a13labs.infra/terraform/k8sapps/fluent_bit.tf

resource "kubernetes_cluster_role" "fluent_bit" {

  metadata {
    name = "fluent-bit-role"
  }

  rule {
    api_groups = [""]
    resources  = ["pods"]
    verbs      = ["get", "use"]
  }
}

resource "kubernetes_cluster_role_binding" "fluent_bit" {

  metadata {
    name = "fluent-bit-role-binding"
  }

  role_ref {
    api_group = "rbac.authorization.k8s.io"
    kind      = "ClusterRole"
    name      = kubernetes_cluster_role.fluent_bit.metadata.0.name
  }

  subject {
    kind      = "ServiceAccount"
    name      = kubernetes_service_account_v1.fluent_bit.metadata.0.name
    namespace = kubernetes_namespace.monitoring.metadata.0.name
  }
}

resource "kubernetes_service_account_v1" "fluent_bit" {
  metadata {
    name      = "fluent-bit-sa"
    namespace = kubernetes_namespace.monitoring.metadata.0.name
  }

  automount_service_account_token = false
}

resource "kubernetes_config_map" "fluent_bit" {
  metadata {
    name      = "fluent-bit"
    namespace = kubernetes_namespace.monitoring.metadata.0.name
  }

  data = {
    "fluent-bit.conf" = file("./resources/fluent-bit/fluent-bit.conf")
    "parsers.conf"    = file("./resources/fluent-bit/parsers.conf")
  }
}

resource "kubernetes_daemonset" "fluent_bit" {

  depends_on = [
    kubernetes_stateful_set.influxdb
  ]

  metadata {
    name      = "fluent-bit"
    namespace = kubernetes_namespace.monitoring.metadata.0.name
  }

  spec {
    selector {
      match_labels = {
        app = "fluent-bit"
      }
    }
    strategy {
      type = "RollingUpdate"
    }
    template {
      metadata {
        labels = {
          app = "fluent-bit"
        }
      }

      spec {
        service_account_name            = kubernetes_service_account_v1.fluent_bit.metadata.0.name
        automount_service_account_token = true
        container {
          name              = "fluent-bit"
          image             = "fluent/fluent-bit:${local.fluent_bit_version}"
          image_pull_policy = "IfNotPresent"
          resources {
            requests = {
              memory = "100Mi"
            }
          }
          volume_mount {
            name       = "varlog"
            mount_path = "/var/log"
          }
          volume_mount {
            name       = "varlibdockercontainers"
            mount_path = "/var/lib/docker/containers"
            read_only  = true
          }
          volume_mount {
            name       = "config"
            mount_path = "/fluent-bit/etc/fluent-bit.conf"
            sub_path   = "fluent-bit.conf"
          }
          volume_mount {
            name       = "config"
            mount_path = "/fluent-bit/etc/parsers.conf"
            sub_path   = "parsers.conf"
          }
          volume_mount {
            name       = "geoip"
            mount_path = "/fluent-bit/etc/GeoLite2-City.mmdb"
            read_only  = true
          }
        }
        volume {
          name = "varlog"
          host_path {
            path = "/var/log"
          }
        }
        volume {
          name = "varlibdockercontainers"
          host_path {
            path = "/var/lib/docker/containers"
          }
        }
        volume {
          name = "config"
          config_map {
            name = kubernetes_config_map.fluent_bit.metadata.0.name
          }
        }
        volume {
          name = "geoip"
          host_path {
            path = "/var/lib/GeoIP/GeoLite2-City.mmdb"
          }
        }
      }
    }
  }
  lifecycle {
    replace_triggered_by = [
      kubernetes_config_map.fluent_bit
    ]
  }
}