#部署crd
kubectl create -f https://download.elastic.co/downloads/eck/2.12.1/crds.yaml
kubectl apply -f https://download.elastic.co/downloads/eck/2.1

cat <<EOF | kubectl apply -f -
apiVersion: elasticsearch.k8s.elastic.co/v1
kind: Elasticsearch
metadata:
  name: es-cluster
spec:
version: 8.13.2
  nodeSets:
  - name: default
    count:1
    config:
      node.store.allow_mmap: false
    volumeClaimTemplates:
    - metadata:
      name: elasticsearch-data
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 10Gi
        storageClassName: nfs-csi-es
EOF

kubectl get secret es-cluster-es-elastic-user -o yaml
data:
  elastic: XXXX   #这段是密码

echo XXXXXX  | base64 -d

curl -u"ekastic:XXXXX" -k https://es-cluster-es-http.NAMESAPCE.svc:9200

cat <<EOF | kubectl apply -f -
apiVersion: kibana.k8s.elastic.co/v1
kind: Kibana
metadata:
  name: kibana
spec:
version: 8.13.2
  count:1
  elasticsearchRef:
    name: es-cluster    #      和es集群名称一致
  http:                 #关闭默认的https。
    tls:
      selfSignedCertificate:
        disabled: true
  podTemplate:     #设置pod模板资源，添加了标签和资源使用限制
    metadata:
      labels:
        app: kibana
    spec:
      containers:
      - name: kibana
        resources:
          limits:
            memory: 1Gi
            cpu: 1
EOF

apiVersion: beat.k8s.elastic.co/v1beta1
kind: Beat
metadata:
  name: filebeat
  namespace: elastic-system
spec:
type: filebeat
version: 8.13.2
  elasticsearchRef:       #关联es和kibana
    name: "es-cluster"
  kibanaRef:
    name: "kibana"
  config:
    filebeat:
      autodiscover:
        providers:
        - type: kubernetes
          node: ${NODE_NAME}       #node名称
          hints:
            enabled: true
            default_config:
              type: container
              paths:
              - var/log/containers/*${data.kubernetes.container.id}.log
        processors:
        - add_kubernetes_metadata:
            host: ${NODE_NAME}
            matchers:
            - logs_path:
                logs_path: "/var/log/containers/"
        - drop_event.when:    
            or:              #忽略掉一些namespace下的日志收集
            - equals:      
kubernetes.namespace: "kube-system"
            - equals:
kubernetes.namespace: "logging"
            - equals:
kubernetes.namespace: "ingress-nginx"
            - equals:
kubernetes.namespace: "kube-node-lease"
            - equals:
kubernetes.namespace: "elastic-system"
  daemonSet:
    podTemplate:
      spec:
        serviceAccountName: filebeat
automountServiceAccountToken: true
terminationGracePeriodSeconds:30
        dnsPolicy: ClusterFirstWithHostNet
        hostNetwork: true # Allows to provide richer host metadata
        containers:
        - name: filebeat
          securityContext:
            runAsUser: 0
            # If using Red Hat OpenShift uncomment this:
            #privileged: true
          volumeMounts:
          - name: varlogcontainers
            mountPath: var/log/containers
          - name: varlogpods
            mountPath: var/log/pods
          - name: varlibdockercontainers
            mountPath: var/lib/docker/containers
          env:
            - name: NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
        volumes:
        - name: varlogcontainers
          hostPath:
            path: var/log/containers
        - name: varlogpods
          hostPath:
            path: var/log/pods
        - name: varlibdockercontainers
          hostPath:
            path: var/lib/docker/containers
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: filebeat
rules:
- apiGroups: [""] # "" indicates the core API group
  resources:
  - namespaces
  - pods
  - nodes
verbs:
  - get
  - watch
  - list
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: filebeat
  namespace: elastic-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: filebeat
subjects:
- kind: ServiceAccount
  name: filebeat
  namespace: elastic-system
roleRef:
  kind: ClusterRole
  name: filebeat
  apiGroup: rbac.authorization.k8s.io
---
#查看是否收到了日志
curl -u'slastic:XXXX' -k https://es-cluster.NAMESPACE.svc:9200/_cat/indices