unkin-agent
9f574d03e1
CLI tools and the logviewer UI need ClickHouse access without write or DDL rights. Adds a logreader user to the logs CHI mirroring the vector user mechanism: password sha256 hash sourced from a Vault-synced Secret, readonly profile, scoped to the logs database only. Credentials are seeded in Vault kv and synced by VSO, so no secret material lands in git.
74 lines
2.4 KiB
YAML
74 lines
2.4 KiB
YAML
---
|
|
# ClickHouse credentials for the `vector` user.
|
|
#
|
|
# Seed the Vault KV entry once (values are NOT stored in git), e.g.:
|
|
# PW=$(openssl rand -base64 24)
|
|
# HASH=$(printf '%s' "$PW" | sha256sum | cut -d' ' -f1)
|
|
# vault kv put kv/kubernetes/namespace/logging/default/clickhouse-credentials \
|
|
# username=vector password="$PW" password_sha256_hex="$HASH"
|
|
#
|
|
# The `logging/default` ServiceAccount reads this path via the templated
|
|
# `policies/kv/kubernetes/default.yaml` policy (k8s auth role `default`), so no
|
|
# terraform-vault change is required — only the value above must be written.
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: clickhouse-credentials
|
|
namespace: logging
|
|
spec:
|
|
destination:
|
|
create: true
|
|
name: clickhouse-credentials
|
|
overwrite: true
|
|
hmacSecretData: true
|
|
mount: kv
|
|
path: kubernetes/namespace/logging/default/clickhouse-credentials
|
|
refreshAfter: 5m
|
|
type: kv-v2
|
|
vaultAuthRef: default
|
|
---
|
|
# ClickHouse credentials for the read-only `logreader` user (CLI tools +
|
|
# logviewer UI). Seeded the same way as clickhouse-credentials above:
|
|
# PW=$(openssl rand -hex 24)
|
|
# HASH=$(printf '%s' "$PW" | sha256sum | cut -d' ' -f1)
|
|
# vault kv put kv/kubernetes/namespace/logging/default/clickhouse-logreader \
|
|
# username=logreader password="$PW" password_sha256_hex="$HASH"
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: clickhouse-logreader
|
|
namespace: logging
|
|
spec:
|
|
destination:
|
|
create: true
|
|
name: clickhouse-logreader
|
|
overwrite: true
|
|
hmacSecretData: true
|
|
mount: kv
|
|
path: kubernetes/namespace/logging/default/clickhouse-logreader
|
|
refreshAfter: 5m
|
|
type: kv-v2
|
|
vaultAuthRef: default
|
|
---
|
|
# NATS JetStream auth. Distinct passwords for the producer (edge), consumer
|
|
# (transform tier + archiver) and admin (bootstrap Job) users. Seed once:
|
|
# for k in admin producer consumer; do declare P_$k=$(openssl rand -base64 24); done
|
|
# vault kv put kv/kubernetes/namespace/logging/default/nats-auth \
|
|
# admin_password="$P_admin" producer_password="$P_producer" consumer_password="$P_consumer"
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: nats-auth
|
|
namespace: logging
|
|
spec:
|
|
destination:
|
|
create: true
|
|
name: nats-auth
|
|
overwrite: true
|
|
hmacSecretData: true
|
|
mount: kv
|
|
path: kubernetes/namespace/logging/default/nats-auth
|
|
refreshAfter: 5m
|
|
type: kv-v2
|
|
vaultAuthRef: default
|