From cd51078d7946e0caa74b20993b95911fde294390 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sun, 23 Aug 2026 17:00:07 +1000
Subject: [PATCH] logging: add read-only clickhouse logreader user +
 Vault-synced secret (#400)

## Why
CLI tools and the logviewer UI need ClickHouse access without write or DDL rights. The only existing app user (`vector`) has `access_management` and write access; this adds a properly scoped read-only login using the same secret-sourcing mechanism.

## Changes
- Adds a `logreader` user to the `logs` ClickHouseInstallation: password hash via `secretKeyRef` to the Vault-synced `clickhouse-logreader` Secret (same mechanism as `vector`), networks `::/0`, `readonly` profile, scoped to the `logs` database only
- Adds a `readonly` profile (`readonly: 1`, same memory/time limits as default)
- Adds a `clickhouse-logreader` VaultStaticSecret mirroring the existing `clickhouse-credentials` object (kv-v2, 5m refresh, VSO-created destination Secret)

## Vault kv
Seeded at `kv/kubernetes/namespace/logging/default/clickhouse-logreader` (version 1) with keys: `username`, `password`, `password_sha256_hex`. No secret material lands in git; the CHI only ever sees the sha256 hash via the synced Secret.

Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/400
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
---
 apps/base/logging/clickhouseinstallation.yaml | 17 ++++++++++++++
 apps/base/logging/vaultstaticsecret.yaml      | 23 +++++++++++++++++++
 2 files changed, 40 insertions(+)

diff --git a/apps/base/logging/clickhouseinstallation.yaml b/apps/base/logging/clickhouseinstallation.yaml
index f6b63f0..08e7d9a 100644
--- a/apps/base/logging/clickhouseinstallation.yaml
+++ b/apps/base/logging/clickhouseinstallation.yaml
@@ -29,9 +29,26 @@ spec:
       default/networks/ip:
         - "127.0.0.1"
         - "::1"
+      # Read-only user for CLI tools + the logviewer UI. Hash sourced from the
+      # Vault-synced clickhouse-logreader Secret, same mechanism as vector.
+      # Scoped to the logs database only (unlike vector, which bootstraps it).
+      logreader/password_sha256_hex:
+        valueFrom:
+          secretKeyRef:
+            name: clickhouse-logreader
+            key: password_sha256_hex
+      logreader/networks/ip:
+        - "::/0"
+      logreader/profile: readonly
+      logreader/quota: default
+      logreader/allow_databases/database:
+        - "logs"
     profiles:
       default/max_memory_usage: "10000000000"
       default/max_execution_time: "120"
+      readonly/readonly: "1"
+      readonly/max_memory_usage: "10000000000"
+      readonly/max_execution_time: "120"
     clusters:
       - name: logs
         layout:
diff --git a/apps/base/logging/vaultstaticsecret.yaml b/apps/base/logging/vaultstaticsecret.yaml
index 45b56ab..9113945 100644
--- a/apps/base/logging/vaultstaticsecret.yaml
+++ b/apps/base/logging/vaultstaticsecret.yaml
@@ -27,6 +27,29 @@ spec:
   type: kv-v2
   vaultAuthRef: default
 ---
+# ClickHouse credentials for the read-only `logreader` user (CLI tools +
+# logviewer UI). Seeded the same way as clickhouse-credentials above:
+#   PW=$(openssl rand -hex 24)
+#   HASH=$(printf '%s' "$PW" | sha256sum | cut -d' ' -f1)
+#   vault kv put kv/kubernetes/namespace/logging/default/clickhouse-logreader \
+#     username=logreader password="$PW" password_sha256_hex="$HASH"
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: clickhouse-logreader
+  namespace: logging
+spec:
+  destination:
+    create: true
+    name: clickhouse-logreader
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/logging/default/clickhouse-logreader
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
 # NATS JetStream auth. Distinct passwords for the producer (edge), consumer
 # (transform tier + archiver) and admin (bootstrap Job) users. Seed once:
 #   for k in admin producer consumer; do declare P_$k=$(openssl rand -base64 24); done