Explains using a DaemonSet Fluent Bit agent to automatically collect and enrich Kubernetes pod logs cluster-wide without per-application configuration.
Picture a new tenant moving into our apartment complex.They unpack on a Monday, and that same morning their mail is already being collected. Nobody had to hire a new courier or redraw the delivery route — the logging agent is already in place and ready to pick up logs.
We deploy Alloy as a DaemonSet, so every node in the cluster runs the same Fluent Bit–based agent. That agent watches the node’s containers and automatically begins collecting logs for any pod that starts on that node. This setup is application-agnostic: the agent does not need per-application configuration to discover and collect logs.Fluent Bit commonly operates by tailing the container log files on each node and using the Kubernetes API to enrich records with pod metadata (labels, namespace, pod name, etc.). As soon as a container writes logs, the agent picks them up — just like the tenant receiving mail on day one.Example: a minimal Deployment for an application that requires no special logging config
apiVersion: apps/v1kind: Deploymentmetadata: name: api labels: app: apispec: replicas: 1 selector: matchLabels: app: api template: metadata: labels: app: api spec: containers: - name: api image: kodekloud/loki-demo
How it works (high level)
The DaemonSet runs Fluent Bit on every node.
Fluent Bit tails container log files on the node (typically under /var/log/containers/).
Fluent Bit queries the Kubernetes API to enrich logs with pod metadata (labels, namespace, etc.).
Enriched log records are forwarded to your log backend (e.g., Grafana Loki, Elasticsearch).
Permissions and requirements
Resource / Requirement
Purpose
Notes / Example
DaemonSet on each node
Ensures an agent runs on every node
Deploy Fluent Bit as a DaemonSet
Node file access
Read container log files
Agent needs access to node log directories (hostPath mounts)
Kubernetes API access
Enrich logs with pod metadata
Requires RBAC permissions to read pod objects
pods/log (optional)
If agent reads logs via the API instead of tailing files
Grant pods/log only when using API-based log retrieval
No per-application logging configuration is required. As long as the DaemonSet agent runs and has permission to access node container log files and to read pod metadata from the Kubernetes API (RBAC for pod metadata), it will automatically collect logs from newly created pods. pods/log permission is only required if the agent is configured to fetch logs via the API rather than tailing node files.
