unkin-agent
d1085f0ae2
rke2's `registries.yaml` already rewrites upstream image names to the artifactapi mirror, so manifests must carry canonical upstream names. Only in-house `artifactapi.k8s.syd1.au.unkin.net/docker-internal/...` images stay explicit (logarchiver/logviewer are untouched). Changes: - Point the ClickHouseInstallation and the clickhouse-schema job at `docker.io/clickhouse/clickhouse-server:24.8`. - Point the logviewer oauth2-proxy cert-combine init container at `docker.io/library/alpine:3`. - Point the NATS bootstrap job at `docker.io/natsio/nats-box:0.18.0`. - Point the NATS chart values at `docker.io/library/nats` and `docker.io/natsio/nats-server-config-reloader`. - Point all three Vector values files (agent, aggregator, vm-ingest) at `docker.io/timberio/vector`. - Drop the now-wrong "pulled through the artifactapi dockerhub remote" comments in the NATS and vector-agent values. Tags/digests unchanged and the `repository`/`tag` split is preserved. `kustomize build --enable-helm apps/overlays/au-syd1/logging` differs from main only in those nine image strings. Extra found, not changed here: `.woodpecker/vector-test.yaml` still pins its CI step image to `artifactapi.k8s.syd1.au.unkin.net/dockerhub/timberio/vector:0.57.0-debian`. That is a Woodpecker step image rather than a namespace manifest, so it is left out to keep this PR to the logging namespace — say the word and I will fix it separately. Reviewed-on: #433 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
98 lines
3.0 KiB
YAML
98 lines
3.0 KiB
YAML
---
|
|
apiVersion: clickhouse.altinity.com/v1
|
|
kind: ClickHouseInstallation
|
|
metadata:
|
|
name: logs
|
|
namespace: logging
|
|
spec:
|
|
defaults:
|
|
templates:
|
|
dataVolumeClaimTemplate: data-volume
|
|
serviceTemplate: chi-service
|
|
podTemplate: clickhouse
|
|
configuration:
|
|
users:
|
|
# Password hash is sourced from the Vault-synced clickhouse-credentials
|
|
# Secret; the plaintext never lands in git or the ClickHouse config.
|
|
vector/password_sha256_hex:
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: clickhouse-credentials
|
|
key: password_sha256_hex
|
|
vector/networks/ip:
|
|
- "::/0"
|
|
vector/profile: default
|
|
vector/quota: default
|
|
# Allow the vector user to create the logs database/table (bootstrap Job)
|
|
# and to INSERT. Restrict the built-in default user to loopback only.
|
|
vector/access_management: "1"
|
|
default/networks/ip:
|
|
- "127.0.0.1"
|
|
- "::1"
|
|
# Read-only user for CLI tools + the logviewer UI. Hash sourced from the
|
|
# Vault-synced clickhouse-logreader Secret, same mechanism as vector.
|
|
# Scoped to the logs database only (unlike vector, which bootstraps it).
|
|
logreader/password_sha256_hex:
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: clickhouse-logreader
|
|
key: password_sha256_hex
|
|
logreader/networks/ip:
|
|
- "::/0"
|
|
logreader/profile: readonly
|
|
logreader/quota: default
|
|
logreader/allow_databases/database:
|
|
- "logs"
|
|
profiles:
|
|
default/max_memory_usage: "10000000000"
|
|
default/max_execution_time: "120"
|
|
readonly/readonly: "2"
|
|
readonly/max_memory_usage: "10000000000"
|
|
readonly/max_execution_time: "120"
|
|
clusters:
|
|
- name: logs
|
|
layout:
|
|
shardsCount: 1
|
|
replicasCount: 1
|
|
templates:
|
|
volumeClaimTemplates:
|
|
- name: data-volume
|
|
spec:
|
|
storageClassName: cephrbd-fast-delete
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
resources:
|
|
requests:
|
|
# 3d TTL on logs.raw. At ~130 GiB/day raw, ClickHouse LZ4/ZSTD
|
|
# (~6x on log text) stores ~20-25 GiB/day => ~60-75 GiB/3d, plus
|
|
# merge headroom (~2x peak). logs.raw is the only table. 150Gi
|
|
# gives comfortable headroom; long-term data lives in S3, not here.
|
|
storage: 150Gi
|
|
serviceTemplates:
|
|
- name: chi-service
|
|
generateName: "clickhouse-{chi}"
|
|
spec:
|
|
type: ClusterIP
|
|
ports:
|
|
- name: http
|
|
port: 8123
|
|
- name: tcp
|
|
port: 9000
|
|
podTemplates:
|
|
- name: clickhouse
|
|
spec:
|
|
securityContext:
|
|
fsGroup: 101
|
|
runAsUser: 101
|
|
runAsGroup: 101
|
|
containers:
|
|
- name: clickhouse
|
|
image: docker.io/clickhouse/clickhouse-server:24.8
|
|
resources:
|
|
requests:
|
|
cpu: 500m
|
|
memory: 2Gi
|
|
limits:
|
|
cpu: "2"
|
|
memory: 8Gi
|