RunReveal
SourcesRevealdDeployment

Kubernetes deployment

Run reveald as a DaemonSet to collect logs from every node in your cluster. This is ideal for collecting CRI container logs, journald entries, and host-level log files.

DaemonSet manifest

apiVersion: v1
kind: ConfigMap
metadata:
  name: reveald-config
  namespace: monitoring
data:
  config.json: |
    {
      "sources": {
        "containers": {
          "type": "cri",
          "path": "/var/log/pods/",
          "extension": ".log",
          "recursive": true
        }
      },
      "destinations": {
        "runreveal": {
          "type": "runreveal",
          "webhookURL": "$WEBHOOK_URL"
        }
      }
    }
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: reveald
  namespace: monitoring
  labels:
    app: reveald
spec:
  selector:
    matchLabels:
      app: reveald
  template:
    metadata:
      labels:
        app: reveald
    spec:
      containers:
        - name: reveald
          image: runreveal/reveald:latest
          args: ["run", "--config", "/etc/reveald/config.json"]
          env:
            - name: WEBHOOK_URL
              valueFrom:
                secretKeyRef:
                  name: reveald-secrets
                  key: webhook-url
          volumeMounts:
            - name: config
              mountPath: /etc/reveald
              readOnly: true
            - name: pod-logs
              mountPath: /var/log/pods
              readOnly: true
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 200m
              memory: 256Mi
      volumes:
        - name: config
          configMap:
            name: reveald-config
        - name: pod-logs
          hostPath:
            path: /var/log/pods

Secret for webhook URL

kubectl create secret generic reveald-secrets \
  --namespace monitoring \
  --from-literal=webhook-url="https://api.runreveal.com/sources/reveald/webhook/..."

Don't put your webhook URL in the ConfigMap. Use a Kubernetes Secret and reference it via secretKeyRef as shown above.

Collecting journald in Kubernetes

To collect journald alongside container logs, mount the journal directories:

volumeMounts:
  - name: pod-logs
    mountPath: /var/log/pods
    readOnly: true
  - name: journal-run
    mountPath: /run/log/journal
    readOnly: true
  - name: journal-var
    mountPath: /var/log/journal
    readOnly: true
 
volumes:
  - name: journal-run
    hostPath:
      path: /run/log/journal
  - name: journal-var
    hostPath:
      path: /var/log/journal

And add a journald source to your config:

{
  "sources": {
    "containers": {
      "type": "cri",
      "path": "/var/log/pods/",
      "extension": ".log",
      "recursive": true
    },
    "journal": {
      "type": "journald"
    }
  }
}

Resource recommendations

Cluster sizeCPU requestMemory requestCPU limitMemory limit
Small (< 50 pods/node)50m64Mi200m256Mi
Medium (50-200 pods/node)100m128Mi500m512Mi
Large (> 200 pods/node)200m256Mi1000m1Gi

Adjust based on log volume. Monitor memory usage and increase limits if reveald is OOM-killed.

On this page