diff --git a/example/collector-k8-manifest.yml b/example/collector-k8-manifest.yml index bb402dc..bb14873 100644 --- a/example/collector-k8-manifest.yml +++ b/example/collector-k8-manifest.yml @@ -11,8 +11,6 @@ spec: config: | receivers: kubearmor_receiver: - endpoint: ${env:KUBEARMOR_SERVICE?default=kubearmor:32767} - logfilter: ${env:LOGFILTER?default=all} exporters: logging: @@ -29,6 +27,3 @@ spec: exporters: - loki - logging - env: - - name: KUBEARMOR_SERVICE - value: kubearmor:32767 diff --git a/example/tutorials/tutorial.md b/example/tutorials/tutorial.md index 6904e6d..e6bb86d 100644 --- a/example/tutorials/tutorial.md +++ b/example/tutorials/tutorial.md @@ -112,6 +112,25 @@ Examine the logs to see that it is properly running. docker stop kubearmor-otel-receiver; docker rm kubearmor-otel-receiver ``` +### Kubearmor receiver config. + +There are two configuration options for the receiver: + +- endpoint: + This specifies kubearmor's server API URL. +- logfilter + This is used to specify which logs one is interested in. If none is specified all logs are received. There are three filters: + - kubearmorLogs: + Use this if you want to see kubearmor's application logs. + - policy + Use this if you want to see alerts. + - system + Use this if you want to see logs about insights gotten by kubearmor aboutt host system. + - all + Use this if you want to see the entire log messages. +Refer to [kubearmor_receiver/testdata/config.yml](kubearmor_receiver/testdata/config.yml) for a visual example on how to +place the options in your configuration file. + ## OpenTelemetry KubeArmor Logs pattern ```log {"resourceLogs":[{"resource":{},"scopeLogs":[{"scope":{},"logRecords":[{"timeUnixNano":"1679915426000","observedTimeUnixNano":"1679915426487671942","body":{"kvlistValue":{"values":[{"key":"HostPID","value":{"doubleValue":261}},{"key":"PPID","value":{"doubleValue":1}},{"key":"Operation","value":{"stringValue":"File"}},{"key":"Resource","value":{"stringValue":"/var/log/journal/b09389c7d40f420982b5facb1f6e1686"}},{"key":"Data","value":{"stringValue":"syscall=SYS_OPENAT fd=-100 flags=O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC"}},{"key":"Result","value":{"stringValue":"Passed"}},{"key":"UpdatedTime","value":{"stringValue":"2023-03-27T11:10:26.485913Z"}},{"key":"HostName","value":{"stringValue":"babe-chinwendum"}},{"key":"PID","value":{"doubleValue":261}},{"key":"Type","value":{"stringValue":"HostLog"}},{"key":"Source","value":{"stringValue":"/usr/lib/systemd/systemd-journald"}}]}},"traceId":"","spanId":""}]}]}]}