# Vector TRANSFORM tier (STATELESS Deployment) — the "brain": sole ClickHouse
# writer, owns all transforms, holds the only ClickHouse + NATS-consumer creds.
#
# Stateless by design: a JetStream pull consumer with NO PVC and NO disk buffer.
# JetStream is the sole durability layer. On a ClickHouse outage the clickhouse
# sink blocks (buffer when_full=block), back-pressure stops the source pulling,
# and unpulled messages stay in JetStream for redelivery. Because Vector's NATS
# source does NOT support end-to-end acknowledgements (it acks on receipt, not
# after the sink), the only at-risk window is the in-memory buffer's worth of
# already-pulled events if a pod is killed mid-outage — the accepted trade for a
# horizontally-autoscalable stateless tier. Multiple replicas share the one
# durable consumer `transform` (JetStream pull consumers distribute work), so
# HPA is safe.
role: Stateless-Aggregator
fullnameOverride: vector-aggregator

image:
  repository: docker.io/timberio/vector
  tag: 0.57.0-distroless-libc

# Horizontal autoscaling on CPU — safe with N replicas on one durable consumer.
autoscaling:
  enabled: true
  minReplicas: 2
  maxReplicas: 8
  targetCPUUtilizationPercentage: 70

workloadResourceAnnotations:
  configmap.reloader.stakater.com/auto: "true"

podLabels:
  vector.dev/exclude: "true"

# Pipeline is the single source of truth in apps/base/logging/vector/
# aggregator.yaml (unit-tested by `vector test` in CI), mounted via
# existingConfigMaps. No persistence — stateless.
dataDir: /vector-data-dir
existingConfigMaps:
  - vector-aggregator-config

# The ONLY place ClickHouse + NATS-consumer creds are consumed.
env:
  # Vector 0.57 disables ${VAR} config interpolation by default; the pipeline's
  # auth (${CLICKHOUSE_*}, ${NATS_CONSUMER_PASSWORD}) needs it enabled.
  - name: VECTOR_DANGEROUSLY_ALLOW_ENV_VAR_INTERPOLATION
    value: "true"
  - name: CLICKHOUSE_USER
    valueFrom:
      secretKeyRef:
        name: clickhouse-credentials
        key: username
  - name: CLICKHOUSE_PASSWORD
    valueFrom:
      secretKeyRef:
        name: clickhouse-credentials
        key: password
  - name: NATS_CONSUMER_PASSWORD
    valueFrom:
      secretKeyRef:
        name: nats-auth
        key: consumer_password

# Pure consumer: expose only the Vector API for debugging.
containerPorts:
  - name: api
    containerPort: 8686
    protocol: TCP

service:
  enabled: true
  type: ClusterIP
  ports:
    - name: api
      port: 8686
      targetPort: 8686
      protocol: TCP

resources:
  requests:
    cpu: 250m
    memory: 512Mi
  limits:
    cpu: "2"
    memory: 2Gi
