Splunk Daemonset for kubernetes not indexing data due to read only filesystem


I have configured splunk daemonset for k8s cluster. Agent logs are flowing. However the application logs are not getting indexed, as /var/lib/docker/containers is owned by root and a read only file system.
Also I am not able to change permissions of /var/lib/docker/containers. PS - We are running splunk agent with a non-root user.

Any help ?

Tags (1)
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.