ta-k8s-logs.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app: ta-k8s-logs
  name: ta-k8s-logs
imagePullSecrets:
   - name: <yourdockerhubsecret>
---

apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: ta-k8s-logs
rules:
- apiGroups: ["", "apps","batch","extensions"]
  resources:
  - cronjobs
  - componentstatuses
  - configmaps
  - controllerrevisions
  - daemonsets
  - deployments
  - jobs
  - replicasets
  - replicationcontrollers
  - resourcequotas
  - scheduledjobs
  - statefulsets
  - namespaces
  - nodes
  - services
  - secrets
  - serviceaccounts
  - endpoints
  - pods
  verbs: ["get", "list", "watch"]
- nonResourceURLs: ["/metrics"]
  verbs: ["get"]

---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  labels:
    app: ta-k8s-logs
  name: ta-k8s-logs
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: ta-k8s-logs
subjects:
  - kind: ServiceAccount
    name: ta-k8s-logs
    namespace: default
---

apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  name: ta-k8s-logs
  labels:
    app: ta-k8s-logs
    name: ta-k8s-logs
spec:
  updateStrategy:
    type: RollingUpdate
  template:
    metadata:
      name: ta-k8s-logs
      labels:
        daemon: ta-k8s-logs
    spec:
      serviceAccountName: ta-k8s-logs
      tolerations:
      - operator: "Exists"
        effect: "NoSchedule"
      containers:
      - name: ta-k8s-logs
        image: splunk/universalforwarder:7.0.3-monitor-k8s-logs
        imagePullPolicy: Always 
        env:
         - name: SPLUNK_FORWARD_SERVER
           value: <splunk_host>:9997
         - name: SPLUNK_START_ARGS
           value: --accept-license --answer-yes
         - name: SPLUNK_USER
           value: root
        resources:
          limits:
            cpu: 1
            memory: 200Mi
          requests:
            cpu: 100m
            memory: 200Mi
        volumeMounts:
        - name: varlog
          mountPath: /var/log
          readOnly: true
        - name: varlibdockercontainers
          mountPath: /var/lib/docker/containers
          readOnly: true
        - name: dockersock
          mountPath: /var/run/docker.sock
          readOnly: true
        #- name: splunk-uf-etc
        #  mountPath: /opt/splunk/etc
        #- name: splunk-uf-var
        #  mountPath: /opt/splunk/var
      terminationGracePeriodSeconds: 30
      volumes:
      - name: varlog
        hostPath:
          path: /var/log
      - name: varlibdockercontainers
        hostPath:
          path: /var/lib/docker/containers
      - name: dockersock
        hostPath:
          path: /var/run/docker.sock
      #- name: splunk-uf-etc
      #  emptyDir: {}
      #  #hostPath:
      #  #  path: /var/lib/splunk-uf-etc
      #- name: splunk-uf-var
      #  emptyDir: {}
      #  #hostPath: 
      #  #  path: /var/lib/splunk-uf-var