From b2c8de65e6f9fe55a7014bf0ec09a386d270b395 Mon Sep 17 00:00:00 2001 From: Maureen Ononiwu Date: Sun, 3 Sep 2023 16:46:49 +0100 Subject: [PATCH] example/Docs: Removed Spec.Env & updated tutorial with receiver config Signed-off-by: Maureen Ononiwu --- example/collector-k8-manifest.yml | 8 ++----- example/config.yml | 4 ++-- example/tutorials/tutorial.md | 40 +++++++++++++++++++++++++++++-- 3 files changed, 42 insertions(+), 10 deletions(-) diff --git a/example/collector-k8-manifest.yml b/example/collector-k8-manifest.yml index bb402dc..d1d9cce 100644 --- a/example/collector-k8-manifest.yml +++ b/example/collector-k8-manifest.yml @@ -11,9 +11,8 @@ spec: config: | receivers: kubearmor_receiver: - endpoint: ${env:KUBEARMOR_SERVICE?default=kubearmor:32767} - logfilter: ${env:LOGFILTER?default=all} - + endpoint: kubearmor:32767 + logfilter: all exporters: logging: verbosity: detailed @@ -29,6 +28,3 @@ spec: exporters: - loki - logging - env: - - name: KUBEARMOR_SERVICE - value: kubearmor:32767 diff --git a/example/config.yml b/example/config.yml index 5000bdc..ec85413 100644 --- a/example/config.yml +++ b/example/config.yml @@ -1,7 +1,7 @@ receivers: kubearmor_receiver: - endpoint: ${env:KUBEARMOR_SERVICE?default=:32767} - logfilter: ${env:LOGFILTER?default=all} + endpoint: ${env:KUBEARMOR_SERVICE} + logfilter: ${env:LOGFILTER} exporters: logging: diff --git a/example/tutorials/tutorial.md b/example/tutorials/tutorial.md index 6904e6d..69cbb44 100644 --- a/example/tutorials/tutorial.md +++ b/example/tutorials/tutorial.md @@ -3,7 +3,7 @@ We would be creating an OpenTelemetry collector to test out the receiver. The OpenTelemetry Collector offers a vendor-agnostic implementation of how to receive, process and export telemetry data. Read more about it in the [docs](https://opentelemetry.io/docs/collector/). There are different versions: 1. [Collector-core collector](https://github.com/open-telemetry/opentelemetry-collector) - The components that are a part of this collector are fixed that i.e. components are not contributed to this collector. It is maintained by the OpenTelemetry community + The components that are a part of this collector are fixed i.e. components are not contributed to this collector. It is maintained by the OpenTelemetry community 2. [Collector contrib collector](https://github.com/open-telemetry/opentelemetry-collector-contrib) This consists of a growing number of components contributed by the community, observability vendors and any one in general with a need to create custom components for a specific use, 3. Custom collector @@ -57,6 +57,8 @@ kubectl apply -f example/collector-k8-manifest.yml kubectl logs -n kube-system ds/kubearmor-collector-collector -f ``` +***Learn about the receiver's configuration [here](tutorial.md#kubearmor-receiver-config).*** + #### Cleanup ```bash # delete the collector @@ -72,7 +74,7 @@ kubectl delete -f https://github.com/cert-manager/cert-manager/releases/latest/d ### COLLECTOR ON BARE METAL #### Run pre-built OpeneTelemetry collector -If you want to skip building the example collector yoursleves, you can use the pre-built one with: +If you want to skip building the example collector yourselves, you can use the pre-built one with: ```bash docker run -d --net=host --name=kubearmor-otel-receiver kubearmor/otel-receiver ``` @@ -106,12 +108,46 @@ Note: - `config.yml` file is located in this repo at `example/config.yml`. Examine the logs to see that it is properly running. + +***Learn about the receiver's configuration options [here](tutorial.md#kubearmor-receiver-config).*** + #### Cleanup ```bash # stop and remove the collector container docker stop kubearmor-otel-receiver; docker rm kubearmor-otel-receiver ``` +### Kubearmor receiver config. + +There are two configuration options for the receiver: + +- **endpoint:** + + This specifies kubearmor's server API URL. + +- **logfilter** + + This is used to specify which logs one is interested in. There are three filters: + + - kubearmorLogs: + + Use this if you want to see Kubearmor's internal logs only. + + - policy + + Use this if you want to see alerts only. + + - system + + Use this if you want to see logs about insights gotten by kubearmor about the host system only. + + - all + + Use this if you want to see internal logs, insights and alerts. + +Refer to [kubearmor_receiver/testdata/config.yml](kubearmor_receiver/testdata/config.yml) for a visual example on how to +place the options in your configuration file. + ## OpenTelemetry KubeArmor Logs pattern ```log {"resourceLogs":[{"resource":{},"scopeLogs":[{"scope":{},"logRecords":[{"timeUnixNano":"1679915426000","observedTimeUnixNano":"1679915426487671942","body":{"kvlistValue":{"values":[{"key":"HostPID","value":{"doubleValue":261}},{"key":"PPID","value":{"doubleValue":1}},{"key":"Operation","value":{"stringValue":"File"}},{"key":"Resource","value":{"stringValue":"/var/log/journal/b09389c7d40f420982b5facb1f6e1686"}},{"key":"Data","value":{"stringValue":"syscall=SYS_OPENAT fd=-100 flags=O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC"}},{"key":"Result","value":{"stringValue":"Passed"}},{"key":"UpdatedTime","value":{"stringValue":"2023-03-27T11:10:26.485913Z"}},{"key":"HostName","value":{"stringValue":"babe-chinwendum"}},{"key":"PID","value":{"doubleValue":261}},{"key":"Type","value":{"stringValue":"HostLog"}},{"key":"Source","value":{"stringValue":"/usr/lib/systemd/systemd-journald"}}]}},"traceId":"","spanId":""}]}]}]}