fluentd-logger-wid.yaml

# Copyright 2020 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: v1
kind: Namespace
metadata:
  name: apps
---
# Fluentd Service
apiVersion: v1
kind: Service
metadata:
  name: apigee-fluentd
  namespace: apps
  labels:
    app: apigee-fluentd
spec:
  ports:
  - name: fluentd-tcp
    port: 5140
    protocol: TCP
    targetPort: 5140
  - name: fluentd-udp
    port: 5140
    protocol: UDP
    targetPort: 5140
  selector:
    app: apigee-fluentd
---
# Fluentd Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: apigee-fluentd
  namespace: apps
  labels:
    app: apigee-fluentd
spec:
  replicas: 1
  selector:
    matchLabels:
      app: apigee-fluentd
  template:
    metadata:
      labels:
        app: apigee-fluentd
      annotations:
        sidecar.istio.io/inject: "false"
    spec:
      containers:
      - name: fluentd
        #image: fluent/fluentd
        image: gcr.io/stackdriver-agents/stackdriver-logging-agent:1.6.8
        #image: google/apigee-stackdriver-logging-agent:1.6.8        
        resources:
          limits:
            memory: 500Mi
          requests:
            cpu: 100m
            memory: 200Mi
        volumeMounts:
        - name: config-volume
          mountPath: /etc/google-fluentd/config.d
        - name: ksa-token          
          mountPath: /etc/ksa-token
          readOnly: true
      terminationGracePeriodSeconds: 30
      serviceAccountName: logging-svc-account
      volumes:
      - name: config-volume
        configMap:
          defaultMode: 0644
          name: apigee-fluentd-config
      - name: ksa-token
        projected:
          defaultMode: 420
          sources:
          - serviceAccountToken:
              audience: srinandans.svc.id.goog
              expirationSeconds: 172800
              path: ksa-token          
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - preference:
              matchExpressions:
              - key: cloud.google.com/gke-nodepool
                operator: In
                values:
                - apps
            weight: 100
---
# Fluentd ConfigMap, contains config files.
kind: ConfigMap
apiVersion: v1
metadata:
  name: apigee-fluentd-config
  namespace: apps
data:
  fluent.conf: |-  
    # Takes the messages sent over UDP
    <source>
      @type syslog
      tag apigee
      port 5140
      bind 0.0.0.0
      <parse>
        message_format rfc5424
      </parse>      
    </source>
    <match apigee.**>
       @type stdout
    </match>
    <filter **>
      @type add_insert_ids
      insert_id_key apigee-message-logger
    </filter>
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: logging-svc-account
  namespace: apps
  annotations:
    iam.gke.io/gcp-service-account: logwriter@srinandans.iam.gserviceaccount.com

## gcloud iam service-accounts add-iam-policy-binding --role roles/iam.workloadIdentityUser --member "serviceAccount:srinandans.svc.id.goog[apps/logging-svc-account]" logwriter@srinandans.iam.gserviceaccount.com