cloudwatch-agent-daemonset.yaml

apiVersion: v1
kind: Namespace
metadata:
  name: amazon-cloudwatch  # Change if using a different namespace
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cloudwatch-agent
  namespace: amazon-cloudwatch  # Change if using a different namespace
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cloudwatch-agent-role
rules:
- apiGroups: [""]
  resources: ["nodes", "pods", "endpoints"]
  verbs: ["list", "watch"]
- apiGroups: [""]
  resources: ["nodes/proxy"]
  verbs: ["get"]
- apiGroups: ["apps"]
  resources: ["daemonsets", "deployments", "replicasets", "statefulsets"]
  verbs: ["list", "watch"]
- apiGroups: ["batch"]
  resources: ["jobs"]
  verbs: ["list", "watch"]
- apiGroups: ["extensions"]
  resources: ["replicasets", "deployments"]
  verbs: ["list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cloudwatch-agent-role-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cloudwatch-agent-role
subjects:
- kind: ServiceAccount
  name: cloudwatch-agent
  namespace: amazon-cloudwatch  # Change if using a different namespace
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: cloudwatch-agent
  namespace: amazon-cloudwatch  # Change if using a different namespace
  labels:
    k8s-app: cloudwatch-agent
spec:
  selector:
    matchLabels:
      name: cloudwatch-agent
  template:
    metadata:
      labels:
        name: cloudwatch-agent
    spec:
      serviceAccountName: cloudwatch-agent
      containers:
      - name: cloudwatch-agent
        image: amazon/cloudwatch-agent:latest
        resources:
          limits:
            memory: 200Mi
            cpu: 200m
          requests:
            memory: 200Mi
            cpu: 200m
        env:
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: HOST_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        - name: K8S_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: K8S_POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        volumeMounts:
        - name: config-volume
          mountPath: /etc/cloudwatch-agent/config
          readOnly: true
        - name: rootfs
          mountPath: /rootfs
          readOnly: true
        - name: varlibdockercontainers
          mountPath: /var/lib/docker/containers
          readOnly: true
        - name: varlog
          mountPath: /var/log
          readOnly: true
      terminationGracePeriodSeconds: 60
      volumes:
      - name: config-volume
        secret:
          secretName: cloudwatch-agent-config  # Ensure this matches your secret name
      - name: rootfs
        hostPath:
          path: /
      - name: varlibdockercontainers
        hostPath:
          path: /var/lib/docker/containers
      - name: varlog
        hostPath:
          path: /var/log