unkinben
1202aae06f
Three changes from review: 1. Pull every container image through the artifactapi dockerhub remote instead of direct upstream: clickhouse-server, altinity operator + metrics-exporter, bitnami/kubectl (crdHook), nats + nats-server-config-reloader, nats-box (bootstrap Job), and vector (all tiers + the CI image). Requires terraform-artifactapi#16 (dockerhub allowlist patterns) merged first. 2. Keep upstream official images (no Docker Hardened Images). DHI exists for clickhouse-server and vector but is subscription-gated and served from a private org namespace not reachable via the anonymous artifactapi dockerhub proxy; its shell-less images would also break the bash bootstrap Jobs and the shell-based vector-test CI step. Use vector's distroless-libc for runtime pods (near-hardened) and the debian variant only for CI. 3. Make the transform tier a stateless Deployment (was a StatefulSet): no PVC, no disk buffer — JetStream is the sole durability layer. The ClickHouse sink uses an in-memory block buffer so a ClickHouse outage back-pressures the JetStream pull source (unpulled messages are retained/redelivered). Add a CPU HPA (2-8) — safe because JetStream pull consumers distribute work across N replicas on the one durable consumer. Caveat documented: vector's NATS source has no end-to-end acks (acks on receipt), so a pod killed mid-outage can lose its in-memory buffer window; accepted trade for a stateless autoscaling tier. Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
106 lines
3.8 KiB
YAML
106 lines
3.8 KiB
YAML
---
|
|
# Declarative ClickHouse schema bootstrap. Runs as an ArgoCD PostSync hook so it
|
|
# executes after the ClickHouseInstallation is reconciled, and re-runs on every
|
|
# sync (idempotent CREATE ... IF NOT EXISTS). Edit the DDL here to evolve the
|
|
# schema; the Vector aggregator writes to logs.raw with skip_unknown_fields, so
|
|
# adding columns is backward-compatible.
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: clickhouse-schema
|
|
namespace: logging
|
|
annotations:
|
|
argocd.argoproj.io/hook: PostSync
|
|
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
|
|
labels:
|
|
app.kubernetes.io/name: clickhouse-schema
|
|
app.kubernetes.io/component: bootstrap
|
|
spec:
|
|
backoffLimit: 20
|
|
activeDeadlineSeconds: 1800
|
|
ttlSecondsAfterFinished: 3600
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: clickhouse-schema
|
|
vector.dev/exclude: "true"
|
|
spec:
|
|
restartPolicy: OnFailure
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 101
|
|
runAsGroup: 101
|
|
containers:
|
|
- name: clickhouse-schema
|
|
image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/clickhouse/clickhouse-server:24.8
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
env:
|
|
- name: HOME
|
|
value: /tmp
|
|
- name: CLICKHOUSE_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: clickhouse-credentials
|
|
key: username
|
|
- name: CLICKHOUSE_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: clickhouse-credentials
|
|
key: password
|
|
command:
|
|
- /bin/bash
|
|
- -ec
|
|
- |
|
|
host=clickhouse-logs.logging.svc.cluster.local
|
|
echo "Waiting for ClickHouse at ${host}:9000 ..."
|
|
until clickhouse-client --host "$host" --port 9000 \
|
|
--user "$CLICKHOUSE_USER" --password "$CLICKHOUSE_PASSWORD" \
|
|
--query "SELECT 1" >/dev/null 2>&1; do
|
|
echo " not ready, retrying in 5s"; sleep 5
|
|
done
|
|
echo "Applying schema ..."
|
|
clickhouse-client --host "$host" --port 9000 \
|
|
--user "$CLICKHOUSE_USER" --password "$CLICKHOUSE_PASSWORD" \
|
|
--multiquery <<'EOSQL'
|
|
CREATE DATABASE IF NOT EXISTS logs;
|
|
|
|
CREATE TABLE IF NOT EXISTS logs.raw
|
|
(
|
|
timestamp DateTime64(3) DEFAULT now64(3),
|
|
host LowCardinality(String) DEFAULT '',
|
|
source LowCardinality(String) DEFAULT '',
|
|
namespace LowCardinality(String) DEFAULT '',
|
|
pod String DEFAULT '',
|
|
container LowCardinality(String) DEFAULT '',
|
|
stream LowCardinality(String) DEFAULT '',
|
|
severity LowCardinality(String) DEFAULT '',
|
|
message String DEFAULT '',
|
|
labels Map(LowCardinality(String), String),
|
|
fields Map(LowCardinality(String), String)
|
|
)
|
|
ENGINE = MergeTree
|
|
PARTITION BY toDate(timestamp)
|
|
ORDER BY (source, namespace, host, timestamp)
|
|
TTL toDateTime(timestamp) + INTERVAL 30 DAY
|
|
SETTINGS index_granularity = 8192;
|
|
EOSQL
|
|
echo "Schema applied."
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
volumeMounts:
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
volumes:
|
|
- name: tmp
|
|
emptyDir: {}
|