Terraform IBM Logs agent module

This module deploys the following logs agent to an IBM Cloud Red Hat OpenShift Container Platform or Kubernetes cluster:

Logs agent

Overview

terraform-ibm-logs-agent

Usage

# ############################################################################
# Init cluster config for helm
# ############################################################################

data "ibm_container_cluster_config" "cluster_config" {
  cluster_name_id = "xxxxxxxxx" # replace with cluster ID or name
}

# ############################################################################
# Config providers
# ############################################################################

provider "ibm" {
  ibmcloud_api_key = "xxxxxxxxxxxx"  # pragma: allowlist secret
}

provider "helm" {
  kubernetes {
    host                   = data.ibm_container_cluster_config.cluster_config.host
    token                  = data.ibm_container_cluster_config.cluster_config.token
    cluster_ca_certificate = data.ibm_container_cluster_config.cluster_config.ca_certificate
  }
  # No registry authentication required - using public registries
}

provider "kubernetes" {
  host                   = data.ibm_container_cluster_config.cluster_config.host
  token                  = data.ibm_container_cluster_config.cluster_config.token
  cluster_ca_certificate = data.ibm_container_cluster_config.cluster_config.ca_certificate
}

# ############################################################################
# Install Logs Agent
# ############################################################################

module "logs_agent_module" {
  source                        = "terraform-ibm-modules/logs-agent/ibm"
  version                       = "X.Y.Z" # replace with actual version of module to consume
  cluster_id                    = "xxxxxxx" # replace with ID of the cluster
  cluster_resource_group_id     = "xxxxxxx" # replace with ID of the cluster resource group
  logs_agent_trusted_profile_id = "XXXXXXXX" # replace with ID of the trusted profile to use for authentication
  cloud_logs_ingress_endpoint   = "<cloud-logs-instance-guid>.ingress.us-south.logs.cloud.ibm.com"
  cloud_logs_ingress_port       = 443
}

Required IAM access policies

You need the following permissions to run this module.

Service
- Resource group only
  - Viewer access on the specific resource group
- Kubernetes service
  - Viewer platform access
  - Manager service access

Requirements

Name	Version
terraform	>= 1.9.0
helm	>= 3.0.0, <4.0.0
ibm	>= 1.81.1, <2.0.0

Modules

No modules.

Resources

Name	Type
helm_release.logs_agent	resource
ibm_container_cluster.cluster	data source
ibm_container_cluster_config.cluster_config	data source
ibm_container_vpc_cluster.cluster	data source

Inputs

Name	Description	Type	Default	Required
cloud_logs_ingress_endpoint	The host for IBM Cloud Logs ingestion. Ensure you use the ingress endpoint. See https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-endpoints_ingress.	`string`	n/a	yes
cloud_logs_ingress_port	The target port for the IBM Cloud Logs ingestion endpoint. The port must be 443 if you connect by using a VPE gateway, or port 3443 when you connect by using CSEs.	`number`	`3443`	no
cluster_config_endpoint_type	The type of endpoint to use for the cluster config access: `default`, `private`, `vpe`, or `link`. The `default` value uses the default endpoint of the cluster.	`string`	`"default"`	no
cluster_id	The ID of the cluster to deploy the agent.	`string`	n/a	yes
cluster_resource_group_id	The resource group ID of the cluster.	`string`	n/a	yes
enable_annotations	Set to true to include pod annotations in log records. Default annotations such as pod IP address and container ID, along with any custom annotations on the pod, will be included. This can help filter logs based on pod annotations in Cloud Logs.	`bool`	`false`	no
enable_multiline	Enable or disable multiline log support. Learn more	`bool`	`false`	no
is_vpc_cluster	Specify true if the target cluster for the agent is a VPC cluster, false if it is a classic cluster.	`bool`	`true`	no
log_filters	List of additional filters to be applied on logs. Learn more.	`any`	`[]`	no
logs_agent_additional_metadata	The list of additional metadata fields to add to the routed logs.	list(object({ key = optional(string) value = optional(string) }))	`[]`	no
logs_agent_chart	The name of the Helm chart to deploy.	`string`	`"logs-agent-helm"`	no
logs_agent_chart_location	The location of the Logs agent helm chart.	`string`	`"oci://icr.io/ibm-observe"`	no
logs_agent_chart_version	The version of the Helm chart to deploy.	`string`	`"1.6.3"`	no
logs_agent_enable_scc	Whether to enable creation of Security Context Constraints in Openshift. When installing on an OpenShift cluster, this setting is mandatory to configure permissions for pods within your cluster.	`bool`	`true`	no
logs_agent_exclude_log_source_paths	The list of log sources to exclude. Specify the paths that the Logs agent ignores.	`list(string)`	`[]`	no
logs_agent_iam_api_key	The IBM Cloud API key for the Logs agent to authenticate and communicate with the IBM Cloud Logs. It is required if `logs_agent_iam_mode` is set to `IAMAPIKey`.	`string`	`null`	no
logs_agent_iam_environment	IAM authentication Environment: `Production` or `PrivateProduction` or `Staging` or `PrivateStaging`. `Production` specifies the public endpoint & `PrivateProduction` specifies the private endpoint.	`string`	`"PrivateProduction"`	no
logs_agent_iam_mode	IAM authentication mode: `TrustedProfile` or `IAMAPIKey`.	`string`	`"TrustedProfile"`	no
logs_agent_image_version	The version of the Logs agent image to deploy.	`string`	`"1.6.3@sha256:c4c03d39002278558e7be9a7349a3408c703de788ebc7ef5846edf1f8f5e4584"`	no
logs_agent_init_image_version	The version of the Logs agent init container image to deploy.	`string`	`"1.6.3@sha256:0696d9be28088aad5ebcce26855d6de9abd7d4b0f8b98d050fb4507625ca465f"`	no
logs_agent_log_source_namespaces	The list of namespaces from which logs should be forwarded by agent. If namespaces are not listed, logs from all namespaces will be sent.	`list(string)`	`[]`	no
logs_agent_name	The name of the Logs agent. The name is used in all Kubernetes and Helm resources in the cluster.	`string`	`"logs-agent"`	no
logs_agent_namespace	The namespace where the Logs agent is deployed. The default value is `ibm-observe`.	`string`	`"ibm-observe"`	no
logs_agent_resources	The resources configuration for cpu/memory/storage. Learn More	object({ limits = object({ cpu = string memory = string }) requests = object({ cpu = string memory = string }) })	{ "limits": { "cpu": "500m", "memory": "3Gi" }, "requests": { "cpu": "100m", "memory": "1Gi" } }	no
logs_agent_selected_log_source_paths	The list of specific log sources paths. Logs will only be collected from the specified log source paths. If no paths are specified, it will send logs from `/var/log/containers`.	`list(string)`	`[]`	no
logs_agent_system_logs	The list of additional log sources. By default, the Logs agent collects logs from a single source at `/var/log/containers/*.log`.	`list(string)`	`[]`	no
logs_agent_tolerations	List of tolerations to apply to Logs agent. The default value means a pod will run on every node.	list(object({ key = optional(string) operator = optional(string) value = optional(string) effect = optional(string) tolerationSeconds = optional(number) }))	[ { "operator": "Exists" } ]	no
logs_agent_trusted_profile_id	The IBM Cloud trusted profile ID. Used only when `logs_agent_iam_mode` is set to `TrustedProfile`. The trusted profile must have an IBM Cloud Logs `Sender` role.	`string`	`null`	no
max_unavailable	The maximum number of pods that can be unavailable during a DaemonSet rolling update. Accepts absolute number or percentage (e.g., '1' or '10%').	`string`	`"1"`	no
wait_till	To avoid long wait times when you run your Terraform code, you can specify the stage when you want Terraform to mark the cluster resource creation as completed. Depending on what stage you choose, the cluster creation might not be fully completed and continues to run in the background. However, your Terraform code can continue to run without waiting for the cluster to be fully created. Supported args are `MasterNodeReady`, `OneWorkerNodeReady`, `IngressReady` and `Normal`	`string`	`"Normal"`	no
wait_till_timeout	Timeout for wait_till in minutes.	`number`	`90`	no

Outputs

No outputs.

Contributing

You can report issues and request features for this module in GitHub issues in the module repo. See Report an issue or request a feature.

To set up your local development environment, see Local development setup in the project documentation.

License

terraform-ibm-modules/terraform-ibm-logs-agent

About

Topics

Resources

License

Code of conduct

Contributing

Uh oh!

Stars

Watchers

Forks

Releases 38

Packages 0

Contributors 13

Uh oh!

Languages

Packages