unkin-agent
5a23146513
## Why The `readonly` profile used by `logreader` sets `readonly=1`, which rejects any per-query settings change. HTTP clients (logviewer, chlog) send settings params like `max_execution_time` with their queries, so every query fails with `Code: 164 DB::Exception: Cannot modify 'max_execution_time' setting in readonly mode` — logviewer healthz returns 503 and CrashLoops, chlog queries fail. `readonly=2` keeps data access read-only while permitting settings changes, which is what HTTP clients need. ## Changes - Changes the `readonly` profile in `apps/base/logging/clickhouseinstallation.yaml` from `readonly: "1"` to `readonly: "2"` Reviewed-on: #409 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
98 lines
3.1 KiB
YAML
98 lines
3.1 KiB
YAML
---
|
|
apiVersion: clickhouse.altinity.com/v1
|
|
kind: ClickHouseInstallation
|
|
metadata:
|
|
name: logs
|
|
namespace: logging
|
|
spec:
|
|
defaults:
|
|
templates:
|
|
dataVolumeClaimTemplate: data-volume
|
|
serviceTemplate: chi-service
|
|
podTemplate: clickhouse
|
|
configuration:
|
|
users:
|
|
# Password hash is sourced from the Vault-synced clickhouse-credentials
|
|
# Secret; the plaintext never lands in git or the ClickHouse config.
|
|
vector/password_sha256_hex:
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: clickhouse-credentials
|
|
key: password_sha256_hex
|
|
vector/networks/ip:
|
|
- "::/0"
|
|
vector/profile: default
|
|
vector/quota: default
|
|
# Allow the vector user to create the logs database/table (bootstrap Job)
|
|
# and to INSERT. Restrict the built-in default user to loopback only.
|
|
vector/access_management: "1"
|
|
default/networks/ip:
|
|
- "127.0.0.1"
|
|
- "::1"
|
|
# Read-only user for CLI tools + the logviewer UI. Hash sourced from the
|
|
# Vault-synced clickhouse-logreader Secret, same mechanism as vector.
|
|
# Scoped to the logs database only (unlike vector, which bootstraps it).
|
|
logreader/password_sha256_hex:
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: clickhouse-logreader
|
|
key: password_sha256_hex
|
|
logreader/networks/ip:
|
|
- "::/0"
|
|
logreader/profile: readonly
|
|
logreader/quota: default
|
|
logreader/allow_databases/database:
|
|
- "logs"
|
|
profiles:
|
|
default/max_memory_usage: "10000000000"
|
|
default/max_execution_time: "120"
|
|
readonly/readonly: "2"
|
|
readonly/max_memory_usage: "10000000000"
|
|
readonly/max_execution_time: "120"
|
|
clusters:
|
|
- name: logs
|
|
layout:
|
|
shardsCount: 1
|
|
replicasCount: 1
|
|
templates:
|
|
volumeClaimTemplates:
|
|
- name: data-volume
|
|
spec:
|
|
storageClassName: cephrbd-fast-delete
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
resources:
|
|
requests:
|
|
# 3d TTL on logs.raw. At ~130 GiB/day raw, ClickHouse LZ4/ZSTD
|
|
# (~6x on log text) stores ~20-25 GiB/day => ~60-75 GiB/3d, plus
|
|
# merge headroom (~2x peak). logs.raw is the only table. 150Gi
|
|
# gives comfortable headroom; long-term data lives in S3, not here.
|
|
storage: 150Gi
|
|
serviceTemplates:
|
|
- name: chi-service
|
|
generateName: "clickhouse-{chi}"
|
|
spec:
|
|
type: ClusterIP
|
|
ports:
|
|
- name: http
|
|
port: 8123
|
|
- name: tcp
|
|
port: 9000
|
|
podTemplates:
|
|
- name: clickhouse
|
|
spec:
|
|
securityContext:
|
|
fsGroup: 101
|
|
runAsUser: 101
|
|
runAsGroup: 101
|
|
containers:
|
|
- name: clickhouse
|
|
image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/clickhouse/clickhouse-server:24.8
|
|
resources:
|
|
requests:
|
|
cpu: 500m
|
|
memory: 2Gi
|
|
limits:
|
|
cpu: "2"
|
|
memory: 8Gi
|