Recipe: Kubernetes Log Ingestion

The Helm chart runs blazerules_agent as a DaemonSet and blazerules_dashboard as a Deployment.

Install

helm install blazerules ./charts/blazerules \
  --set image.repository=your-registry/blazerules \
  --set image.tag=0.1.0

Python equivalent: run Helm from a deployment script

import subprocess

subprocess.run([
    "helm", "install", "blazerules", "./charts/blazerules",
    "--set", "image.repository=your-registry/blazerules",
    "--set", "image.tag=0.1.0",
], check=True)

Default agent input:

agent:
  enabled: true
  mode: daemonset
  input:
    type: file_tail
    path: /var/log/containers/blazerules.log
  output:
    type: ndjson
    path: /var/log/blazerules/decisions.ndjson

Custom Values

image:
  repository: ghcr.io/your-org/blazerules
  tag: 0.1.0

agent:
  batchSize: 4096
  flushMs: 250
  input:
    type: file_tail
    path: /var/log/containers/checkout.log
  output:
    type: ndjson
    path: /var/log/blazerules/decisions.ndjson
  dedupe:
    enabled: true
    keyFields: [event_id]
    ttlSeconds: 3600

dashboard:
  enabled: true
  service:
    type: ClusterIP
  decisionLogPath: /var/log/blazerules/decisions.ndjson
  deadLetterLogPath: /var/log/blazerules/dead_letters.ndjson

persistence:
  enabled: true
  size: 20Gi

Apply:

helm upgrade --install blazerules ./charts/blazerules -f values.yaml

Python equivalent: upgrade from a deployment script

import subprocess

subprocess.run([
    "helm", "upgrade", "--install", "blazerules",
    "./charts/blazerules",
    "-f", "values.yaml",
], check=True)

Notes

Keep the dashboard behind internal access controls. It has no built-in auth.
Enable persistence if you need decision/DLQ files after pod restart.
For cloud object storage, supply AWS profile/region/endpoint credentials through environment variables or your platform secret mechanism.