Configuring Graylog¶

Graylog with TCP

Collect the following information from your Graylog administrator:
- Host: The hostname or IP address of your Graylog server (e.g. graylog.example.com).
- Port: The GELF TCP input port, typically 12201.
- TLS certificates: Download the following files from your Graylog administrator:
  - graylog_ca.crt — the CA certificate that signed the Graylog server certificate.

Edit the fluent-bit configuration

[artesca-os@bootstrap ~]$

export GRAYLOG_HOST="<graylog-host>"
export GRAYLOG_PORT="12201"

[artesca-os@bootstrap ~]$

sudo kubectl --kubeconfig /etc/kubernetes/admin.conf apply -f - << EOF
apiVersion: v1
kind: ConfigMap
metadata:
  name: metalk8s-fluent-bit-config
  namespace: metalk8s-logging
data:
  config.yaml: |-
    apiVersion: addons.metalk8s.scality.com
    kind: FluentBitConfig
    spec:
      config:
        output:
          - Name: gelf
            Match: audit.*
            Host: "$GRAYLOG_HOST"
            Port: "$GRAYLOG_PORT"
            Mode: tls
            TLS: On
            TLS.Verify: On
            TLS.ca_file: /fluent-bit/etc/tls/graylog_ca.crt
            Gelf_Short_Message_Key: log
EOF

Add the certificates to Fluent Bit
Note

Before running the command below, copy the certificate files to the home directory of the bootstrap node (/home/artesca-os/) with the following exact names:
- graylog_ca.crt
Once the command has completed, delete them from the node.
[artesca-os@bootstrap ~]$
sudo kubectl --kubeconfig /etc/kubernetes/admin.conf \ patch secret -n metalk8s-logging fluent-bit-certs -p \ '{"data":{ "graylog_ca.crt":"'"$(base64 -w 0 graylog_ca.crt)"'" }}'

Update bootstrap configuration

[artesca-os@bootstrap ~]$

sudo salt-call --local state.single file.serialize \
  /etc/metalk8s/bootstrap.yaml \
  dataset="{ \
    'addons': { \
      'fluent-bit': { \
        'enabled': True \
      }, \
    } \
  }" \
  serializer=yaml merge_if_exists=True show_changes=True

Export the MetalK8s version you are using as an environment variable:

[artesca-os@bootstrap ~]$

export MK8SVERSION=`sudo kubectl \
    --kubeconfig=/etc/kubernetes/admin.conf \
    get cm -n kube-system artesca-version \
    -o jsonpath="{.data.metalk8s}"`

Apply the changes

[artesca-os@bootstrap ~]$

sudo kubectl exec --kubeconfig /etc/kubernetes/admin.conf \
    $(sudo kubectl --kubeconfig /etc/kubernetes/admin.conf get pod -n kube-system -l app=salt-master -o name) \
    -n kube-system -c salt-master -- \
    salt-run state.sls metalk8s.addons.logging.deployed \
    saltenv=metalk8s-$MK8SVERSION

Graylog with mTLS

Collect the following information from your Graylog administrator:
- Host: The hostname or IP address of your Graylog server (e.g. graylog.example.com).
- Port: The GELF TCP input port, typically 12201.
- TLS certificates: Download the following files from your Graylog administrator:
  - graylog_ca.crt — the CA certificate that signed the Graylog server certificate.
  - graylog_client.crt and graylog_client.key — a client certificate/key pair for mutual TLS authentication.

Edit the fluent-bit configuration

[artesca-os@bootstrap ~]$

export GRAYLOG_HOST="<graylog-host>"
export GRAYLOG_PORT="12201"

[artesca-os@bootstrap ~]$

sudo kubectl --kubeconfig /etc/kubernetes/admin.conf apply -f - << EOF
apiVersion: v1
kind: ConfigMap
metadata:
  name: metalk8s-fluent-bit-config
  namespace: metalk8s-logging
data:
  config.yaml: |-
    apiVersion: addons.metalk8s.scality.com
    kind: FluentBitConfig
    spec:
      config:
        output:
          - Name: gelf
            Match: audit.*
            Host: "$GRAYLOG_HOST"
            Port: "$GRAYLOG_PORT"
            Mode: tls
            TLS: On
            TLS.Verify: On
            TLS.ca_file: /fluent-bit/etc/tls/graylog_ca.crt
            TLS.crt_file: /fluent-bit/etc/tls/graylog_client.crt
            TLS.key_file: /fluent-bit/etc/tls/graylog_client.key
            Gelf_Short_Message_Key: log
EOF

Add the certificates to Fluent Bit

Note

Before running the command below, copy the certificate files to the home directory of the bootstrap node (/home/artesca-os/) with the following exact names:

graylog_ca.crt
graylog_client.crt
graylog_client.key

Once the command has completed, delete them from the node.

[artesca-os@bootstrap ~]$

sudo kubectl --kubeconfig /etc/kubernetes/admin.conf \
   patch secret -n metalk8s-logging fluent-bit-certs -p \
   '{"data":{
     "graylog_ca.crt":"'"$(base64 -w 0 graylog_ca.crt)"'",
     "graylog_client.crt":"'"$(base64 -w 0 graylog_client.crt)"'",
     "graylog_client.key":"'"$(base64 -w 0 graylog_client.key)"'"
   }}'

Update bootstrap configuration

[artesca-os@bootstrap ~]$

sudo salt-call --local state.single file.serialize \
  /etc/metalk8s/bootstrap.yaml \
  dataset="{ \
    'addons': { \
      'fluent-bit': { \
        'enabled': True \
      }, \
    } \
  }" \
  serializer=yaml merge_if_exists=True show_changes=True

Export the MetalK8s version you are using as an environment variable:

[artesca-os@bootstrap ~]$

export MK8SVERSION=`sudo kubectl \
    --kubeconfig=/etc/kubernetes/admin.conf \
    get cm -n kube-system artesca-version \
    -o jsonpath="{.data.metalk8s}"`

Apply the changes

[artesca-os@bootstrap ~]$

sudo kubectl exec --kubeconfig /etc/kubernetes/admin.conf \
    $(sudo kubectl --kubeconfig /etc/kubernetes/admin.conf get pod -n kube-system -l app=salt-master -o name) \
    -n kube-system -c salt-master -- \
    salt-run state.sls metalk8s.addons.logging.deployed \
    saltenv=metalk8s-$MK8SVERSION