在 GKE 上部署 Graylog

Question

我很难在 Google Kubernetes Engine 上部署 Graylog，我正在使用此配置 https://github.com/aliasmee/kubernetes-graylog-cluster 并进行一些小的修改。我的 Graylog 服务器已启动，但在界面中显示此错误：

Error message
    Request has been terminated
    Possible causes: the network is offline, Origin is not allowed by Access-Control-Allow-Origin, the page is being unloaded, etc.
Original Request
    GET http://ES_IP:12900/system/sessions
Status code
    undefined
Full error message
    Error: Request has been terminated
    Possible causes: the network is offline, Origin is not allowed by Access-Control-Allow-Origin, the page is being unloaded, etc.

Graylog 日志除此之外没有显示任何特别内容：

org.graylog.plugins.threatintel.tools.AdapterDisabledException: Spamhaus service is disabled, not starting (E)DROP adapter. To enable it please go to System / Configurations.
    at org.graylog.plugins.threatintel.adapters.spamhaus.SpamhausEDROPDataAdapter.doStart(SpamhausEDROPDataAdapter.java:68) ~[?:?]
    at org.graylog2.plugin.lookup.LookupDataAdapter.startUp(LookupDataAdapter.java:59) [graylog.jar:?]
    at com.google.common.util.concurrent.AbstractIdleService$DelegateService.run(AbstractIdleService.java:62) [graylog.jar:?]
    at com.google.common.util.concurrent.Callables.run(Callables.java:119) [graylog.jar:?]
    at java.lang.Thread.run(Thread.java:748) [?:1.8.0_181]

但在最后：

2019-01-16 13:35:00,255 INFO : org.graylog2.bootstrap.ServerBootstrap - Graylog server up and running.

Elastic 搜索运行状况检查为绿色，ES 和 Mongo 日志中都没有问题。不过我怀疑与 Elastic Search 的连接有问题。

curl http://ip_address:9200/_cluster/health\?pretty
{
  "cluster_name" : "elasticsearch",
  "status" : "green",
  "timed_out" : false,
  "number_of_nodes" : 1,
  "number_of_data_nodes" : 1,
  "active_primary_shards" : 4,
  "active_shards" : 4,
  "relocating_shards" : 0,
  "initializing_shards" : 0,
  "unassigned_shards" : 0,
  "delayed_unassigned_shards" : 0,
  "number_of_pending_tasks" : 0,
  "number_of_in_flight_fetch" : 0,
  "task_max_waiting_in_queue_millis" : 0,
  "active_shards_percent_as_number" : 100.0
}

Answer 1

阅读您分享的教程后，我能够确定 kubelet 需要运行参数 --allow-privileged。

"Elasticsearch pods need for an init-container to run in privileged mode, so it can set some VM options. For that to happen, the kubelet should be running with args --allow-privileged, otherwise the init-container will fail to run."

无法自定义或修改 kubelet parameter/arguments，这里有一个功能请求：https://issuetracker.google.com/118428580，因此可以在将来实现。

此外，如果您直接在节点上修改 kubelet，主节点可能会重置配置，并且不能保证配置将持久存在。

在 GKE 上部署 Graylog

Deploy Graylog on GKE

graylog2

kubernetes

graylog

google-kubernetes-engine