #定义存储卷来源
81.       volumes:
82.       - name: config
83.         configMap:
84.           defaultMode: 0640
85.           name: filebeat-config
86.       - name: varlogcontainers
87.         hostPath:
88.           path: /var/log/containers
89.       - name: varlogpods
90.         hostPath:
91.           path: /var/log/pods
92.       - name: varlibdockercontainers
93.         hostPath:
94.           path: /var/lib/docker/containers
95.       # data folder stores a registry of read status for all files, so we don't send everything again on a Filebeat pod restart
96.       - name: data
97.         hostPath:
98.           # When filebeat runs as non-root user, this directory needs to be writable by group (g+w).
99.           path: /var/lib/filebeat-data
100.           type: DirectoryOrCreate
102. [root@master-1 logs]# kubectl apply -f filebeat-ds.yaml

复制代码

5.设置 Filebeat 利用 TLS 连接es

注：es如果没有开启tls认证，该步骤可以忽略

2. #1. 通过secret存储es证书
3. [root@master-1 logs]# kubectl create secret generic es-ca-cert -n kube-system --from-file=ca.crt=/root/ca.crt
5. #2.在Filebeat 的 Deployment/DaemonSet 中挂载证书filebeat-ds.yaml
6. volumeMounts:
7. - name: es-ca-cert
8.   mountPath: /etc/filebeat/certs
9.   readOnly: true
11. volumes:
12. - name: es-ca-cert
13.   secret:
14.     secretName: es-ca-cert
15. #3.配置 Filebeat 的 filebeat-config.yml
16. #修改 Filebeat 的 Elasticsearch 输出配置，启用 TLS 并指定 CA 证书路径
17.       #hosts需要改为https
18.       hosts: ['${ELASTICSEARCH_HOST:elasticsearch}:${ELASTICSEARCH_PORT:9200}']
19.       username: ${ELASTICSEARCH_USERNAME}
20.       password: ${ELASTICSEARCH_PASSWORD}
21.       # 禁用默认数据流，使用自定义索引
22.       #data_stream.enabled: false
23.       # 定义索引名称格式：nginx-logs-当前日期
24.       index: "nginx-logs-%{+yyyy.MM.dd}"
25.       ssl:
26.         enabled: true
27.         certificate_authorities: ["/etc/filebeat/certs/ca.crt"]  # 挂载的 CA 证书路径
28.         verification_mode: "full"            # 严格验证证书（生产环境推荐）

复制代码

6.利用Secret 存储es用户暗码（更安全）

2. #1. 使用kubectl命令创建secret
3. [root@master-1 logs]# kubectl create secret generic es-credentials -n kube-system \
4.   --from-literal=username=elastic \
5.   --from-literal=password=CxL+02hUBIERrlwaXefD
6. #也可通过yaml方式创建
7. [root@master-1 logs]# kubectl apply -f es-credentials.yaml
8. apiVersion: v1
9. kind: Secret
10. metadata:
11.   name: es-credentials
12.   namespace: kube-system
13. type: Opaque
14. data:
15.   password: Q3hMKzAyaFVCSUVScmx3YVhlZkQ=   # echo -n "CxL+02hUBIERrlwaXefD" | base64
16.   username: ZWxhc3RpYw==                   # echo -n "elastic" | base64
18. #2.将secret通过环境变量注入pod中
19. # 示例：Filebeat DaemonSet 配置片段
20. spec:
21.   template:
22.     spec:
23.       containers:
24.         - name: filebeat
25.           env:
26.             - name: ELASTICSEARCH_USERNAME
27.               valueFrom:
28.                 secretKeyRef:
29.                   name: es-credentials
30.                   key: username
31.             - name: ELASTICSEARCH_PASSWORD
32.               valueFrom:
33.                 secretKeyRef:
34.                   name: es-credentials
35.                   key: password
36. #3.filebeat-config从环境变量中获取
37. output.elasticsearch:
38.   hosts: ["https://es:9200"]
39.   protocol: "https"
40.   username: ${ELASTICSEARCH_USERNAME}  # 从环境变量读取
41.   password: ${ELASTICSEARCH_PASSWORD}  # 从环境变量读取

复制代码

7.汇总版本（tls+secret）

2. #kubectl apply -f filebeat-config.yaml
3. apiVersion: v1
4. kind: ConfigMap
5. metadata:
6.   name: filebeat-config
7.   namespace: kube-system
8.   labels:
9.     k8s-app: filebeat
10. data:
11.   filebeat.yml: |-
12.     # To enable hints based autodiscover, remove `filebeat.inputs` configuration and uncomment this:
13.     filebeat.autodiscover:
14.       providers:
15.         - type: kubernetes
16.           node: ${NODE_NAME}
17.           hints.enabled: true
18.           conditions:
19.             equals:
20.               data.kubernetes.container.name: "nginx"  # 关键条件字段
21.           hints.default_config:
22.             type: container
23.             paths:
24.               - /var/log/containers/*${data.kubernetes.container.id}.log
25.             symlinks: true
26.     processors:
27.       - add_host_metadata:
28.     output.elasticsearch:
29.       hosts: ['${ELASTICSEARCH_HOST:elasticsearch}:${ELASTICSEARCH_PORT:9200}']
30.       username: ${ELASTICSEARCH_USERNAME}
31.       password: ${ELASTICSEARCH_PASSWORD}
32.       # 禁用默认数据流，使用自定义索引
33.       #data_stream.enabled: false
34.       # 定义索引名称格式：nginx-logs-当前日期
35.       index: "nginx-logs-%{+yyyy.MM.dd}"
36.       ssl:
37.         enabled: true
38.         certificate_authorities: ["/etc/filebeat/certs/ca.crt"]  # 挂载的 CA 证书路径
39.         verification_mode: "full"            # 严格验证证书（生产环境推荐）
40.     setup.ilm.enabled: false  # 禁用索引生命周期管理
41.     setup.template.enabled: false  # 禁用默认索引模板
42.     cloud.id: ""   # 清空云ID配置
43.     cloud.auth: ""
44. ---
45. #kubectl apply -f filebeat-ds.yaml
46. apiVersion: apps/v1
47. kind: DaemonSet
48. metadata:
49.   name: filebeat
50.   namespace: kube-system
51.   labels:
52.     k8s-app: filebeat
53. spec:
54.   selector:
55.     matchLabels:
56.       k8s-app: filebeat
57.   template:
58.     metadata:
59.       labels:
60.         k8s-app: filebeat
61.     spec:
62.       serviceAccountName: filebeat-sa
63.       terminationGracePeriodSeconds: 30
64.       hostNetwork: true
65.       dnsPolicy: ClusterFirstWithHostNet
66.       containers:
67.       - name: filebeat
68.         image: docker.elastic.co/beats/filebeat:8.13.2
69.         args: [
70.           "-c", "/etc/filebeat.yml",
71.           "-e","--path.data", "/usr/share/filebeat/data/pod-$(HOSTNAME)"
72.         ]
73.         env:
74.         - name: HOSTNAME
75.           valueFrom:
76.             fieldRef:
77.               fieldPath: metadata.name  # 注入Pod名称作为唯一标识
78.         - name: ELASTICSEARCH_USERNAME
79.           valueFrom:
80.             secretKeyRef:
81.               name: es-credentials
82.               key: username
83.         - name: ELASTICSEARCH_PASSWORD
84.           valueFrom:
85.             secretKeyRef:
86.               name: es-credentials
87.               key: password
88.         - name: ELASTICSEARCH_HOST
89.           value: "https://192.168.91.30"
90.         - name: ELASTICSEARCH_PORT
91.           value: "9200"
92.        # - name: ELASTICSEARCH_USERNAME
93.        #   value: elastic
94.        # - name: ELASTICSEARCH_PASSWORD
95.        #   value: "CxL+02hUBIERrlwaXefD"
96.         - name: ELASTIC_CLOUD_ID
97.           value:
98.         - name: ELASTIC_CLOUD_AUTH
99.           value:
100.         - name: NODE_NAME
101.           valueFrom:
102.             fieldRef:
103.               fieldPath: spec.nodeName
104.         securityContext:
105.           runAsUser: 0
106.           # If using Red Hat OpenShift uncomment this:
107.           #privileged: true
108.         resources:
109.           limits:
110.             memory: 200Mi
111.           requests:
112.             cpu: 100m
113.             memory: 100Mi
114.         volumeMounts:
115.         - name: config
116.           mountPath: /etc/filebeat.yml
117.           readOnly: true
118.           subPath: filebeat.yml
119.         - name: data
120.           mountPath: /usr/share/filebeat/data
121.         - name: varlogcontainers
122.           mountPath: /var/log/containers
123.           readOnly: true
124.         - name: varlogpods
125.           mountPath: /var/log/pods
126.           readOnly: true
127.         - name: varlibdockercontainers
128.           mountPath: /var/lib/docker/containers
129.           readOnly: true
130.         - name: es-ca-cert
131.           mountPath: /etc/filebeat/certs
132.           readOnly: true
133.       volumes:
134.       - name: config
135.         configMap:
136.           defaultMode: 0640
137.           name: filebeat-config
138.       - name: varlogcontainers
139.         hostPath:
140.           path: /var/log/containers
141.       - name: varlogpods
142.         hostPath:
143.           path: /var/log/pods
144.       - name: varlibdockercontainers
145.         hostPath:
146.           path: /var/lib/docker/containers
147.       - name: es-ca-cert
148.         secret:
149.           secretName: es-ca-cert
150.       # data folder stores a registry of read status for all files, so we don't send everything again on a Filebeat pod restart
151.       - name: data
152.         hostPath:
153.           # When filebeat runs as non-root user, this directory needs to be writable by group (g+w).
154.           path: /var/lib/filebeat-data
155.           type: DirectoryOrCreate
156. ---
157. #filebeat-sa.yaml
158. apiVersion: rbac.authorization.k8s.io/v1
159. kind: ClusterRoleBinding
160. metadata:
161.   name: filebeat
162. subjects:
163. - kind: ServiceAccount
164.   name: filebeat-sa
165.   namespace: kube-system
166. roleRef:
167.   kind: ClusterRole
168.   name: filebeat
169.   apiGroup: rbac.authorization.k8s.io
170. ---
171. apiVersion: rbac.authorization.k8s.io/v1
172. kind: RoleBinding
173. metadata:
174.   name: filebeat-kubeadm-config
175.   namespace: kube-system
176. subjects:
177.   - kind: ServiceAccount
178.     name: filebeat-sa
179.     namespace: kube-system
180. roleRef:
181.   kind: Role
182.   name: filebeat-kubeadm-config
183.   apiGroup: rbac.authorization.k8s.io
184. ---
185. apiVersion: rbac.authorization.k8s.io/v1
186. kind: ClusterRole
187. metadata:
188.   name: filebeat
189.   labels:
190.     k8s-app: filebeat
191. rules:
192. - apiGroups: [""] # "" indicates the core API group
193.   resources:
194.   - namespaces
195.   - pods
196.   - nodes
197.   verbs:
198.   - get
199.   - watch
200.   - list
201. - apiGroups: ["apps"]
202.   resources:
203.     - replicasets
204.   verbs: ["get", "list", "watch"]
205. ---
206. apiVersion: rbac.authorization.k8s.io/v1
207. kind: Role
208. metadata:
209.   name: filebeat-kubeadm-config
210.   namespace: kube-system
211.   labels:
212.     k8s-app: filebeat
213. rules:
214.   - apiGroups: [""]
215.     resources:
216.       - configmaps
217.     resourceNames:
218.       - kubeadm-config
219.     verbs: ["get"]
220. ---
221. apiVersion: v1
222. kind: ServiceAccount
223. metadata:
224.   name: filebeat-sa
225.   namespace: kube-system
226.   labels:
227.     k8s-app: filebeat

复制代码

8.测试效果以及排查题目

2. [root@master-1 logs]# kubectl apply -f filebeat-sa.yaml
3. [root@master-1 logs]# kubectl apply -f filebeat-config.yaml
4. [root@master-1 logs]# kubectl apply -f filebeat-ds.yaml
5. #以下表示部署成功
6. [root@master-1 logs]# kubectl get pods -A -o wide
7. NAMESPACE     NAME     READY   STATUS    RESTARTS        AGE     IP              NODE     NOMINATED NODE   READINESS GATES
8. kube-system   filebeat-49g94                            1/1     Running   0               16m     192.168.91.22   node-2   <none>           <none>
9. kube-system   filebeat-rgf4f                            1/1     Running   0               16m     192.168.91.21   node-1   <none>           <none>
11. #kibana中查看索引Stack Management-->Index Management
12. nginx-logs
14. #查看filebeat日志
15. [root@master-1 logs]# kubectl logs -f filebeat-49g94  -n kube-system
17. #调试 Filebeat，输出更详细的日志，帮助排查问题
18. [root@master-1 logs]# kubectl exec -it filebeat-49g94  -n kube-system -- filebeat -e -d "*" -c /etc/filebeat.yml
20. # 遇到被锁的情况 进入Filebeat Pod手动删除锁文件
21. [root@master-1 logs]# kubectl exec -it filebeat-49g94  -n kube-system  -- rm -f /usr/share/filebeat/data/filebeat.lock
23. #查看es连通性
24. [root@master-1 logs]# kubectl exec -it filebeat-49g94 -n kube-system -- curl -u elastic:CxL+02hUBIERrlwaXefD http://192.168.91.30:9200       

复制代码

EFK 日记系统为 Kubernetes 提供了从日记网络、存储到分析的全链路本领，生产环境中需重点关注 长期化存储、资源配额 和 安全设置（如 TLS 加密、RBAC 权限）。