Most Kubernetes log pipelines run on a password: one credential for the log store, copied to every node, shared across clusters and almost never rotated. Kubernetes already gives every pod a signed identity that expires in minutes, and OpenSearch already knows how to check one. We joined the two and ended up with a logging pipeline that has no password anywhere in it, works across a fleet of clusters, and lets each cluster write only its own logs.
Read itWe sent 494,175 numbered log lines through Fluent Bit and Vector into OpenSearch and counted every one that arrived. With stock settings, one shipper lost 62 percent of a busy pod's logs and the other lost 85 percent, both without logging a single error. Five defaults were behind it, and each one is a one-line fix.
Read itWe shipped exactly 100 MB of logs into OpenSearch, once with Fluent Bit and once with Vector, and measured every byte that landed on disk. One copy came to about 1.5 times the raw size, the replica doubled that, and the search index, not the logs, turned out to be the biggest part of the bill.
Read it