$30 off During Our Annual Pro Sale. View Details »

Reliable Log Aggregation System in Multi-Tenant Kubernetes cluster

Reliable Log Aggregation System in Multi-Tenant Kubernetes cluster

LINE DEVDAY 2021
PRO

November 10, 2021
Tweet

More Decks by LINE DEVDAY 2021

Other Decks in Technology

Transcript

  1. None
  2. Speaker: Hiroki Sakamoto - Role: Site Reliability Engineer at Verda

    - Mission: Improving System Reliability - Interest: Kubernetes, Distributed System 
  3. Background 

  4. What is Verda? is based on OpenStack. since 2016~ FaaS

    PaaS IaaS NAT LB Bare metal 
  5. What is Verda? Virtual Machines 74,000+ Physical Machines 30,000+ Hypervisors

    4,000+ 
  6. SRE Teams for Verda Platform wide SRE Provide Verda-Internal platform

    to improve Verda services reliability Infra Management Manage our physical infrastructure resources to host Verda services 
  7. SRE Teams for Verda Platform wide SRE Provide Verda-Internal platform

    to improve Verda services reliability Here! 
  8. Log aggregation in Verda 

  9. Presentation Targets  Targets - The people who address the

    issues similar to ours - The people who are thinking about Multi-Tenant architecture - The people who can make decision about architecture Theme - Config Management in Multi-Tenant Kuberenetes - Operation for Fluentd in Multi-Tenant Kubernetes
  10. Benefits  - Get a useful idea to address the

    config management in Multi- Tenant Kubernetes - Get knowledge about log management and config management in Multi-Tenant Kuberetes before your release
  11. Issues about logging in Verda 

  12. Provide Multi-Tenant Kubernetes for Verda Purpose - Aggregate infra resources

    - Standardize operations - Provide internal platform tools to reduce operation costs /PWB /FVUSPO ,FZTUPOF .POJUPSJOH -PBECBMBODFS /"5 %BTICPBSE %FTJHOBUF $JOEFS 
  13. Original log aggregation mechanism /PWB"1* emptydir -PHSPUBUFE /FVUSPO"1* emptydir -PHSPUBUFE

    Elasticsearch 
  14. Original log aggregation mechanism /PWB"1* emptydir -PHSPUBUFE /FVUSPO"1* emptydir -PHSPUBUFE

    Elasticsearch - Fluentd and Logrotated are in a Pod as sidecars - Emptydir is used to share log files among the containers 
  15. Original log aggregation mechanism /PWB"1* emptydir -PHSPUBUFE /FVUSPO"1* emptydir -PHSPUBUFE

    Elasticsearch Generate logs! 
  16. Original log aggregation mechanism /PWB"1* emptydir -PHSPUBUFE /FVUSPO"1* emptydir -PHSPUBUFE

    Elasticsearch Tail logs 
  17. Original log aggregation mechanism /PWB"1* emptydir -PHSPUBUFE /FVUSPO"1* emptydir -PHSPUBUFE

    Elasticsearch Send logs 
  18. Original log aggregation mechanism /PWB"1* emptydir -PHSPUBUFE /FVUSPO"1* emptydir -PHSPUBUFE

    Elasticsearch Rotate logs If needed 
  19. Original log aggregation mechanism /PWB"1* emptydir -PHSPUBUFE /FVUSPO"1* emptydir -PHSPUBUFE

    Elasticsearch Pain Points - Too many sidecars in all of the Pods - All developers must maintain Fluentd regardless of their knowledge - Lack of monitoring, taking care of performance, reliability and durability 
  20. Original log aggregation mechanism /PWB"1* emptydir -PHSPUBUFE /FVUSPO"1* emptydir -PHSPUBUFE

    Elasticsearch Hard to schedule pods efficiently due to too many containers!! 
  21. Original log aggregation mechanism /PWB"1* emptydir -PHSPUBUFE /FVUSPO"1* emptydir -PHSPUBUFE

    Elasticsearch Hard to schedule pods efficiently due to too many containers!! Quality depends on each teams 
  22. Original log aggregation mechanism /PWB"1* emptydir -PHSPUBUFE /FVUSPO"1* emptydir -PHSPUBUFE

    Elasticsearch Hard to schedule pods efficiently due to too many containers!! Quality depends on each teams Need to send “Audit logs” but don’t have enough monitoring 
  23. Original log aggregation mechanism /PWB"1* emptydir -PHSPUBUFE /FVUSPO"1* emptydir -PHSPUBUFE

    Elasticsearch 5XFNPKJzCZ$PQZSJHIU5XJUUFS *ODBOEPUIFSDPOUSJCVUPSTJTMJDFOTFEVOEFS$$#: 
  24. Original log aggregation mechanism /PWB"1* emptydir -PHSPUBUFE /FVUSPO"1* emptydir -PHSPUBUFE

    Elasticsearch We need to re-think! 
  25. Solutions for the issues 

  26. 2 solutions Provide Managed Fluentd cluster Provide Fluentd Config Operator

    
  27. 2 solutions Provide Managed Fluentd cluster Provide Fluentd Config Operator

    
  28. Managed Fluentd Cluster /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout

    logfile "HHSFHBUPS/PEFT Elasticsearch Forwarder Aggregator Aggregator Aggregator /PEF# /PWB /FVUSPO ,FZTUPOF stdout stdout stdout logfile Forwarder 
  29. Managed Fluentd Cluster /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout

    logfile "HHSFHBUPS/PEFT Elasticsearch Forwarder Aggregator Aggregator Aggregator /PEF# /PWB /FVUSPO ,FZTUPOF stdout stdout stdout logfile Forwarder Managed scope 
  30. Managed Fluentd Cluster /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout

    logfile "HHSFHBUPS/PEFT Elasticsearch Forwarder Aggregator Aggregator Aggregator /PEF# /PWB /FVUSPO ,FZTUPOF stdout stdout stdout logfile Forwarder Forwarders - Collect logs and send them to aggregators - Deployed as Daemonset It means that a node has only one Fluentd container 
  31. Managed Fluentd Cluster /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout

    logfile "HHSFHBUPS/PEFT Elasticsearch Forwarder Aggregator Aggregator Aggregator /PEF# /PWB /FVUSPO ,FZTUPOF stdout stdout stdout logfile Forwarder Aggregators - Receive logs from forwarders - Process and filter logs - Send logs to datastore like ES - Deployed as StatefulSet - With PersistentVolume 
  32. Managed Fluentd Cluster /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout

    logfile "HHSFHBUPS/PEFT Elasticsearch Forwarder Aggregator Aggregator Aggregator /PEF# /PWB /FVUSPO ,FZTUPOF stdout stdout stdout logfile Forwarder Why split? - Not need much resource for Daemonset - Improve Scalability - Reduce changing scope when deploying 
  33. Managed Fluentd Cluster /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout

    logfile "HHSFHBUPS/PEFT Elasticsearch Forwarder Aggregator Aggregator Aggregator /PEF# /PWB /FVUSPO ,FZTUPOF stdout stdout stdout logfile Forwarder Pods output logs to stdout 
  34. Managed Fluentd Cluster /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout

    "HHSFHBUPS/PEFT Elasticsearch Forwarder Aggregator Aggregator Aggregator /PEF# /PWB /FVUSPO ,FZTUPOF stdout stdout stdout Forwarder Docker log driver copies from stdout to other log file logfile logfile 
  35. Managed Fluentd Cluster /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout

    "HHSFHBUPS/PEFT Elasticsearch Forwarder Aggregator Aggregator Aggregator /PEF# /PWB /FVUSPO ,FZTUPOF stdout stdout stdout Forwarder Tail from the logs logfile logfile 
  36. Managed Fluentd Cluster /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout

    "HHSFHBUPS/PEFT Elasticsearch Forwarder Aggregator Aggregator Aggregator /PEF# /PWB /FVUSPO ,FZTUPOF stdout stdout stdout Forwarder Aggregate and process logs logfile logfile 
  37. Managed Fluentd Cluster /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout

    "HHSFHBUPS/PEFT Elasticsearch Forwarder Aggregator Aggregator Aggregator /PEF# /PWB /FVUSPO ,FZTUPOF stdout stdout stdout Forwarder Send logs logfile logfile 
  38. Managed Fluentd Cluster /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout

    logfile "HHSFHBUPS/PEFT Elasticsearch Forwarder Aggregator Aggregator Aggregator /PEF# /PWB /FVUSPO ,FZTUPOF stdout stdout stdout logfile Forwarder Fluentd is shared resource 
  39. For durability /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout "HHSFHBUPS/PEFT

    Elasticsearch Forwarder Aggregator Aggregator Aggregator /PEF# /PWB /FVUSPO ,FZTUPOF stdout stdout stdout Forwarder - Buffer logs in each host directory - Flush buffers at shutdown - Save the position it’s already read into files - Require ack response from aggregator logfile logfile 
  40. For durability /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout logfile

    "HHSFHBUPS/PEFT Elasticsearch Forwarder Aggregator Aggregator Aggregator /PEF# /PWB /FVUSPO ,FZTUPOF stdout stdout stdout logfile Forwarder - Buffer logs in each PersistentVolume - Flush buffers at shutdown - Distribute Pods across nodes 
  41. Managed Fluentd Cluster /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout

    logfile "HHSFHBUPS/PEFT Elasticsearch Forwarder Aggregator Aggregator Aggregator /PEF# /PWB /FVUSPO ,FZTUPOF stdout stdout stdout logfile Forwarder Pros - Developers don’t need to maintain Fluentd - Fluentd can buffer logs while the destinations are down - Easy to scale aggregators - Monitored by SRE Team so developers don’t need to do that - Ensured durability, reliability and performance by SRE Team 
  42. Managed Fluentd Cluster /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout

    logfile /PEF# ,FZTUPOF /"5 -PBECBMBODFS stdout stdout stdout logfile "HHSFHBUPS/PEFT Elasticsearch Forwarder Forwarder Aggregator Aggregator Aggregator So... How do developers apply their own logging config? 5XFNPKJzCZ$PQZSJHIU5XJUUFS *ODBOEPUIFSDPOUSJCVUPSTJTMJDFOTFEVOEFS$$#: 
  43. 2 solutions Provide Managed Fluentd cluster Provide Fluentd Config Operator

    
  44. 2 solutions Provide Managed Fluentd cluster Provide Fluentd Config Operator

    
  45. Shared Fluentd Issues /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout

    logfile "HHSFHBUPS/PEFT Elasticsearch Forwarder Aggregator Aggregator Aggregator /PEF# /PWB /FVUSPO ,FZTUPOF stdout stdout stdout logfile Forwarder 
  46. Shared Fluentd Issues /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout

    logfile "HHSFHBUPS/PEFT Elasticsearch Forwarder Aggregator Aggregator Aggregator /PEF# /PWB /FVUSPO ,FZTUPOF stdout stdout stdout logfile Forwarder A team would apply... 
  47. Shared Fluentd Issues /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout

    logfile "HHSFHBUPS/PEFT Elasticsearch Forwarder Aggregator Aggregator Aggregator /PEF# /PWB /FVUSPO ,FZTUPOF stdout stdout stdout logfile Forwarder The other team would apply... 
  48. Shared Fluentd Issues /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout

    logfile "HHSFHBUPS/PEFT Elasticsearch Forwarder Aggregator Aggregator Aggregator /PEF# /PWB /FVUSPO ,FZTUPOF stdout stdout stdout logfile Forwarder Conflict! Conflict! Conflict! 
  49. Shared Fluentd Issues /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout

    logfile "HHSFHBUPS/PEFT Elasticsearch Forwarder Aggregator Aggregator Aggregator /PEF# /PWB /FVUSPO ,FZTUPOF stdout stdout stdout logfile Forwarder Some team would apply broken config... ! 
  50. Shared Fluentd Issues /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout

    logfile "HHSFHBUPS/PEFT Elasticsearch Forwarder Aggregator Aggregator Aggregator /PEF# /PWB /FVUSPO ,FZTUPOF stdout stdout stdout logfile Forwarder Process down!! 
  51. Shared Fluentd Issues /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout

    logfile "HHSFHBUPS/PEFT Elasticsearch Forwarder Aggregator Aggregator Aggregator /PEF# /PWB /FVUSPO ,FZTUPOF stdout stdout stdout logfile Forwarder Process down!! What happen?! 
  52. Shared Fluentd Issues - Changes to config would be conflicted

    among some teams - Invalid config causes process down - Developers need to take care of Fluentd when applying config 
  53. Requirements  - All configs should be validated before applying

    - All configs shouldn’t affect other teams’ configs - All configs shouldn’t cause process down - All applying config shouldn’t make developers operate manually
  54. LoggingPipeline Forwarder Config Fluentd Config Operator  Forwarder Aggregator Fluentd

    Config Operator Aggregator Config FluentdNode Developers SRE
  55. Fluentd Config Operator  LoggingPipeline Forwarder Config Forwarder Aggregator Fluentd

    Config Operator Aggregator Config FluentdNode Developers SRE - Automatically validate config written in CRD “LoggingPipeline” - Automatically compile the Fluentd config to CM if the config is valid - Automatically notify Fluentd to reload new config - Automatically block config if the config is invalid
  56. LoggingPipeline Forwarder Config Fluentd Config Operator  Forwarder Aggregator Fluentd

    Config Operator Aggregator Config FluentdNode Developers SRE Apply to specify managed Fluentd
  57. LoggingPipeline Forwarder Config Fluentd Config Operator  Forwarder Aggregator Fluentd

    Config Operator Aggregator Config FluentdNode Developers SRE Apply logging config
  58. Fluentd Config Operator  Where to collect logs

  59. Fluentd Config Operator  How to process logs

  60. Fluentd Config Operator  Where to send logs

  61. LoggingPipeline Forwarder Config Fluentd Config Operator  Forwarder Aggregator Fluentd

    Config Operator Aggregator Config FluentdNode Developers SRE Start to reoncile
  62. LoggingPipeline Forwarder Config Fluentd Config Operator  Forwarder Aggregator Fluentd

    Config Operator Aggregator Config FluentdNode Developers SRE Compile config to Configmaps for validation for forwarder for aggregator
  63. LoggingPipeline Forwarder Config Fluentd Config Operator  Forwarder Aggregator Fluentd

    Config Operator Aggregator Config FluentdNode Developers SRE for forwarder for aggregator Start validation
  64. LoggingPipeline Forwarder Config Fluentd Config Operator  Forwarder Aggregator Fluentd

    Config Operator Aggregator Config FluentdNode Developers SRE Compile & update configs If success
  65. LoggingPipeline Forwarder Config Fluentd Config Operator  Forwarder Aggregator Fluentd

    Config Operator Aggregator Config FluentdNode Developers SRE Notify Fluentd specified in FluentdNode CRD if config get updated
  66. Fluentd Config Operator  LoggingPipeline Forwarder Config Forwarder Aggregator Fluentd

    Config Operator Aggregator Config FluentdNode Developers SRE All developers need to do is specify log source and destination in CRD. 5XFNPKJzCZ$PQZSJHIU5XJUUFS *ODBOEPUIFSDPOUSJCVUPSTJTMJDFOTFEVOEFS$$#:
  67. Fluentd Config Operator  LoggingPipeline Forwarder Config Forwarder Aggregator Fluentd

    Config Operator Aggregator Config FluentdNode Developers SRE Dive into this more detail
  68. CRD: LoggingPipeline  Support stdout as log source

  69. CRD: LoggingPipeline  Support logs in emptyDir as log source

  70. CRD: LoggingPipeline  Support logs defined in snippet as log

    source
  71. Compile LoggingPipeline 

  72. Compile LoggingPipeline  Compiled for forwarders

  73. Compile LoggingPipeline  Automatically generate to indicate emptyDir path in

    host
  74. Compile LoggingPipeline  Automatically add to ensure durability

  75. Compile LoggingPipeline  Automatically add to ensure durability

  76. Compile LoggingPipeline  Compiled for aggregators

  77. Compile LoggingPipeline  Relabel to encapsulate not to affect other

    configs
  78. Compile LoggingPipeline  Automatically complicate prefix to save in persistent

    volume
  79. Compile LoggingPipeline  - Compile separately for forwarders and aggregators

    - Automatically complicate important parameters - Automatically wrap config with label to isolate it not to affect others - Automatically change directory to buffer logs to ensure durability
  80. Config Validation  - Run static validation - Run pod

    with dry-run command for forwarders - Run pod with actual-run to ensure connectivity to destinations for aggregators
  81. Operations for the solutions 

  82. Load Test /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout logfile

    /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout logfile 
  83. Load Test /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout logfile

    /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout logfile "HHSFHBUPS/PEFT Forwarder Aggregator Aggregator Aggregator Forwarder Dark launch in prod 
  84. Load Test /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout logfile

    /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout logfile "HHSFHBUPS/PEFT Forwarder Aggregator Aggregator Aggregator Forwarder About 250GB/day 
  85. Load Test Results…  The CPU usage of some aggregators

    got very higher periodically regardless of plenty of aggregator instances - Event thread in Fluentd was hanging up - Connections between the aggregator and forwarders were not too much - It means that aggregation, processing and writing buffer are heavy - But I/O was not hanging up
  86. Load Test Results…  The CPU usage of some aggregators

    got very higher periodically regardless of plenty of aggregator instances - Event thread in Fluentd was hanging up - Connections between the aggregator and forwarders were not too much - It means that aggregation, processing and writing buffer are heavy - But I/O was not hanging up Log chunk size may be too much Let’s make chunk size be lower! 5XFNPKJzCZ$PQZSJHIU5XJUUFS *ODBOEPUIFSDPOUSJCVUPSTJTMJDFOTFEVOEFS$$#:
  87. Load Test Results…  The CPU usage of some aggregators

    got very higher periodically regardless of plenty of aggregator instances - Event thread in Fluentd was hanging up - Connections between the aggregator and forwarders were not too much - It means that aggregation, processing and writing buffer are heavy - But I/O was not hanging up Resolved 5XFNPKJzCZ$PQZSJHIU5XJUUFS *ODBOEPUIFSDPOUSJCVUPSTJTMJDFOTFEVOEFS$$#:
  88. Monitoring AlertManager Cluster Remote write Monitor VM Alert Fire alerts

    Query periodically /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout logfile /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout logfile "HHSFHBUPS/PEFT Forwarder Aggregator Aggregator Aggregator Forwarder 
  89. Monitoring AlertManager Cluster Remote write Monitor VM Alert Fire alerts

    Query periodically /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout logfile /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout logfile "HHSFHBUPS/PEFT Forwarder Aggregator Aggregator Aggregator Forwarder - Prometheus in the cluster scrape metrics from Fluentd containers - It is monitored by a Prometheus which is out of the cluster - The Prometheus writes metrics to VictoriaMetrics TSDB - VM Alert query pre-defined rules for VictoriaMetrics periodically - VM Alert fire alerts to AlertManager if match with the rules - AlertManager sends notifications to the destinations like Slack, PagerDuty 
  90. Monitoring - CPU, Memory Usage - Process down, Pod down,

    Pod restart count - Whether there is no logs which is sent to the destination - log inflow speed < log processing speed - Disk usage for buffering and buffered bytes - Number of errors and slow flush about Fluentd - Number of errors about Fluentd Config Operator 
  91. Project Results 

  92. Project Results  Provided Managed Fluentd Cluster and Fluentd Config

    Operator - Got developers off maintaining Fluentd - All developers need to do is to manage their own logging config itself - Reduced about 172 containers in a cluster - Improve reliability, durability and performance about logging - Found undetected error about logging by monitoring
  93. However…  Some issues occurs after release - Docker JSON

    Log Driver splits the logs more than 16k so broken json log come to our Fluentd… - We need mechanism to notify developers parsing error
  94. Dead Letter Routing 

  95. Next Project 

  96. Introduce Kafka and… Elasticsearch /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout

    stdout logfile /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout logfile "HHSFHBUPS/PEFT Forwarder Aggregator Aggregator Aggregator Forwarder 
  97. Introduce Kafka and… Elasticsearch /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout

    stdout logfile /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout logfile "HHSFHBUPS/PEFT Forwarder Aggregator Aggregator Aggregator Forwarder - Remove direct dependency between forwarder and aggregator to improve scalability - Enable developers to send logs from out of the cluster 
  98. Introduce Kafka and… Elasticsearch /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout

    stdout logfile /PEF" /PWB /FVUSPO ,FZTUPOF stdout stdout stdout logfile "HHSFHBUPS/PEFT Forwarder Aggregator Aggregator Aggregator Forwarder Standardize logging across all Verda services! 
  99. Thank you