一、ELK的简单介绍
ELK是一个应用套件，由Elasticsearch、Logstash和Kibana三部分组成，简称ELK。它是一套开源免费、功能强大的日志分析管理系统。ELK可以将我们的系统日志、网站日志、应用系统日志等各种日志进行收集、过滤、清洗，然后进行集中存放并可用于实时检索 。
然而，随着技术的发展，从 ELK 转变为 EFK 的应用架构正在逐渐受到欢迎。在EFK中，Filebeat或Fluentd取代了Logstash的角色。其中，Filebeat是Elastic Stack的一部分，被设计用来帮助用户收集和发送日志文件到Elasticsearch。而Fluentd是一个流行的开源数据收集器，用于获取容器日志文件、过滤和转换日志数据，然后将数据传递到Elasticsearch集群，在该集群中对其进行索引和存储。此外，结合Logstash具有基于磁盘的自适应缓冲系统，可以吸收传入的吞吐量，从而减轻Elasticsearch持续写入数据的压力。
随着各企业对大量日志的采集，为了获得更好的吞吐和更好的性能，ELK也变得越来越庞大，最终如下图：

二、k8s部署ELK
本次使用的k8s版本是v1.21版本。
部署使用statefullset控制器，当然，你也可用deployment控制器。
2.1 创建statefullset的依赖，空的svc
创建名称空间

kubectl   create ns  kube-logging

创建elastic.yaml

kind: Service
apiVersion: v1
metadata:
  name: elasticsearch
  namespace: kube-logging
  labels:
    app: elasticsearch
spec:
  selector:
    app: elasticsearch
  clusterIP: None
  ports:
    - port: 9200
      name: rest
    - port: 9300
      name: inter-node

查看是否成功

[root@master elk]# kubectl get svc -n kube-logging
NAME            TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)             AGE
elasticsearch   ClusterIP   None         <none>        9200/TCP,9300/TCP   54s

2.2.创建存储类，用于es数据的持久化处理
这里使用的是NFS的存储类动态创建，要使用静态的可以看前面的mysql那节。
所有节点安装下nfs，确保驱动

 yum install nfs-utils -y
 systemctl start nfs
 systemctl enable  nfs

在master创建共享目录

[root@master elk]# mkdir /data/elk -p
vim /etc/exports
/data/v1 *(rw,no_root_squash)
exportfs -arv

创建sa，对这个sa进行rbac授权，使得存储类能和k8s的api-server通信

apiVersion: v1
kind: ServiceAccount
metadata:
  name: nfs-provisioner

[root@master elk]# kubectl apply -f serviceaccount.yaml 
serviceaccount/nfs-provisioner created

给刚创建的sa授权，使用ClusterRoleBinding将run-nfs-provisioner绑定到 ClusterRole

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: nfs-provisioner-runner
rules:
  - apiGroups: [""]
    resources: ["persistentvolumes"]
    verbs: ["get", "list", "watch", "create", "delete"]
  - apiGroups: [""]
    resources: ["persistentvolumeclaims"]
    verbs: ["get", "list", "watch", "update"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["storageclasses"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["create", "update", "patch"]
  - apiGroups: [""]
    resources: ["services", "endpoints"]
    verbs: ["get"]
  - apiGroups: ["extensions"]
    resources: ["podsecuritypolicies"]
    resourceNames: ["nfs-provisioner"]
    verbs: ["use"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: run-nfs-provisioner
subjects:
  - kind: ServiceAccount
    name: nfs-provisioner
    namespace: default
roleRef:
  kind: ClusterRole
  name: nfs-provisioner-runner
  apiGroup: rbac.authorization.k8s.io
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: leader-locking-nfs-provisioner
rules:
  - apiGroups: [""]
    resources: ["endpoints"]
    verbs: ["get", "list", "watch", "create", "update", "patch"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: leader-locking-nfs-provisioner
subjects:
  - kind: ServiceAccount
    name: nfs-provisioner
    namespace: default
roleRef:
  kind: Role
  name: leader-locking-nfs-provisioner
  apiGroup: rbac.authorization.k8s.io

kubectl apply -f rbac.yaml

部署nfs存储动态供应商

kind: Deployment
apiVersion: apps/v1
metadata:
  name: nfs-provisioner
spec:
  selector:
    matchLabels:
      app: nfs-provisioner
  replicas: 1
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: nfs-provisioner
    spec:
      serviceAccount: nfs-provisioner
      containers:
        - name: nfs-provisioner
          image: nfs-client-provisioner
          imagePullPolicy: IfNotPresent
          volumeMounts:
            - name: nfs-client-root
              mountPath: /persistentvolumes
          env:
            - name: PROVISIONER_NAME
              value: example.com/nfs
            - name: NFS_SERVER
              value: 172.17.100.150
            - name: NFS_PATH
              value: /data/elk
      volumes:
        - name: nfs-client-root
          nfs:
            server: 172.17.100.150
            path: /data/elk

kubectl apply -f nfs-deployment.yaml 

查看状态

[root@master elk]# kubectl get pod  -owide 
NAME                               READY   STATUS    RESTARTS   AGE   IP                NODE    NOMINATED NODE   READINESS GATES
nfs-provisioner-57cdd589d4-gfstc   1/1     Running   0          52s   192.168.166.134   node1   <none> 

使用存储类动态分配存储

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: do-block-storage
provisioner: example.com/nfs

root@master elk]# kubectl apply -f es_class.yaml 

查看

[root@master elk]# kubectl get storageclass
NAME               PROVISIONER       RECLAIMPOLICY   VOLUMEBINDINGMODE   ALLOWVOLUMEEXPANSION   AGE
do-block-storage   example.com/nfs   Delete          Immediate           false                  18s

注意：provisioner 的值要和上面创建的值对应value: example.com/nfs

下面的在后面文档。