Skip to content

Commit 9cec125

Browse files
kaitlynmichaelkaitlynmichael
committed
Add log collector RBAC documentation and navigation improvements
- Added comprehensive log collector RBAC page with restricted and all mode configurations - Updated logs section index to include log collector RBAC documentation - Added direct links from collect-logs.md to specific YAML examples - Configured proper navigation order (collect logs before RBAC) - Each YAML example is in its own linkable subsection for direct referencing - Includes complete RBAC configurations using existing embed files from content/embeds/k8s/ - Provides security considerations and troubleshooting guidance
1 parent 10393e5 commit 9cec125

File tree

3 files changed

+220
-29
lines changed

3 files changed

+220
-29
lines changed

‎content/operate/kubernetes/logs/_index.md

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,28 @@
11
---
2-
Title: Redis Enterprise Software logs on Kubernetes
2+
Title: Logs
33
alwaysopen: false
44
categories:
55
- docs
66
- operate
77
- kubernetes
8-
description: This section provides information about how logs are stored and accessed.
8+
description: Access and manage Redis Enterprise logs on Kubernetes for monitoring and troubleshooting.
99
hideListLinks: true
1010
linkTitle: Logs
1111
weight: 60
1212
---
1313

14-
## Logs
14+
Access and manage Redis Enterprise logs on Kubernetes for monitoring, troubleshooting, and debugging your Redis Enterprise deployment. Logs provide valuable insights into cluster operations, database performance, and system health.
1515

16-
Each redis-enterprise container stores its logs under `/var/opt/redislabs/log`.
17-
When using persistent storage this path is automatically mounted to the
18-
`redis-enterprise-storage` volume.
19-
This volume can easily be accessed by a sidecar, i.e. a container residing on the same pod.
16+
## Log collection and access
17+
18+
Learn how to collect and access logs from your Redis Enterprise deployment:
19+
20+
- [Collect logs]({{< relref "/operate/kubernetes/logs/collect-logs" >}}) - Methods for collecting logs from Redis Enterprise pods and containers
21+
- [Log collector RBAC]({{< relref "/operate/kubernetes/logs/log-collector-rbac" >}}) - RBAC configurations for log collection in restricted and all modes
22+
23+
## Log storage and access
24+
25+
Each Redis Enterprise container stores its logs under `/var/opt/redislabs/log`. When using persistent storage, this path is automatically mounted to the `redis-enterprise-storage` volume, making logs accessible through sidecar containers or external log collection tools.
2026

2127
For example, in the REC (Redis Enterprise Cluster) spec you can add a sidecar container, such as a busybox, and mount the logs to there:
2228

‎content/operate/kubernetes/logs/collect-logs.md

Lines changed: 12 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -15,41 +15,31 @@ The Redis Enterprise cluster (REC) log collector script ([`log_collector.py`](ht
1515

1616
As of version 6.2.18-3, the log collector tool has two modes:
1717

18-
- **restricted** collects only resources and logs created by the operator and Redis Enterprise deployments
18+
- **[restricted]({{< relref "/operate/kubernetes/logs/log-collector-rbac#restricted-mode-rbac" >}})** collects only resources and logs created by the operator and Redis Enterprise deployments
1919
- This is the default for versions 6.2.18-3 and later
20-
- **all** collects everything from your environment
20+
- **[all]({{< relref "/operate/kubernetes/logs/log-collector-rbac#all-mode-rbac" >}})** collects everything from your environment
2121
- This is the default mode for versions 6.2.12-1 and earlier
2222

2323
{{<note>}} This script requires Python 3.6 or later. {{</note>}}
2424

2525
1. Download the latest [`log_collector.py`](https://github.com/RedisLabs/redis-enterprise-k8s-docs/blob/master/log_collector/log_collector.py) file.
2626

2727
1. Have a K8s administrator run the script on the system that runs your `kubectl` or `oc` commands.
28+
- Pass `-n` parameter to run on a different namespace than the one you are currently on
29+
- Pass `-m` parameter to change the log collector mode (`all` or `restricted`)
30+
- Run with `-h` to see more options
2831

2932
```bash
30-
python log_collector.py
33+
python log_collector.py
3134
```
3235

33-
## Options
36+
{{< note >}} If you get an error because the yaml module is not found, install the pyYAML module with `pip install pyyaml`.
37+
{{< /note >}}
3438

35-
You can run `log_collector.py` with the following options:
3639

37-
| Option | Description |
38-
|--------|-------------|
39-
| `-n`, `--namespace` | Sets the namespace(s) to collect from. Can be set to a single namespace, or multiple namespaces (comma-separated). When left empty, will use the current context's namespace from kubeconfig. |
40-
| `-o`, `--output_dir` | Sets the output directory. Defaults to current working directory. |
41-
| `-a`, `--logs_from_all_pods` | Collect logs from all pods in the selected namespace(s), and otherwise collect only from the operator and pods run by the operator. |
42-
| `-t`, `--timeout` | Time to wait for external commands to finish execution (Linux only). Default to 180s. Specify 0 to disable timeout. |
43-
| `--k8s_cli` | The K8s cli client to use (kubectl/oc/auto-detect). Defaults to auto-detect (chooses between 'kubectl' and 'oc'). Full paths can also be used. |
44-
| `-m`, `--mode` | Controls which resources are collected. In 'restricted' mode, only resources associated with the operator and have the label 'app=redis-enterprise' are collected. In 'all' mode, all resources are collected. Defaults to 'restricted' mode. |
45-
| `--collect_istio` | Collect data from istio-system namespace to debug potential problems related to istio ingress method. |
46-
| `--skip_support_package` | Disable collection of RS support package from Redis Enterprise nodes. |
47-
| `--collect_empty_files` | Collect empty log files for missing resources. |
48-
| `--helm_release_name` | Collect resources related to the given Helm release name. |
49-
| `--collect_rbac_resources` | Temporary development flag. Collect all role based access control related custom resources. |
50-
| `-h`, `--help` | Show help message and exit. |
51-
52-
{{< note >}} If you get an error because the yaml module is not found, install the pyYAML module with `pip install pyyaml`.
53-
{{< /note >}}
5440

5541
1. Upload the resulting `tar.gz` file containing all the logs to [Redis Support](https://support.redislabs.com/).
42+
43+
## RBAC requirements
44+
45+
The log collector requires specific RBAC permissions depending on the collection mode. See [Log collector RBAC]({{< relref "/operate/kubernetes/logs/log-collector-rbac" >}}) for complete YAML configurations for both restricted and all modes.

‎content/operate/kubernetes/logs/log-collector-rbac.md

Lines changed: 195 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,195 @@
1+
---
2+
Title: Log collector RBAC
3+
alwaysopen: false
4+
categories:
5+
- docs
6+
- operate
7+
- kubernetes
8+
description: RBAC configurations for Redis Enterprise log collector in all and restricted modes.
9+
linkTitle: Log collector RBAC
10+
weight: 90
11+
---
12+
13+
This page provides YAML examples for configuring RBAC permissions for the Redis Enterprise log collector tool. The log collector requires different permission levels depending on the collection mode you choose.
14+
15+
## Overview
16+
17+
The Redis Enterprise log collector script helps gather diagnostic information for troubleshooting. It has two collection modes that require different RBAC permissions:
18+
19+
- **Restricted mode**: Collects only Redis Enterprise-related resources and logs (default for versions 6.2.18-3+)
20+
- **All mode**: Collects comprehensive cluster information including non-Redis resources (default for versions 6.2.12-1 and earlier)
21+
22+
## When to use each mode
23+
24+
### Restricted mode (recommended)
25+
26+
Use restricted mode when:
27+
- You want to minimize security exposure
28+
- Your organization has strict RBAC policies
29+
- You only need Redis Enterprise-specific troubleshooting data
30+
- You're running version 6.2.18-3 or later (default mode)
31+
32+
### All mode
33+
34+
Use all mode when:
35+
- You need comprehensive cluster diagnostics
36+
- Redis Support specifically requests additional cluster information
37+
- You're troubleshooting complex issues that may involve non-Redis resources
38+
- You're running version 6.2.12-1 or earlier (default mode)
39+
40+
## Permission differences
41+
42+
The key differences between the two modes:
43+
44+
| Resource Category | Restricted Mode | All Mode |
45+
|------------------|----------------|----------|
46+
| **Cluster-level resources** | Limited | Full access |
47+
| **Node information** | ❌ No access | ✅ Full access |
48+
| **Storage classes** | ❌ No access | ✅ Full access |
49+
| **Volume attachments** | ❌ No access | ✅ Full access |
50+
| **Certificate signing requests** | ❌ No access | ✅ Full access |
51+
| **Operator resources** | ❌ No access | ✅ Full access |
52+
| **Istio resources** | ❌ No access | ✅ Full access |
53+
54+
## Restricted mode RBAC
55+
56+
Use restricted mode for minimal security exposure while still collecting essential Redis Enterprise diagnostics.
57+
58+
{{<embed-md "k8s/log_collector_role_restricted_mode.md">}}
59+
60+
### Restricted mode permissions
61+
62+
The restricted mode provides access to:
63+
64+
**Role permissions (namespace-scoped):**
65+
- **Pods and logs**: Read pod information and access container logs
66+
- **Pod exec**: Execute commands inside containers for diagnostics
67+
- **Core resources**: Access to services, endpoints, ConfigMaps, secrets, and storage resources
68+
- **Workload resources**: Read deployments, StatefulSets, DaemonSets, and jobs
69+
- **Redis Enterprise resources**: Full read access to all Redis Enterprise custom resources
70+
- **Networking**: Read ingress and network policy configurations
71+
- **OpenShift routes**: Read route configurations (for OpenShift environments)
72+
73+
**ClusterRole permissions (cluster-scoped):**
74+
- **Persistent volumes**: Read cluster-wide storage information
75+
- **Namespaces**: Read namespace information
76+
- **RBAC**: Read cluster roles and bindings
77+
- **Custom resource definitions**: Read Redis Enterprise CRDs
78+
- **Admission controllers**: Read ValidatingWebhook configurations
79+
80+
## All mode RBAC
81+
82+
Use all mode when you need comprehensive cluster diagnostics or when specifically requested by Redis Support.
83+
84+
{{<embed-md "k8s/log_collector_role_all_mode.md">}}
85+
86+
### All mode additional permissions
87+
88+
In addition to all restricted mode permissions, all mode provides:
89+
90+
**Additional ClusterRole permissions:**
91+
- **Nodes**: Read cluster node information and status
92+
- **Storage classes**: Read storage class configurations
93+
- **Volume attachments**: Read volume attachment status
94+
- **Certificate signing requests**: Read certificate management information
95+
- **Operator resources**: Read OLM (Operator Lifecycle Manager) resources
96+
- **Istio resources**: Read Istio service mesh configurations
97+
98+
## Role binding
99+
100+
Bind the Role to your service account in each namespace where you want to collect logs.
101+
102+
```yaml
103+
apiVersion: rbac.authorization.k8s.io/v1
104+
kind: RoleBinding
105+
metadata:
106+
name: redis-enterprise-log-collector
107+
namespace: <target-namespace>
108+
subjects:
109+
- kind: ServiceAccount
110+
name: redis-enterprise-log-collector
111+
namespace: <service-account-namespace>
112+
roleRef:
113+
kind: Role
114+
name: redis-enterprise-log-collector
115+
apiGroup: rbac.authorization.k8s.io
116+
```
117+
118+
## Cluster role binding
119+
120+
Bind the ClusterRole to your service account for cluster-wide permissions.
121+
122+
```yaml
123+
apiVersion: rbac.authorization.k8s.io/v1
124+
kind: ClusterRoleBinding
125+
metadata:
126+
name: redis-enterprise-log-collector
127+
subjects:
128+
- kind: ServiceAccount
129+
name: redis-enterprise-log-collector
130+
namespace: <service-account-namespace>
131+
roleRef:
132+
kind: ClusterRole
133+
name: redis-enterprise-log-collector
134+
apiGroup: rbac.authorization.k8s.io
135+
```
136+
137+
## Usage
138+
139+
Apply the appropriate RBAC configuration and role bindings, then run the log collector with the desired mode:
140+
141+
```bash
142+
# Restricted mode (default for 6.2.18-3+)
143+
python log_collector.py -m restricted -n <namespace>
144+
145+
# All mode
146+
python log_collector.py -m all -n <namespace>
147+
```
148+
149+
## Security considerations
150+
151+
### Principle of least privilege
152+
153+
- **Start with restricted mode**: Use restricted mode unless you specifically need additional cluster information
154+
- **Limit namespace access**: Only grant permissions in namespaces where log collection is needed
155+
- **Time-bound access**: Consider creating temporary RBAC resources for log collection activities
156+
157+
### Sensitive data handling
158+
159+
Both modes collect:
160+
- **Secrets metadata**: Names and types of secrets (not the actual secret values)
161+
- **ConfigMap data**: Configuration information that may contain sensitive settings
162+
- **Pod logs**: Application logs that may contain sensitive information
163+
164+
Ensure collected logs are handled according to your organization's data security policies.
165+
166+
## Troubleshooting
167+
168+
### Permission denied errors
169+
170+
If you encounter permission errors:
171+
172+
1. **Verify RBAC resources**: Ensure roles and bindings are applied correctly
173+
2. **Check service account**: Confirm the service account has the necessary bindings
174+
3. **Validate namespace access**: Ensure role bindings exist in target namespaces
175+
4. **Review mode requirements**: Verify you're using the correct mode for your needs
176+
177+
### Missing resources
178+
179+
If the log collector reports missing resources:
180+
181+
1. **Check cluster role permissions**: Ensure ClusterRole is applied and bound
182+
2. **Verify CRD access**: Confirm access to Redis Enterprise custom resource definitions
183+
3. **Review mode selection**: Consider switching to all mode if additional resources are needed
184+
185+
## Next steps
186+
187+
- [Learn about log collection]({{< relref "/operate/kubernetes/logs/collect-logs" >}})
188+
- [Explore YAML deployment examples]({{< relref "/operate/kubernetes/reference/yaml-examples" >}})
189+
- [Configure monitoring]({{< relref "/operate/kubernetes/re-clusters/connect-prometheus-operator" >}})
190+
191+
## Related documentation
192+
193+
- [Collect logs guide]({{< relref "/operate/kubernetes/logs/collect-logs" >}})
194+
- [Kubernetes RBAC](https://kubernetes.io/docs/reference/access-authn-authz/rbac/)
195+
- [Redis Enterprise troubleshooting]({{< relref "/operate/kubernetes/logs" >}})

0 commit comments

Comments
 (0)