unkin-agent
d1085f0ae2
rke2's `registries.yaml` already rewrites upstream image names to the artifactapi mirror, so manifests must carry canonical upstream names. Only in-house `artifactapi.k8s.syd1.au.unkin.net/docker-internal/...` images stay explicit (logarchiver/logviewer are untouched). Changes: - Point the ClickHouseInstallation and the clickhouse-schema job at `docker.io/clickhouse/clickhouse-server:24.8`. - Point the logviewer oauth2-proxy cert-combine init container at `docker.io/library/alpine:3`. - Point the NATS bootstrap job at `docker.io/natsio/nats-box:0.18.0`. - Point the NATS chart values at `docker.io/library/nats` and `docker.io/natsio/nats-server-config-reloader`. - Point all three Vector values files (agent, aggregator, vm-ingest) at `docker.io/timberio/vector`. - Drop the now-wrong "pulled through the artifactapi dockerhub remote" comments in the NATS and vector-agent values. Tags/digests unchanged and the `repository`/`tag` split is preserved. `kustomize build --enable-helm apps/overlays/au-syd1/logging` differs from main only in those nine image strings. Extra found, not changed here: `.woodpecker/vector-test.yaml` still pins its CI step image to `artifactapi.k8s.syd1.au.unkin.net/dockerhub/timberio/vector:0.57.0-debian`. That is a Woodpecker step image rather than a namespace manifest, so it is left out to keep this PR to the logging namespace — say the word and I will fix it separately. Reviewed-on: #433 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
54 lines
1.3 KiB
YAML
54 lines
1.3 KiB
YAML
# Vector EDGE agent (DaemonSet) — thin publisher. Tails every node's pod logs
|
|
# (incl. control-plane via the blanket toleration) and publishes them into
|
|
# JetStream over the Vector NATS sink. No parsing; only a routing subject token
|
|
# is attached. Shaping happens in the transform tier after JetStream.
|
|
role: Agent
|
|
fullnameOverride: vector-agent
|
|
|
|
# distroless-libc (no DHI — subscription-gated/private-namespace, not reachable
|
|
# via the anon proxy).
|
|
image:
|
|
repository: docker.io/timberio/vector
|
|
tag: 0.57.0-distroless-libc
|
|
|
|
rbac:
|
|
create: true
|
|
serviceAccount:
|
|
create: true
|
|
|
|
podLabels:
|
|
vector.dev/exclude: "true"
|
|
|
|
tolerations:
|
|
- operator: Exists
|
|
|
|
env:
|
|
# Vector 0.57 disables ${VAR} config interpolation by default; auth needs it.
|
|
- name: VECTOR_DANGEROUSLY_ALLOW_ENV_VAR_INTERPOLATION
|
|
value: "true"
|
|
- name: NATS_PRODUCER_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: nats-auth
|
|
key: producer_password
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 1Gi
|
|
|
|
service:
|
|
enabled: false
|
|
|
|
# Pipeline is the single source of truth in apps/base/logging/vector/agent.yaml,
|
|
# mounted via existingConfigMaps (avoids the chart's customConfig Helm-tpl pass).
|
|
dataDir: /vector-data-dir
|
|
existingConfigMaps:
|
|
- vector-agent-config
|
|
|
|
workloadResourceAnnotations:
|
|
configmap.reloader.stakater.com/auto: "true"
|