Initial commit

01_Namespace.yaml

+# create amazon-cloudwatch namespace
+apiVersion: v1
+kind: Namespace
+metadata:
+    name: amazon-cloudwatch
+    labels:
+        name: amazon-cloudwatch
+---

02_ServiceAccount.yaml

+# create CWAgent service account
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+    name: cloudwatch-agent
+    namespace: amazon-cloudwatch
+
+---
+
+# Create FluentD service account
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+    name: fluentd
+    namespace: amazon-cloudwatch
+---

02_eks.tf

+// Configuring the provider allows easy usage when multiple accounts managed
+// and avoids mistakes.
+provider "aws" {
+  region = "eu-west-1"
+  // Profile defined in AWS Credentials file
+  profile = "Autentia"
+}
+
+resource "aws_iam_role" "eks_cluster" {
+  name = "eks-cluster-tutorial"
+
+  // As the console output is JSON formatted this allows to paste output directly
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17",
+    Statement = [
+      {
+        Effect = "Allow",
+        Principal = {
+          Service = "eks.amazonaws.com"
+        },
+        Action = "sts:AssumeRole"
+      }
+    ]
+  })
+
+  tags = {
+    Application = "AWS EKS Tutorial"
+  }
+}
+
+resource "aws_iam_role_policy_attachment" "AmazonEKSClusterPolicy" {
+  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
+  role = aws_iam_role.eks_cluster.name
+}
+
+resource "aws_iam_role_policy_attachment" "AmazonEKSServicePolicy" {
+  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy"
+  role = aws_iam_role.eks_cluster.name
+}
+
+resource "aws_eks_cluster" "aws_eks" {
+  name = "eks_cluster_test"
+  role_arn = aws_iam_role.eks_cluster.arn
+
+  version = "1.19" // To trigger an update to 1.19
+
+  vpc_config {
+    subnet_ids = [
+      "subnet-00e4cc76",
+      "subnet-988db9fc"
+    ]
+  }
+
+  tags = {
+    Name = "EKS_test",
+    Application = "AWS EKS Tutorial"
+  }
+}
+
+resource "aws_iam_role" "eks_nodes" {
+  name = "eks-node-group-test"
+
+  tags = {
+    Application = "AWS EKS Tutorial"
+  }
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17",
+    Statement = [
+      {
+        Effect = "Allow",
+        Principal = {
+          Service = "ec2.amazonaws.com"
+        },
+        Action = "sts:AssumeRole"
+      }
+    ]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "AmazonEKSWorkerNodePolicy" {
+  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
+  role = aws_iam_role.eks_nodes.name
+}
+
+resource "aws_iam_role_policy_attachment" "AmazonEKS_CNI_Policy" {
+  policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
+  role = aws_iam_role.eks_nodes.name
+}
+
+resource "aws_iam_role_policy_attachment" "AmazonEC2ContainerRegistryReadOnly" {
+  policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
+  role = aws_iam_role.eks_nodes.name
+}
+
+resource "aws_iam_role_policy_attachment" "CloudWatchAgentServerPolicy" {
+  policy_arn = "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy"
+  role = aws_iam_role.eks_nodes.name
+}
+
+resource "aws_eks_node_group" "node" {
+  cluster_name = aws_eks_cluster.aws_eks.name
+  node_group_name = "node_test"
+  node_role_arn = aws_iam_role.eks_nodes.arn
+  subnet_ids = [
+    "subnet-00e4cc76",
+    "subnet-988db9fc"
+  ]
+
+//  Fix the instance type to a free tier one
+  instance_types = ["t3.small"]
+
+  scaling_config {
+    desired_size = 1
+    max_size = 1
+    min_size = 1
+  }
+
+  // Avoid Terraform detecting changes on desired_size due to scaling policies
+  // If our application has scaled up we do not change current instances ;)
+  lifecycle {
+    ignore_changes = [scaling_config[0].desired_size]
+  }
+
+  tags = {
+    Application = "AWS EKS Tutorial"
+  }
+
+  # Ensure that IAM Role permissions are created before and deleted after EKS Node Group handling.
+  # Otherwise, EKS will not be able to properly delete EC2 Instances and Elastic Network Interfaces.
+  depends_on = [
+    aws_iam_role_policy_attachment.AmazonEKSWorkerNodePolicy,
+    aws_iam_role_policy_attachment.AmazonEKS_CNI_Policy,
+    aws_iam_role_policy_attachment.AmazonEC2ContainerRegistryReadOnly,
+    aws_iam_role_policy_attachment.CloudWatchAgentServerPolicy,
+  ]
+}
\ No newline at end of file

03_ClusterRole.yaml

+# CWAgent Cluster Role and Role Binding
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+    name: cloudwatch-agent-role
+rules:
+    - apiGroups: [""]
+      resources: ["pods", "nodes", "endpoints"]
+      verbs: ["list", "watch"]
+    - apiGroups: ["apps"]
+      resources: ["replicasets"]
+      verbs: ["list", "watch"]
+    - apiGroups: ["batch"]
+      resources: ["jobs"]
+      verbs: ["list", "watch"]
+    - apiGroups: [""]
+      resources: ["nodes/proxy"]
+      verbs: ["get"]
+    - apiGroups: [""]
+      resources: ["nodes/stats", "configmaps", "events"]
+      verbs: ["create"]
+    - apiGroups: [""]
+      resources: ["configmaps"]
+      resourceNames: ["cwagent-clusterleader"]
+      verbs: ["get","update"]
+
+---
+
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+    name: cloudwatch-agent-role-binding
+subjects:
+    - kind: ServiceAccount
+      name: cloudwatch-agent
+      namespace: amazon-cloudwatch
+roleRef:
+    kind: ClusterRole
+    name: cloudwatch-agent-role
+    apiGroup: rbac.authorization.k8s.io
+---
+
+# FluentD Cluster Role and Role Binding
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+    name: fluentd-role
+rules:
+    - apiGroups: [""]
+      resources:
+          - namespaces
+          - pods
+          - pods/logs
+      verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+    name: fluentd-role-binding
+roleRef:
+    apiGroup: rbac.authorization.k8s.io
+    kind: ClusterRole
+    name: fluentd-role
+subjects:
+    - kind: ServiceAccount
+      name: fluentd
+      namespace: amazon-cloudwatch
+---
\ No newline at end of file

04_ConfigMap.yaml

+# Cluster name and AWS region
+apiVersion: v1
+data:
+    cluster.name: eks_cluster_test
+    logs.region: eu-west-1
+kind: ConfigMap
+metadata:
+    name: cluster-info
+    namespace: amazon-cloudwatch
+---
+
+# CWAgent
+apiVersion: v1
+data:
+    # Configuration is in Json format. No matter what configure change you make,
+    # please keep the Json blob valid.
+    cwagentconfig.json: |
+        {
+          "agent": {
+            "region": "eu-west-1"
+          },
+          "logs": {
+            "metrics_collected": {
+              "kubernetes": {
+                "cluster_name": "eks_cluster_test",
+                "metrics_collection_interval": 60
+              }
+            },
+            "force_flush_interval": 5
+          }
+        }
+kind: ConfigMap
+metadata:
+    name: cwagentconfig
+    namespace: amazon-cloudwatch
+---
+
+# FluentD
+apiVersion: v1
+kind: ConfigMap
+metadata:
+    name: fluentd-config
+    namespace: amazon-cloudwatch
+    labels:
+        k8s-app: fluentd-cloudwatch
+data:
+    fluent.conf: |
+        @include containers.conf
+        @include systemd.conf
+        @include host.conf
+
+        <match fluent.**>
+          @type null
+        </match>
+    containers.conf: |
+        <source>
+          @type tail
+          @id in_tail_container_logs
+          @label @containers
+          path /var/log/containers/*.log
+          exclude_path ["/var/log/containers/cloudwatch-agent*", "/var/log/containers/fluentd*"]
+          pos_file /var/log/fluentd-containers.log.pos
+          tag *
+          read_from_head true
+          <parse>
+            @type json
+            time_format %Y-%m-%dT%H:%M:%S.%NZ
+          </parse>
+        </source>
+
+        <source>
+          @type tail
+          @id in_tail_cwagent_logs
+          @label @cwagentlogs
+          path /var/log/containers/cloudwatch-agent*
+          pos_file /var/log/cloudwatch-agent.log.pos
+          tag *
+          read_from_head true
+          <parse>
+            @type json
+            time_format %Y-%m-%dT%H:%M:%S.%NZ
+          </parse>
+        </source>
+
+        <source>
+          @type tail
+          @id in_tail_fluentd_logs
+          @label @fluentdlogs
+          path /var/log/containers/fluentd*
+          pos_file /var/log/fluentd.log.pos
+          tag *
+          read_from_head true
+          <parse>
+            @type json
+            time_format %Y-%m-%dT%H:%M:%S.%NZ
+          </parse>
+        </source>
+
+        <label @fluentdlogs>
+          <filter **>
+            @type kubernetes_metadata
+            @id filter_kube_metadata_fluentd
+          </filter>
+
+          <filter **>
+            @type record_transformer
+            @id filter_fluentd_stream_transformer
+            <record>
+              stream_name ${tag_parts[3]}
+            </record>
+          </filter>
+
+          <match **>
+            @type relabel
+            @label @NORMAL
+          </match>
+        </label>
+
+        <label @containers>
+          <filter **>
+            @type kubernetes_metadata
+            @id filter_kube_metadata
+          </filter>
+
+          <filter **>
+            @type record_transformer
+            @id filter_containers_stream_transformer
+            <record>
+              stream_name ${tag_parts[3]}
+            </record>
+          </filter>
+
+          <filter **>
+            @type concat
+            key log
+            multiline_start_regexp /^\S/
+            separator ""
+            flush_interval 5
+            timeout_label @NORMAL
+          </filter>
+
+          <match **>
+            @type relabel
+            @label @NORMAL
+          </match>
+        </label>
+
+        <label @cwagentlogs>
+          <filter **>
+            @type kubernetes_metadata
+            @id filter_kube_metadata_cwagent
+          </filter>
+
+          <filter **>
+            @type record_transformer
+            @id filter_cwagent_stream_transformer
+            <record>
+              stream_name ${tag_parts[3]}
+            </record>
+          </filter>
+
+          <filter **>
+            @type concat
+            key log
+            multiline_start_regexp /^\d{4}[-/]\d{1,2}[-/]\d{1,2}/
+            separator ""
+            flush_interval 5
+            timeout_label @NORMAL
+          </filter>
+
+          <match **>
+            @type relabel
+            @label @NORMAL
+          </match>
+        </label>
+
+        <label @NORMAL>
+          <match **>
+            @type cloudwatch_logs
+            @id out_cloudwatch_logs_containers
+            region "#{ENV.fetch('AWS_REGION')}"
+            log_group_name "/aws/containerinsights/#{ENV.fetch('CLUSTER_NAME')}/application"
+            log_stream_name_key stream_name
+            remove_log_stream_name_key true
+            auto_create_stream true
+            <buffer>
+              flush_interval 5
+              chunk_limit_size 2m
+              queued_chunks_limit_size 32
+              retry_forever true
+            </buffer>
+          </match>
+        </label>
+    systemd.conf: |
+        <source>
+          @type systemd
+          @id in_systemd_kubelet
+          @label @systemd
+          filters [{ "_SYSTEMD_UNIT": "kubelet.service" }]
+          <entry>
+            field_map {"MESSAGE": "message", "_HOSTNAME": "hostname", "_SYSTEMD_UNIT": "systemd_unit"}
+            field_map_strict true
+          </entry>
+          path /var/log/journal
+          <storage>
+            @type local
+            persistent true
+            path /var/log/fluentd-journald-kubelet-pos.json
+          </storage>
+          read_from_head true
+          tag kubelet.service
+        </source>
+
+        <source>
+          @type systemd
+          @id in_systemd_kubeproxy
+          @label @systemd
+          filters [{ "_SYSTEMD_UNIT": "kubeproxy.service" }]
+          <entry>
+            field_map {"MESSAGE": "message", "_HOSTNAME": "hostname", "_SYSTEMD_UNIT": "systemd_unit"}
+            field_map_strict true
+          </entry>
+          path /var/log/journal
+          <storage>
+            @type local
+            persistent true
+            path /var/log/fluentd-journald-kubeproxy-pos.json
+          </storage>
+          read_from_head true
+          tag kubeproxy.service
+        </source>
+
+        <source>
+          @type systemd
+          @id in_systemd_docker
+          @label @systemd
+          filters [{ "_SYSTEMD_UNIT": "docker.service" }]
+          <entry>
+            field_map {"MESSAGE": "message", "_HOSTNAME": "hostname", "_SYSTEMD_UNIT": "systemd_unit"}
+            field_map_strict true
+          </entry>
+          path /var/log/journal
+          <storage>
+            @type local
+            persistent true
+            path /var/log/fluentd-journald-docker-pos.json
+          </storage>
+          read_from_head true
+          tag docker.service
+        </source>
+
+        <label @systemd>
+          <filter **>
+            @type kubernetes_metadata
+            @id filter_kube_metadata_systemd
+          </filter>
+
+          <filter **>
+            @type record_transformer
+            @id filter_systemd_stream_transformer
+            <record>
+              stream_name ${tag}-${record["hostname"]}
+            </record>
+          </filter>
+
+          <match **>
+            @type cloudwatch_logs
+            @id out_cloudwatch_logs_systemd
+            region "#{ENV.fetch('AWS_REGION')}"
+            log_group_name "/aws/containerinsights/#{ENV.fetch('CLUSTER_NAME')}/dataplane"
+            log_stream_name_key stream_name
+            auto_create_stream true
+            remove_log_stream_name_key true
+            <buffer>
+              flush_interval 5
+              chunk_limit_size 2m
+              queued_chunks_limit_size 32
+              retry_forever true
+            </buffer>
+          </match>
+        </label>
+    host.conf: |
+        <source>
+          @type tail
+          @id in_tail_dmesg
+          @label @hostlogs
+          path /var/log/dmesg
+          pos_file /var/log/dmesg.log.pos
+          tag host.dmesg
+          read_from_head true
+          <parse>
+            @type syslog
+          </parse>
+        </source>
+
+        <source>
+          @type tail
+          @id in_tail_secure
+          @label @hostlogs
+          path /var/log/secure
+          pos_file /var/log/secure.log.pos
+          tag host.secure
+          read_from_head true
+          <parse>
+            @type syslog
+          </parse>
+        </source>
+
+        <source>
+          @type tail
+          @id in_tail_messages
+          @label @hostlogs
+          path /var/log/messages
+          pos_file /var/log/messages.log.pos
+          tag host.messages
+          read_from_head true
+          <parse>
+            @type syslog
+          </parse>
+        </source>
+
+        <label @hostlogs>
+          <filter **>
+            @type kubernetes_metadata
+            @id filter_kube_metadata_host
+          </filter>
+
+          <filter **>
+            @type record_transformer
+            @id filter_containers_stream_transformer_host
+            <record>
+              stream_name ${tag}-${record["host"]}
+            </record>
+          </filter>
+
+          <match host.**>
+            @type cloudwatch_logs
+            @id out_cloudwatch_logs_host_logs
+            region "#{ENV.fetch('AWS_REGION')}"
+            log_group_name "/aws/containerinsights/#{ENV.fetch('CLUSTER_NAME')}/host"
+            log_stream_name_key stream_name
+            remove_log_stream_name_key true
+            auto_create_stream true
+            <buffer>
+              flush_interval 5
+              chunk_limit_size 2m
+              queued_chunks_limit_size 32
+              retry_forever true
+            </buffer>
+          </match>
+        </label>
+---
+
+#FluentD for Rotatelogs
+apiVersion: v1
+kind: ConfigMap
+metadata:
+    name: fluentd-rotatelogs-config
+    namespace: amazon-cloudwatch
+    labels:
+        k8s-app: fluentd-cloudwatch
+data:
+    fluent.conf: |
+        @include containers.conf
+        <match fluent.**>
+          @type null
+        </match>
+    containers.conf: |
+        <source>
+          @type tail
+          @id in_tail_container_logs
+          @label @containers
+          path /var/log/containers/*.log
+          pos_file /usr/local/fluentd-containers.log.pos
+          tag *
+          read_from_head true
+          <parse>
+            @type none
+            # @type json
+            # time_format %Y-%m-%dT%H:%M:%S.%NZ
+          </parse>
+        </source>
+
+        <label @containers>
+          <filter **>
+            @type kubernetes_metadata
+            @id filter_kube_metadata
+          </filter>
+
+          <filter **>
+            @type record_transformer
+            @id filter_containers_stream_transformer
+            <record>
+              stream_name myapplogs #
+            </record>
+          </filter>
+
+          <filter **>
+            @type concat
+            key log
+            multiline_start_regexp /^\S/
+            separator ""
+            flush_interval 5
+            timeout_label @NORMAL
+          </filter>
+
+          <match **>
+            @type relabel
+            @label @NORMAL