---
# S3 bucket (Ceph RGW) for the long-term raw-log archive, provisioned by the
# in-estate cephrgw-operator. The archiver Vector deployment writes here.
apiVersion: ceph.unkin.net/v1alpha1
kind: ObjectStoreUser
metadata:
  name: logs-archive-owner
  namespace: logging
spec:
  displayName: "Logging raw-archive bucket owner"
  maxBuckets: 5
  quota:
    enabled: true
    # 5 TiB soft cap; real retention is enforced RGW-side by a bucket lifecycle
    # policy (see PR notes) — the operator does not manage lifecycle.
    maxSizeBytes: 5497558138880
---
apiVersion: ceph.unkin.net/v1alpha1
kind: Bucket
metadata:
  name: logs-archive
  namespace: logging
spec:
  bucketName: logs-archive
  ownerRef: logs-archive-owner
  versioning: false
  tags:
    app: logging
    purpose: raw-log-archive
  # Keep the bucket (and its objects) if this CR is ever deleted.
  retainOnDelete: true
---
apiVersion: ceph.unkin.net/v1alpha1
kind: BucketAccess
metadata:
  name: logs-archive-writer
  namespace: logging
spec:
  bucketRef: logs-archive
  level: read-write
  # Operator writes AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY (+ RGW_UID,
  # S3_ENDPOINT, BUCKET_NAME) into this Secret; the archiver consumes it.
  secretName: logs-archive-s3