unkin-agent
cd51078d79
## Why CLI tools and the logviewer UI need ClickHouse access without write or DDL rights. The only existing app user (`vector`) has `access_management` and write access; this adds a properly scoped read-only login using the same secret-sourcing mechanism. ## Changes - Adds a `logreader` user to the `logs` ClickHouseInstallation: password hash via `secretKeyRef` to the Vault-synced `clickhouse-logreader` Secret (same mechanism as `vector`), networks `::/0`, `readonly` profile, scoped to the `logs` database only - Adds a `readonly` profile (`readonly: 1`, same memory/time limits as default) - Adds a `clickhouse-logreader` VaultStaticSecret mirroring the existing `clickhouse-credentials` object (kv-v2, 5m refresh, VSO-created destination Secret) ## Vault kv Seeded at `kv/kubernetes/namespace/logging/default/clickhouse-logreader` (version 1) with keys: `username`, `password`, `password_sha256_hex`. No secret material lands in git; the CHI only ever sees the sha256 hash via the synced Secret. Reviewed-on: #400 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
74 lines
2.4 KiB
YAML
74 lines
2.4 KiB
YAML
---
|
|
# ClickHouse credentials for the `vector` user.
|
|
#
|
|
# Seed the Vault KV entry once (values are NOT stored in git), e.g.:
|
|
# PW=$(openssl rand -base64 24)
|
|
# HASH=$(printf '%s' "$PW" | sha256sum | cut -d' ' -f1)
|
|
# vault kv put kv/kubernetes/namespace/logging/default/clickhouse-credentials \
|
|
# username=vector password="$PW" password_sha256_hex="$HASH"
|
|
#
|
|
# The `logging/default` ServiceAccount reads this path via the templated
|
|
# `policies/kv/kubernetes/default.yaml` policy (k8s auth role `default`), so no
|
|
# terraform-vault change is required — only the value above must be written.
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: clickhouse-credentials
|
|
namespace: logging
|
|
spec:
|
|
destination:
|
|
create: true
|
|
name: clickhouse-credentials
|
|
overwrite: true
|
|
hmacSecretData: true
|
|
mount: kv
|
|
path: kubernetes/namespace/logging/default/clickhouse-credentials
|
|
refreshAfter: 5m
|
|
type: kv-v2
|
|
vaultAuthRef: default
|
|
---
|
|
# ClickHouse credentials for the read-only `logreader` user (CLI tools +
|
|
# logviewer UI). Seeded the same way as clickhouse-credentials above:
|
|
# PW=$(openssl rand -hex 24)
|
|
# HASH=$(printf '%s' "$PW" | sha256sum | cut -d' ' -f1)
|
|
# vault kv put kv/kubernetes/namespace/logging/default/clickhouse-logreader \
|
|
# username=logreader password="$PW" password_sha256_hex="$HASH"
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: clickhouse-logreader
|
|
namespace: logging
|
|
spec:
|
|
destination:
|
|
create: true
|
|
name: clickhouse-logreader
|
|
overwrite: true
|
|
hmacSecretData: true
|
|
mount: kv
|
|
path: kubernetes/namespace/logging/default/clickhouse-logreader
|
|
refreshAfter: 5m
|
|
type: kv-v2
|
|
vaultAuthRef: default
|
|
---
|
|
# NATS JetStream auth. Distinct passwords for the producer (edge), consumer
|
|
# (transform tier + archiver) and admin (bootstrap Job) users. Seed once:
|
|
# for k in admin producer consumer; do declare P_$k=$(openssl rand -base64 24); done
|
|
# vault kv put kv/kubernetes/namespace/logging/default/nats-auth \
|
|
# admin_password="$P_admin" producer_password="$P_producer" consumer_password="$P_consumer"
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: nats-auth
|
|
namespace: logging
|
|
spec:
|
|
destination:
|
|
create: true
|
|
name: nats-auth
|
|
overwrite: true
|
|
hmacSecretData: true
|
|
mount: kv
|
|
path: kubernetes/namespace/logging/default/nats-auth
|
|
refreshAfter: 5m
|
|
type: kv-v2
|
|
vaultAuthRef: default
|