A DaemonSet is a Kubernetes workload controller used to run a Pod on each eligible node. For cluster logging, it commonly places one Fluent Bit instance on every worker or master node, where that instance collects logs from containers on its node. section 4.6.2 section 4.7.1
This node-level model contrasts with application direct logging through a sidecar. Applications write to stdout or stderr; Kubernetes captures that output, and the node-local Fluent Bit instance collects it. A sidecar instead aligns one logging instance and its configuration with a single application Pod. section 4.6.2 section 4.7.1
Choose the deployment model by balancing scope, coupling, and processing cost:
- Use a DaemonSet when one node-level agent should collect logs from all containers on that node. section 4.6.2
- Expect routing, filtering, or enrichment changes in a node’s Fluent Bit configuration to affect every application container collected there. section 4.6.2
- Account for parsing container stdout in the DaemonSet approach; sidecars can avoid that parsing and use their Pod context for simpler matching and filtering. section 4.6.2
- Use a sidecar when lower coupling and application-specific inputs, filters, and formatters outweigh running an additional Fluent Bit instance per application Pod. section 4.6.2
Kubernetes does not prescribe one cluster logging solution. It promotes logging agents either as sidecars or on every node as part of a DaemonSet, because container runtime logging behavior beyond standard output and standard error is not consistently implemented across runtimes. section 4.7.1
The Fluent Operator can manage node monitoring through its FluentBit custom resource, which defines the image and configuration to run as a DaemonSet. ClusterFluentBitConfig can supply cluster-wide input, output, and filter configuration, including secret-backed configuration and namespace targeting; FluentBitConfig supplies namespace-level selections. section 4.8
Node-wide Fluent Bit collection
A Fluent Operator configuration can select a tail input for /var/log/containers/*.log, tag records as kube.*, and bound resource use with memBufLimit and skipLongLines. An output selected for the same configuration can match kube.* records and send them to Elasticsearch. The performance limits help prevent logging output from becoming a source of backpressure or excessive compute consumption. section 4.8
