unkin-agent
9f574d03e1
CLI tools and the logviewer UI need ClickHouse access without write or DDL rights. Adds a logreader user to the logs CHI mirroring the vector user mechanism: password sha256 hash sourced from a Vault-synced Secret, readonly profile, scoped to the logs database only. Credentials are seeded in Vault kv and synced by VSO, so no secret material lands in git.
98 lines
3.1 KiB
YAML
98 lines
3.1 KiB
YAML
---
|
|
apiVersion: clickhouse.altinity.com/v1
|
|
kind: ClickHouseInstallation
|
|
metadata:
|
|
name: logs
|
|
namespace: logging
|
|
spec:
|
|
defaults:
|
|
templates:
|
|
dataVolumeClaimTemplate: data-volume
|
|
serviceTemplate: chi-service
|
|
podTemplate: clickhouse
|
|
configuration:
|
|
users:
|
|
# Password hash is sourced from the Vault-synced clickhouse-credentials
|
|
# Secret; the plaintext never lands in git or the ClickHouse config.
|
|
vector/password_sha256_hex:
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: clickhouse-credentials
|
|
key: password_sha256_hex
|
|
vector/networks/ip:
|
|
- "::/0"
|
|
vector/profile: default
|
|
vector/quota: default
|
|
# Allow the vector user to create the logs database/table (bootstrap Job)
|
|
# and to INSERT. Restrict the built-in default user to loopback only.
|
|
vector/access_management: "1"
|
|
default/networks/ip:
|
|
- "127.0.0.1"
|
|
- "::1"
|
|
# Read-only user for CLI tools + the logviewer UI. Hash sourced from the
|
|
# Vault-synced clickhouse-logreader Secret, same mechanism as vector.
|
|
# Scoped to the logs database only (unlike vector, which bootstraps it).
|
|
logreader/password_sha256_hex:
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: clickhouse-logreader
|
|
key: password_sha256_hex
|
|
logreader/networks/ip:
|
|
- "::/0"
|
|
logreader/profile: readonly
|
|
logreader/quota: default
|
|
logreader/allow_databases/database:
|
|
- "logs"
|
|
profiles:
|
|
default/max_memory_usage: "10000000000"
|
|
default/max_execution_time: "120"
|
|
readonly/readonly: "1"
|
|
readonly/max_memory_usage: "10000000000"
|
|
readonly/max_execution_time: "120"
|
|
clusters:
|
|
- name: logs
|
|
layout:
|
|
shardsCount: 1
|
|
replicasCount: 1
|
|
templates:
|
|
volumeClaimTemplates:
|
|
- name: data-volume
|
|
spec:
|
|
storageClassName: cephrbd-fast-delete
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
resources:
|
|
requests:
|
|
# 3d TTL on logs.raw. At ~130 GiB/day raw, ClickHouse LZ4/ZSTD
|
|
# (~6x on log text) stores ~20-25 GiB/day => ~60-75 GiB/3d, plus
|
|
# merge headroom (~2x peak). logs.raw is the only table. 150Gi
|
|
# gives comfortable headroom; long-term data lives in S3, not here.
|
|
storage: 150Gi
|
|
serviceTemplates:
|
|
- name: chi-service
|
|
generateName: "clickhouse-{chi}"
|
|
spec:
|
|
type: ClusterIP
|
|
ports:
|
|
- name: http
|
|
port: 8123
|
|
- name: tcp
|
|
port: 9000
|
|
podTemplates:
|
|
- name: clickhouse
|
|
spec:
|
|
securityContext:
|
|
fsGroup: 101
|
|
runAsUser: 101
|
|
runAsGroup: 101
|
|
containers:
|
|
- name: clickhouse
|
|
image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/clickhouse/clickhouse-server:24.8
|
|
resources:
|
|
requests:
|
|
cpu: 500m
|
|
memory: 2Gi
|
|
limits:
|
|
cpu: "2"
|
|
memory: 8Gi
|