• Select a role that can access CLS, as shown in the figure below:
  
• If there is no suitable role, you can create one as follows:
  1. Log in to the CAM console, and select [Roles](https://console.cloud.tencent.com/cam/role) in the left sidebar.
  2. On the Roles page, click Create Role.
  3. In the “Select role entity” window that appears, select Tencent Cloud Product Service to go to the Create Custom Role page.
  4. On the Enter role entity info tab, select Cloud Virtual Machine (cvm) and click Next.
     

     Note

     You must select Cloud Virtual Machine (cvm) rather than TKE as the role entity, otherwise, you cannot complete the authorization process.

  5. On the Configure role policy tab, select QcloudCLSAccessForApiGateWayRole policy and click Next.
  6. On the Review tab, enter the role name to review the role information, and then click Done. For more information, see Creating a Role.

• Select the “SecretId” and “SecretKey” of your account API key as the variable values to create the cluster Secret.
  
• If there is no suitable Secret, you need to create one. For more information, see Secret Management. You can view the SecretId and SecretKey in API Keys.
  

  Note

  The user corresponding to the API key must have the permission to access the CLS. If there is no API key, you need to create one. For more information, see Access Key.

Enable log collection by adding environment variables.

apiVersion: apps/v1beta2
kind: Deployment
metadata:
  annotations:
    deployment.kubernetes.io/revision: "1"
labels:
    k8s-app: kafka
    qcloud-app: kafka
  name: kafka
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: kafka
      qcloud-app: kafka
 template:
metadata:
      annotations:
        eks.tke.cloud.tencent.com/cpu: "0.25"
        eks.tke.cloud.tencent.com/mem: "0.5Gi"
labels:
        k8s-app: kafka
        qcloud-app: kafka
    spec:
      containers:
      - env:
        - name: EKS_LOGS_OUTPUT_TYPE
          value: kafka
        - name: EKS_LOGS_KAFKA_BROKERS
          value: 10.0.16.42:9092
        - name: EKS_LOGS_KAFKA_TOPIC
          value: eks
        - name: EKS_LOGS_KAFKA_MESSAGE_KEY # Optional
          valueFrom:
             fieldRef:
               fieldPath: metadata.name
        - name: EKS_LOGS_METADATA_ON
          value: "true"
        - name: EKS_LOGS_LOG_PATHS
          value: stdout,/tmp/busy*.log
        image: busybox:latest
        command: ["/bin/sh"]
        args: ["-c", "while true; do echo hello world; date; echo hello >> /tmp/busy.log; sleep 1; done"]
        imagePullPolicy: Always
        name: while
        resources:
          requests:
            cpu: 250m
            memory: 512Mi

Creating a secret

Note

The following sample is to manually create a secret through yaml. If you create a secret through the console, you do not need to perform 64 encoding. For more information, see Secret Management.

$ echo -n 'secretid' | base64
c2VjcmV0aWQ=
$ echo -n 'secretkey' | base64
c2VjcmV0a2V5

apiVersion: v1
kind: Secret
metadata:
  name: secretidkey
data:
  secretid: 
  secretkey: 

Creating a deployment

Enable log collection by adding environment variables.

apiVersion: apps/v1beta2
kind: Deployment
metadata:
  annotations:
    deployment.kubernetes.io/revision: "1"
  labels:
    k8s-app: cls
    qcloud-app: cls
  name: cls
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: cls
      qcloud-app: cls
  template:
    metadata:
      annotations:
        eks.tke.cloud.tencent.com/cpu: "0.25"
        eks.tke.cloud.tencent.com/mem: "0.5Gi"
      labels:
        k8s-app: cls
        qcloud-app: cls
    spec:
      containers:
      - env:
        - name: EKS_LOGS_OUTPUT_TYPE
          value: cls
        - name: EKS_LOGS_LOGSET_NAME
          value: eks
        - name: EKS_LOGS_TOPIC_ID
          value: 617c8270-e8c8-46e2-a90b-d94c4bebe519
        - name: EKS_LOGS_SECRET_ID
          valueFrom:
            secretKeyRef:
              name: secretidkey
              key: secretid
        - name: EKS_LOGS_SECRET_KEY
          valueFrom:
            secretKeyRef:
              name: secretidkey
              key: secretkey
        - name: EKS_LOGS_LOG_PATHS
          value: stdout,/tmp/busy*.log
        - name: EKS_LOGS_METADATA_ON
          value: "true"
        image: busybox:latest
        command: ["/bin/sh"]
        args: ["-c", "while true; do echo hello world; date; echo hello >> /tmp/busy.log; sleep 1; done"]
        imagePullPolicy: Always
        name: hello
      - env:
        - name: EKS_LOGS_OUTPUT_TYPE
          value: cls
        - name: EKS_LOGS_LOGSET_NAME
          value: eks
        - name: EKS_LOGS_TOPIC_ID
          value: 617c8270-e8c8-46e2-a90b-d94c4bebe519
        - name: EKS_LOGS_SECRET_ID
          valueFrom:
            secretKeyRef:
              name: secretidkey
              key: secretid
        - name: EKS_LOGS_SECRET_KEY
          valueFrom:
            secretKeyRef:
              name: secretidkey
              key: secretkey
        - name: EKS_LOGS_LOG_PATHS
          value: stdout,/tmp/busy*.log
        - name: EKS_LOGS_METADATA_ON
          value: "true"
        image: busybox:latest
        command: ["/bin/sh"]
        args: ["-c", "while true; do echo hello world; date; echo hello >> /tmp/busy.log; sleep 1; done"]
        imagePullPolicy: Always
        name:world

Field description:

Creating a role

Create a role on the CAM console. While creating a role, you need to select Tencent Cloud Product Service, bind the role with a CVM, and select QcloudCLSAccessForApiGateWayRole policy. For more information, see Creating Roles.
In the Pod template, add annotation, specify the role name, and obtain the permission policy contained in the role.

template:
  metadata:
    annotations:
      eks.tke.cloud.tencent.com/role-name: "eks-pushlog"

Creating a deployment

apiVersion: apps/v1beta2
kind: Deployment
metadata:
  annotations:
    deployment.kubernetes.io/revision: "1"
  labels:
    k8s-app: cls
    qcloud-app: cls
  name: cls
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: cls
      qcloud-app: cls
  template:
    metadata:
      annotations:
        eks.tke.cloud.tencent.com/cpu: "0.25"
        eks.tke.cloud.tencent.com/mem: "0.5Gi"
        eks.tke.cloud.tencent.com/role-name: "eks-pushlog"
      labels:
        k8s-app: cls
        qcloud-app: cls
    spec:
      containers:
      - env:
        - name: EKS_LOGS_OUTPUT_TYPE
          value: cls
        - name: EKS_LOGS_LOGSET_NAME
          value: eks
        - name: EKS_LOGS_TOPIC_ID
          value: 617c8270-e8c8-46e2-a90b-d94c4bebe519
        - name: EKS_LOGS_LOG_PATHS
          value: stdout,/tmp/busy*.log
        - name: EKS_LOGS_METADATA_ON
          value: "true"
        image: busybox:latest
        command: ["/bin/sh"]
        args: ["-c", "while true; do echo hello world; date; echo hello >> /tmp/busy.log; sleep 1; done"]
        imagePullPolicy: Always
        name: hello
      - env:
        - name: EKS_LOGS_OUTPUT_TYPE
          value: cls
        - name: EKS_LOGS_LOGSET_NAME
          value: eks
        - name: EKS_LOGS_TOPIC_ID
          value: 617c8270-e8c8-46e2-a90b-d94c4bebe519
        - name: EKS_LOGS_LOG_PATHS
          value: stdout,/tmp/busy*.log
        - name: EKS_LOGS_METADATA_ON
          value: "true"
        image: busybox:latest
        command: ["/bin/sh"]
        args: ["-c", "while true; do echo hello world; date; echo hello >> /tmp/busy.log; sleep 1; done"]
        imagePullPolicy: Always
        name: world

1. Log in to the TKE console, and click Elastic Cluster in the left sidebar.
2. Select the ID of the desired cluster for log collection configuration to enter the cluster management page.
3. Choose Workload on the left, find the row of the desired workload for which you want to update log collection, and click Update Pod Configuration > Advanced Settings on the right to modify configurations, as shown in the figure below:
   
4. Click Done.

Find the yaml corresponding to the workload for which you want to update log collection. Then modify the corresponding variable values based on the relevant variable name changes of the configuration. You can view the meanings of variable names in Configuring log collection.