EKS on Fargate で Pod のコンテナログを CloudWatch Logs に出力してみた（Built-in Fluent Bit 編）

apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig

metadata:
  name: fargate-logging-test
  region: ap-northeast-1
  version: "1.31"

# Fargate 専用のためマネージドノードグループは作成しない
fargateProfiles:
  # kube-system と CoreDNS 用（Fargate 専用クラスターで必須）
  - name: fp-system
    selectors:
      - namespace: kube-system
      - namespace: default

  # 検証用ワークロード
  - name: fp-demo
    selectors:
      - namespace: demo

  # aws-observability（ConfigMap 用）
  - name: fp-observability
    selectors:
      - namespace: aws-observability

eksctl create cluster -f cluster-config.yaml

# CoreDNS から EC2 用のアノテーションを削除
kubectl patch deployment coredns \
  -n kube-system \
  --type json \
  -p='[{"op": "remove", "path": "/spec/template/metadata/annotations/eks.amazonaws.com~1compute-type"}]'

# Pod を再起動して Fargate で起動させる
kubectl rollout restart deployment coredns -n kube-system

# CoreDNS が Running になることを確認
kubectl get pods -n kube-system -l k8s-app=kube-dns

# Fargate Profile から Pod Execution Role ARN を取得
aws eks describe-fargate-profile \
  --cluster-name fargate-logging-test \
  --fargate-profile-name fp-demo \
  --region ap-northeast-1 \
  --query 'fargateProfile.podExecutionRoleArn' \
  --output text

arn:aws:iam::123456789012:role/eksctl-fargate-logging-test-FargatePodExecutionRole-XXXXX

aws sts get-caller-identity --query Account --output text

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogStream",
        "logs:CreateLogGroup",
        "logs:DescribeLogStreams",
        "logs:PutLogEvents",
        "logs:PutRetentionPolicy"
      ],
      "Resource": "arn:aws:logs:ap-northeast-1:<ACCOUNT_ID>:log-group:/eks/*"
    }
  ]
}

# ポリシーを作成
aws iam create-policy \
  --policy-name eks-fargate-logging-policy \
  --policy-document file://eks-fargate-logging-policy.json

# 環境準備で確認した Pod Execution Role 名を指定してアタッチ
aws iam attach-role-policy \
  --policy-arn arn:aws:iam::<ACCOUNT_ID>:policy/eks-fargate-logging-policy \
  --role-name <環境準備で確認した Pod Execution Role 名>

kind: Namespace
apiVersion: v1
metadata:
  name: aws-observability
  labels:
    aws-observability: enabled   # このラベルが必須

kubectl apply -f namespace-aws-observability.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: aws-logging
  namespace: aws-observability
data:
  # Fluent Bit 自身のプロセスログを CloudWatch に送る場合は "true"
  flb_log_cw: "false"

  parsers.conf: |
    [PARSER]
        Name        crio
        Format      Regex
        Regex       ^(?<time>[^ ]+) (?<stream>stdout|stderr) (?<logtag>P|F) (?<log>.*)$
        Time_Key    time
        Time_Format %Y-%m-%dT%H:%M:%S.%L%z

  filters.conf: |
    [FILTER]
        Name             parser
        Match            *
        Key_name         log
        Parser           crio
        Reserve_Data     On

    [FILTER]
        Name                kubernetes
        Match               kube.*
        Merge_Log           On
        Keep_Log            Off
        Buffer_Size         0
        Kube_Meta_Cache_TTL 300s

  output.conf: |
    [OUTPUT]
        Name                cloudwatch_logs
        Match               kube.*
        region              ap-northeast-1
        log_group_name      /eks/my-cluster/demo
        log_stream_prefix   from-fluent-bit-
        log_retention_days  7
        auto_create_group   true

kubectl apply -f configmap-aws-logging.yaml

apiVersion: v1
kind: Namespace
metadata:
  name: demo

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-app
  namespace: demo
spec:
  replicas: 2
  selector:
    matchLabels:
      app: web-app
  template:
    metadata:
      labels:
        app: web-app
    spec:
      containers:
      # コンテナ 1: nginx（メインアプリケーション）
      - name: nginx
        image: nginx:1.25
        ports:
        - containerPort: 80
        resources:
          requests:
            cpu: "100m"
            memory: "128Mi"
          limits:
            cpu: "200m"
            memory: "256Mi"

      # コンテナ 2: log-generator（サイドカー / ログ生成用）
      - name: log-generator
        image: busybox:1.36
        command:
        - /bin/sh
        - -c
        - |
          i=0
          while true; do
            i=$((i+1))
            echo "{\"level\":\"info\",\"container\":\"log-generator\",\"msg\":\"heartbeat #${i}\",\"ts\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"}"
            sleep 10
          done
        resources:
          requests:
            cpu: "50m"
            memory: "64Mi"
          limits:
            cpu: "100m"
            memory: "128Mi"

kubectl apply -f namespace-demo.yaml
kubectl apply -f deployment-web-app.yaml

kubectl get pods -n demo -o wide

NAME                       READY   STATUS    RESTARTS   AGE   IP            NODE
web-app-7d4b9c6f8-xk2p9   2/2     Running   0          2m    10.0.1.123    fargate-ip-10-0-1-123...
web-app-7d4b9c6f8-r7m3t   2/2     Running   0          2m    10.0.2.456    fargate-ip-10-0-2-456...

# nginx コンテナのログ
kubectl logs -n demo -l app=web-app -c nginx --tail=5

# log-generator コンテナのログ
kubectl logs -n demo -l app=web-app -c log-generator --tail=5

{"level":"info","container":"log-generator","msg":"heartbeat #1","ts":"2026-04-08T05:00:00Z"}
{"level":"info","container":"log-generator","msg":"heartbeat #2","ts":"2026-04-08T05:00:10Z"}
...

kubectl describe pod -n demo -l app=web-app | grep -A 2 "Annotations"

Annotations:  CapacityProvisioned: 0.25vCPU 0.5GB
              Logging: LoggingEnabled