unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

logging: add read-only clickhouse logreader user + Vault-synced secret #400

Merged
benvin merged 1 commits from benvin/clickhouse-logreader into main 2026-08-23 17:00:07 +10:00
Conversation 0 Commits 1 Files Changed 2
+40
unkin-agent commented 2026-08-23 16:33:24 +10:00
Member
Copy Link
Copy Source

Why

CLI tools and the logviewer UI need ClickHouse access without write or DDL rights. The only existing app user (vector) has access_management and write access; this adds a properly scoped read-only login using the same secret-sourcing mechanism.

Changes

  • Adds a logreader user to the logs ClickHouseInstallation: password hash via secretKeyRef to the Vault-synced clickhouse-logreader Secret (same mechanism as vector), networks ::/0, readonly profile, scoped to the logs database only
  • Adds a readonly profile (readonly: 1, same memory/time limits as default)
  • Adds a clickhouse-logreader VaultStaticSecret mirroring the existing clickhouse-credentials object (kv-v2, 5m refresh, VSO-created destination Secret)

Vault kv

Seeded at kv/kubernetes/namespace/logging/default/clickhouse-logreader (version 1) with keys: username, password, password_sha256_hex. No secret material lands in git; the CHI only ever sees the sha256 hash via the synced Secret.

## Why CLI tools and the logviewer UI need ClickHouse access without write or DDL rights. The only existing app user (`vector`) has `access_management` and write access; this adds a properly scoped read-only login using the same secret-sourcing mechanism. ## Changes - Adds a `logreader` user to the `logs` ClickHouseInstallation: password hash via `secretKeyRef` to the Vault-synced `clickhouse-logreader` Secret (same mechanism as `vector`), networks `::/0`, `readonly` profile, scoped to the `logs` database only - Adds a `readonly` profile (`readonly: 1`, same memory/time limits as default) - Adds a `clickhouse-logreader` VaultStaticSecret mirroring the existing `clickhouse-credentials` object (kv-v2, 5m refresh, VSO-created destination Secret) ## Vault kv Seeded at `kv/kubernetes/namespace/logging/default/clickhouse-logreader` (version 1) with keys: `username`, `password`, `password_sha256_hex`. No secret material lands in git; the CHI only ever sees the sha256 hash via the synced Secret.
unkin-agent added 1 commit 2026-08-23 16:33:24 +10:00
logging: add read-only clickhouse logreader user + Vault-synced secret
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
9f574d03e1 
CLI tools and the logviewer UI need ClickHouse access without write or
DDL rights. Adds a logreader user to the logs CHI mirroring the vector
user mechanism: password sha256 hash sourced from a Vault-synced Secret,
readonly profile, scoped to the logs database only. Credentials are
seeded in Vault kv and synced by VSO, so no secret material lands in git.
benvin merged commit cd51078d79 into main 2026-08-23 17:00:07 +10:00
benvin deleted branch benvin/clickhouse-logreader 2026-08-23 17:00:07 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#400
Delete Branch "benvin/clickhouse-logreader"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?