# Vector ARCHIVER tier (Deployment) — independent JetStream consumer writing raw
# logs to S3 (Ceph RGW). Isolated from the ClickHouse path (own durable
# consumer). Pipeline: apps/base/logging/vector/archiver.yaml.
role: Stateless-Aggregator
fullnameOverride: vector-archiver
replicas: 1

image:
  repository: artifactapi.k8s.syd1.au.unkin.net/dockerhub/timberio/vector
  tag: 0.57.0-distroless-libc

workloadResourceAnnotations:
  reloader.stakater.com/auto: "true"

podLabels:
  vector.dev/exclude: "true"

dataDir: /vector-data-dir
existingConfigMaps:
  - vector-archiver-config

env:
  # Vector 0.57 disables ${VAR} config interpolation by default; auth needs it.
  - name: VECTOR_DANGEROUSLY_ALLOW_ENV_VAR_INTERPOLATION
    value: "true"
  - name: NATS_CONSUMER_PASSWORD
    valueFrom:
      secretKeyRef:
        name: nats-auth
        key: consumer_password

# S3 creds (AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY) from the cephrgw-operator
# BucketAccess Secret.
envFrom:
  - secretRef:
      name: logs-archive-s3

# Trust the internal unkin.net Vault-PKI CA to verify s3.ceph.unkin.net.
# vault-ca-cert is reflected into every namespace from the certificates ns.
extraVolumes:
  - name: vault-ca-cert
    secret:
      secretName: vault-ca-cert
extraVolumeMounts:
  - name: vault-ca-cert
    mountPath: /etc/vault-ca/ca.crt
    subPath: ca.crt
    readOnly: true

service:
  enabled: false

resources:
  requests:
    cpu: 100m
    memory: 256Mi
  limits:
    cpu: "1"
    memory: 1Gi