The following procedure shows how to configure log rotation and syslog running in a sidecar container.

Creating the Log Directory and Configuring Log Rotation

  • Create the log directory on all the nodes, including the master, and change its owner to whatever user has ID 1000.

    mkdir /var/log/nsx-ujo
    chown localadmin:localadmin /var/log/nsx-ujo
  • Configure log rotation on all the nodes for the /var/log/nsx-ujo directory.

    cat <<EOF >  /etc/logrotate.d/nsx-ujo
    /var/log/nsx-ujo/*.log {
           copytruncate
           daily
           size 100M
           rotate 4
           delaycompress
           compress
           notifempty
           missingok
    }
    EOF

Creating the NCP Replication Controller

  • Create the ncp.ini file for NCP.

    cat <<EOF > /tmp/ncp.ini
    [DEFAULT]
    log_dir = /var/log/nsx-ujo
    [coe]
    cluster = k8s-cl1
    [k8s]
    apiserver_host_ip = 10.114.209.77
    apiserver_host_port = 6443
    ca_file = /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
    client_token_file = /var/run/secrets/kubernetes.io/serviceaccount/token
    insecure = True
    ingress_mode = nat
    [nsx_v3]
    nsx_api_user = admin
    nsx_api_password = Password1!
    nsx_api_managers = 10.114.209.68
    insecure = True
    subnet_prefix = 29
    [nsx_node_agent]
    [nsx_kube_proxy]
    ovs_uplink_port = ens192
    EOF
  • Create the config map from the ini file.

    kubectl create configmap nsx-ncp-config-with-logging --from-file=/tmp/ncp.ini
  • Create the NCP rsyslog config.

    cat <<EOF > /tmp/nsx-ncp-rsyslog.conf
    # yaml template for NCP ReplicationController
    # Correct kubernetes API and NSX API parameters, and NCP Docker image
    # must be specified.
    apiVersion: v1
    kind: ConfigMap
    metadata:
        name: rsyslog-config
        labels:
            version: v1
    data:
        ncp.conf: |
            module(load="imfile")
    
            ruleset(name="remote") {
                action(type="omfwd"
                       Protocol="tcp"
                       Target="nsx.licf.vmware.com"
                       Port="514")
    
                stop
            }
    
            input(type="imfile"
                  File="/var/log/nsx-ujo/ncp.log"
                  Tag="ncp"
                  Ruleset="remote")
    EOF
  • Create the config map from the above.

    kubectl create -f /tmp/nsx-ncp-rsyslog.conf
  • Create the NCP replication controller with the rsyslog sidecar.

    cat <<EOF > /tmp/ncp-rc-with-logging.yml
    # Replication Controller yaml for NCP
    apiVersion: v1
    kind: ReplicationController
    metadata:
      # VMware NSX Container Plugin
      name: nsx-ncp
      labels:
        tier: nsx-networking
        component: nsx-ncp
        version: v1
    spec:
      # Active-Active/Active-Standby is not supported in current release.
      # so replica *must be* 1.
      replicas: 1
      template:
        metadata:
          labels:
            tier: nsx-networking
            component: nsx-ncp
            version: v1
        spec:
          # NCP shares the host management network.
          hostNetwork: true
          nodeSelector:
            kubernetes.io/hostname: k8s-master
          tolerations:
          - key: "node-role.kubernetes.io/master"
            operator: "Exists"
            effect: "NoSchedule"
          containers:
            - name: nsx-ncp
              # Docker image for NCP
              image: nsx-ujo-docker-local.artifactory.eng.vmware.com/nsx-ncp:ob-6236425
              imagePullPolicy: IfNotPresent
              readinessProbe:
                exec:
                  command:
                  - cat
                  - /tmp/ncp_ready
                initialDelaySeconds: 5
                periodSeconds: 5
                failureThreshold: 5
              securityContext:
                capabilities:
                  add:
                    - NET_ADMIN
                    - SYS_ADMIN
                    - SYS_PTRACE
                    - DAC_READ_SEARCH
              volumeMounts:
              - name: config-volume
                # NCP expects ncp.ini is present in /etc/nsx-ujo
                mountPath: /etc/nsx-ujo
              - name: log-volume
                mountPath: /var/log/nsx-ujo
            - name: rsyslog
              image: jumanjiman/rsyslog
              imagePullPolicy: IfNotPresent
              volumeMounts:
              - name: rsyslog-config-volume
                mountPath: /etc/rsyslog.d
                readOnly: true
              - name: log-volume
                mountPath: /var/log/nsx-ujo
          volumes:
            - name: config-volume
              # ConfigMap nsx-ncp-config is expected to supply ncp.ini
              configMap:
                name: nsx-ncp-config-with-logging
            - name: rsyslog-config-volume
              configMap:
                name: rsyslog-config
            - name: log-volume
              hostPath:
                path: /var/log/nsx-ujo/
    EOF
  • Create NCP with the above specification.

    kubectl apply -f /tmp/ncp-rc-with-logging.yml

Creating the NSX Node Agent Daemon Set

  • Create the rsyslog configuration for the node agents.

    cat <<EOF > /tmp/nsx-node-agent-rsyslog.conf
    # yaml template for NCP ReplicationController
    # Correct kubernetes API and NSX API parameters, and NCP Docker image
    # must be specified.
    apiVersion: v1
    kind: ConfigMap
    metadata:
        name: rsyslog-config-node-agent
        labels:
            version: v1
    data:
        ncp.conf: |
            module(load="imfile")
    
            ruleset(name="remote") {
                action(type="omfwd"
                       Protocol="tcp"
                       Target="nsx.licf.vmware.com"
                       Port="514")
    
                stop
            }
    
            input(type="imfile"
                  File="/var/log/nsx-ujo/nsx_kube_proxy.log"
                  Tag="nsx_kube_proxy"
                  Ruleset="remote")
    
            input(type="imfile"
                  File="/var/log/nsx-ujo/nsx_node_agent.log"
                  Tag="nsx_node_agent"
                  Ruleset="remote")
    EOF
  • Create the configmap from the above.

    kubectl create -f /tmp/nsx-node-agent-rsyslog.conf
  • Create the DaemonSet with the configmap sidecar.

    cat <<EOF > /tmp/nsx-node-agent-rsyslog.yml
    # nsx-node-agent DaemonSet
    apiVersion: extensions/v1beta1
    kind: DaemonSet
    metadata:
      name: nsx-node-agent
      labels:
        tier: nsx-networking
        component: nsx-node-agent
        version: v1
    spec:
      template:
        metadata:
          annotations:
            container.apparmor.security.beta.kubernetes.io/nsx-node-agent: localhost/node-agent-apparmor
          labels:
            tier: nsx-networking
            component: nsx-node-agent
            version: v1
        spec:
          hostNetwork: true
          tolerations:
          - key: "node-role.kubernetes.io/master"
            operator: "Exists"
            effect: "NoSchedule"
          containers:
            - name: nsx-node-agent
              # Docker image for NCP
              image: nsx-ujo-docker-local.artifactory.eng.vmware.com/nsx-ncp:ob-6236425
              imagePullPolicy: IfNotPresent
              # override NCP image entrypoint
              command: ["nsx_node_agent"]
              livenessProbe:
                exec:
                  command:
                    - /bin/sh
                    - -c
                    - ps aux | grep [n]sx_node_agent
                initialDelaySeconds: 5
                periodSeconds: 5
              securityContext:
                capabilities:
                  add:
                    - NET_ADMIN
                    - SYS_ADMIN
                    - SYS_PTRACE
                    - DAC_READ_SEARCH
              volumeMounts:
              # ncp.ini
              - name: config-volume
                mountPath: /etc/nsx-ujo
              # mount openvswitch dir
              - name: openvswitch
                mountPath: /var/run/openvswitch
              # mount CNI socket path
              - name: cni-sock
                mountPath: /var/run/nsx-ujo
              # mount container namespace
              - name: netns
                mountPath: /var/run/netns
              # mount host proc
              - name: proc
                mountPath: /host/proc
                readOnly: true
              - name: log-volume
                mountPath: /var/log/nsx-ujo
            - name: nsx-kube-proxy
              # Docker image for NCP
              image: nsx-ujo-docker-local.artifactory.eng.vmware.com/nsx-ncp:ob-6236425
              imagePullPolicy: IfNotPresent
              # override NCP image entrypoint
              command: ["nsx_kube_proxy"]
              livenessProbe:
                exec:
                  command:
                    - /bin/sh
                    - -c
                    - ps aux | grep [n]sx_kube_proxy
                initialDelaySeconds: 5
                periodSeconds: 5
              securityContext:
                capabilities:
                  add:
                    - NET_ADMIN
                    - SYS_ADMIN
                    - SYS_PTRACE
                    - DAC_READ_SEARCH
              volumeMounts:
              # ncp.ini
              - name: config-volume
                mountPath: /etc/nsx-ujo
              # mount openvswitch dir
              - name: openvswitch
                mountPath: /var/run/openvswitch
              - name: log-volume
                mountPath: /var/log/nsx-ujo
            - name: rsyslog
              image: jumanjiman/rsyslog
              imagePullPolicy: IfNotPresent
              volumeMounts:
              - name: rsyslog-config-volume
                mountPath: /etc/rsyslog.d
                readOnly: true
              - name: log-volume
                mountPath: /var/log/nsx-ujo
          volumes:
            - name: config-volume
              configMap:
                name: nsx-ncp-config-with-logging
            - name: cni-sock
              hostPath:
                path: /var/run/nsx-ujo
            - name: netns
              hostPath:
                path: /var/run/netns
            - name: proc
              hostPath:
                path: /proc
            - name: openvswitch
              hostPath:
                path: /var/run/openvswitch
            - name: rsyslog-config-volume
              configMap:
                name: rsyslog-config-node-agent
            - name: log-volume
              hostPath:
                path: /var/log/nsx-ujo/
    EOF
  • Create the DaemonSet.

    kubectl apply -f /tmp/nsx-node-agent-rsyslog.yml