Skip to content

Commit

Permalink
example/Docs: Removed Spec.Env & updated tutorial with receiver config
Browse files Browse the repository at this point in the history
Signed-off-by: Maureen Ononiwu <[email protected]>
  • Loading branch information
Chinwendu20 committed Sep 7, 2023
1 parent 9f702ef commit b2c8de6
Show file tree
Hide file tree
Showing 3 changed files with 42 additions and 10 deletions.
8 changes: 2 additions & 6 deletions example/collector-k8-manifest.yml
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,8 @@ spec:
config: |
receivers:
kubearmor_receiver:
endpoint: ${env:KUBEARMOR_SERVICE?default=kubearmor:32767}
logfilter: ${env:LOGFILTER?default=all}
endpoint: kubearmor:32767
logfilter: all
exporters:
logging:
verbosity: detailed
Expand All @@ -29,6 +28,3 @@ spec:
exporters:
- loki
- logging
env:
- name: KUBEARMOR_SERVICE
value: kubearmor:32767
4 changes: 2 additions & 2 deletions example/config.yml
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
receivers:
kubearmor_receiver:
endpoint: ${env:KUBEARMOR_SERVICE?default=:32767}
logfilter: ${env:LOGFILTER?default=all}
endpoint: ${env:KUBEARMOR_SERVICE}
logfilter: ${env:LOGFILTER}

exporters:
logging:
Expand Down
40 changes: 38 additions & 2 deletions example/tutorials/tutorial.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
We would be creating an OpenTelemetry collector to test out the receiver. The OpenTelemetry Collector offers a vendor-agnostic implementation of how to receive, process and export telemetry data. Read more about it in the [docs](https://opentelemetry.io/docs/collector/). There are different versions:

1. [Collector-core collector](https://github.com/open-telemetry/opentelemetry-collector)
The components that are a part of this collector are fixed that i.e. components are not contributed to this collector. It is maintained by the OpenTelemetry community
The components that are a part of this collector are fixed i.e. components are not contributed to this collector. It is maintained by the OpenTelemetry community
2. [Collector contrib collector](https://github.com/open-telemetry/opentelemetry-collector-contrib)
This consists of a growing number of components contributed by the community, observability vendors and any one in general with a need to create custom components for a specific use,
3. Custom collector
Expand Down Expand Up @@ -57,6 +57,8 @@ kubectl apply -f example/collector-k8-manifest.yml
kubectl logs -n kube-system ds/kubearmor-collector-collector -f
```

***Learn about the receiver's configuration [here](tutorial.md#kubearmor-receiver-config).***
#### Cleanup
```bash
# delete the collector
Expand All @@ -72,7 +74,7 @@ kubectl delete -f https://github.com/cert-manager/cert-manager/releases/latest/d
### COLLECTOR ON BARE METAL
#### Run pre-built OpeneTelemetry collector
If you want to skip building the example collector yoursleves, you can use the pre-built one with:
If you want to skip building the example collector yourselves, you can use the pre-built one with:
```bash
docker run -d --net=host --name=kubearmor-otel-receiver kubearmor/otel-receiver
```
Expand Down Expand Up @@ -106,12 +108,46 @@ Note:
- `config.yml` file is located in this repo at `example/config.yml`.
Examine the logs to see that it is properly running.
***Learn about the receiver's configuration options [here](tutorial.md#kubearmor-receiver-config).***

#### Cleanup
```bash
# stop and remove the collector container
docker stop kubearmor-otel-receiver; docker rm kubearmor-otel-receiver
```

### Kubearmor receiver config.

There are two configuration options for the receiver:

- **endpoint:**

This specifies kubearmor's server API URL.
- **logfilter**
This is used to specify which logs one is interested in. There are three filters:
- kubearmorLogs:
Use this if you want to see Kubearmor's internal logs only.

- policy

Use this if you want to see alerts only.

- system

Use this if you want to see logs about insights gotten by kubearmor about the host system only.

- all

Use this if you want to see internal logs, insights and alerts.

Refer to [kubearmor_receiver/testdata/config.yml](kubearmor_receiver/testdata/config.yml) for a visual example on how to
place the options in your configuration file.

## OpenTelemetry KubeArmor Logs pattern
```log
{"resourceLogs":[{"resource":{},"scopeLogs":[{"scope":{},"logRecords":[{"timeUnixNano":"1679915426000","observedTimeUnixNano":"1679915426487671942","body":{"kvlistValue":{"values":[{"key":"HostPID","value":{"doubleValue":261}},{"key":"PPID","value":{"doubleValue":1}},{"key":"Operation","value":{"stringValue":"File"}},{"key":"Resource","value":{"stringValue":"/var/log/journal/b09389c7d40f420982b5facb1f6e1686"}},{"key":"Data","value":{"stringValue":"syscall=SYS_OPENAT fd=-100 flags=O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC"}},{"key":"Result","value":{"stringValue":"Passed"}},{"key":"UpdatedTime","value":{"stringValue":"2023-03-27T11:10:26.485913Z"}},{"key":"HostName","value":{"stringValue":"babe-chinwendum"}},{"key":"PID","value":{"doubleValue":261}},{"key":"Type","value":{"stringValue":"HostLog"}},{"key":"Source","value":{"stringValue":"/usr/lib/systemd/systemd-journald"}}]}},"traceId":"","spanId":""}]}]}]}
Expand Down

0 comments on commit b2c8de6

Please sign in to comment.