unkin-agent
cd51078d79
## Why CLI tools and the logviewer UI need ClickHouse access without write or DDL rights. The only existing app user (`vector`) has `access_management` and write access; this adds a properly scoped read-only login using the same secret-sourcing mechanism. ## Changes - Adds a `logreader` user to the `logs` ClickHouseInstallation: password hash via `secretKeyRef` to the Vault-synced `clickhouse-logreader` Secret (same mechanism as `vector`), networks `::/0`, `readonly` profile, scoped to the `logs` database only - Adds a `readonly` profile (`readonly: 1`, same memory/time limits as default) - Adds a `clickhouse-logreader` VaultStaticSecret mirroring the existing `clickhouse-credentials` object (kv-v2, 5m refresh, VSO-created destination Secret) ## Vault kv Seeded at `kv/kubernetes/namespace/logging/default/clickhouse-logreader` (version 1) with keys: `username`, `password`, `password_sha256_hex`. No secret material lands in git; the CHI only ever sees the sha256 hash via the synced Secret. Reviewed-on: #400 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
98 lines
3.1 KiB
YAML
98 lines
3.1 KiB
YAML
---
|
|
apiVersion: clickhouse.altinity.com/v1
|
|
kind: ClickHouseInstallation
|
|
metadata:
|
|
name: logs
|
|
namespace: logging
|
|
spec:
|
|
defaults:
|
|
templates:
|
|
dataVolumeClaimTemplate: data-volume
|
|
serviceTemplate: chi-service
|
|
podTemplate: clickhouse
|
|
configuration:
|
|
users:
|
|
# Password hash is sourced from the Vault-synced clickhouse-credentials
|
|
# Secret; the plaintext never lands in git or the ClickHouse config.
|
|
vector/password_sha256_hex:
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: clickhouse-credentials
|
|
key: password_sha256_hex
|
|
vector/networks/ip:
|
|
- "::/0"
|
|
vector/profile: default
|
|
vector/quota: default
|
|
# Allow the vector user to create the logs database/table (bootstrap Job)
|
|
# and to INSERT. Restrict the built-in default user to loopback only.
|
|
vector/access_management: "1"
|
|
default/networks/ip:
|
|
- "127.0.0.1"
|
|
- "::1"
|
|
# Read-only user for CLI tools + the logviewer UI. Hash sourced from the
|
|
# Vault-synced clickhouse-logreader Secret, same mechanism as vector.
|
|
# Scoped to the logs database only (unlike vector, which bootstraps it).
|
|
logreader/password_sha256_hex:
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: clickhouse-logreader
|
|
key: password_sha256_hex
|
|
logreader/networks/ip:
|
|
- "::/0"
|
|
logreader/profile: readonly
|
|
logreader/quota: default
|
|
logreader/allow_databases/database:
|
|
- "logs"
|
|
profiles:
|
|
default/max_memory_usage: "10000000000"
|
|
default/max_execution_time: "120"
|
|
readonly/readonly: "1"
|
|
readonly/max_memory_usage: "10000000000"
|
|
readonly/max_execution_time: "120"
|
|
clusters:
|
|
- name: logs
|
|
layout:
|
|
shardsCount: 1
|
|
replicasCount: 1
|
|
templates:
|
|
volumeClaimTemplates:
|
|
- name: data-volume
|
|
spec:
|
|
storageClassName: cephrbd-fast-delete
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
resources:
|
|
requests:
|
|
# 3d TTL on logs.raw. At ~130 GiB/day raw, ClickHouse LZ4/ZSTD
|
|
# (~6x on log text) stores ~20-25 GiB/day => ~60-75 GiB/3d, plus
|
|
# merge headroom (~2x peak). logs.raw is the only table. 150Gi
|
|
# gives comfortable headroom; long-term data lives in S3, not here.
|
|
storage: 150Gi
|
|
serviceTemplates:
|
|
- name: chi-service
|
|
generateName: "clickhouse-{chi}"
|
|
spec:
|
|
type: ClusterIP
|
|
ports:
|
|
- name: http
|
|
port: 8123
|
|
- name: tcp
|
|
port: 9000
|
|
podTemplates:
|
|
- name: clickhouse
|
|
spec:
|
|
securityContext:
|
|
fsGroup: 101
|
|
runAsUser: 101
|
|
runAsGroup: 101
|
|
containers:
|
|
- name: clickhouse
|
|
image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/clickhouse/clickhouse-server:24.8
|
|
resources:
|
|
requests:
|
|
cpu: 500m
|
|
memory: 2Gi
|
|
limits:
|
|
cpu: "2"
|
|
memory: 8Gi
|