We wanted a watcher that alerts us when bad kernel things happen and were able to deploy that as a DaemonSet using Kubernetes 🙂

• Use a Debian base image (for example ruby:2.5-stretch)
• Run as root user or as user that can read systemd logs like systemd-journal
• Mount /run/log/journal

  spec:
    containers:
    - name: foo
      ...
      volumeMounts:
      - name: runlog
        mountPath: /run/log/journal
        readOnly: true
    volumes:
    - name: runlog
      hostPath:
        path: /run/log/journal

• Use systemd-journal to read the logs

  require 'systemd/journal'
  journal = Systemd::Journal.new
  journal.seek(:tail)
  journal.move_previous
  journal.filter(syslog_identifier: 'kernel')
  journal.watch { |entry| puts entry.message }