Multi-tenant logging in Kommander is built on the DKP Logging architecture. Multi-tenant logging uses the same components as the base logging architecture:
Access to log data is done at the namespace level, through the use of Projects within Kommander as shown in the diagram:
Each Project namespace has a logging-operator “Flow” that sends its pod logs to its own Loki server. A custom controller deploys corresponding Loki and Grafana servers in each namespace, and defines a logging-operator Flow in each namespace that forwards its pod logs to its respective Loki server. There is a corresponding Grafana server for visualizations for each namespace.
For the convenience of cluster Administrators, a cluster-scoped Loki/Grafana instance pair is deployed with a corresponding Logging-operator
ClusterFlow that directs pod logs from all namespaces to the pair. A cluster Administrator can grant access either to none of the logs, or to all logs collected from all pods in a given namespace. Assigning teams to specific namespaces enables the team members to see only the logs for the namespaces they own.
As with any endpoint, if an Ingress controller is in use in the environment, take care that the ingress rules do not supersede the RBAC permissions and thus prevent access to the logs.
Enable Multi-tenant Logging
How to enable Multi-tenant Logging for use with Kommander…Read More
Create a Project for Logging
How to create a Project for use in multi-tenant logging…Read More
Create Project-level logging AppDeployments
How to create Project-level AppDeployments for use in multi-tenant logging…Read More
Verify Project Logging Stack Installation
How to verify the project logging stack installation for multi-tenant logging…Read More
View Project Log Data
How to view project log data within multi-tenant logging…Read More