Logging in Kubernetes

Overview

Kubernetes logging requires collecting container stdout/stderr streams and node-level system logs in a centralized platform.

Typical Architecture

flowchart TD
    A[Pod Logs] --> B[DaemonSet Collector]
    B --> C[Log Backend]
    C --> D[Dashboards]

Practical Example

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: fluent-bit
spec:
  template:
    spec:
      containers:
      - name: fluent-bit
        image: fluent/fluent-bit:2.2

Production Example

Clusters often ship namespace, pod, and container labels with every log event to accelerate tenant and service filtering during incidents.

Common Pitfalls

• Missing pod metadata enrichment
• Losing logs during node termination
• No separation between application and audit logs

Key Takeaways

• Kubernetes logging must be centralized and metadata-rich.
• Collector reliability is critical for incident forensics.
• Label context enables efficient triage across large clusters.