added repo

2026-08-26 03:39:42 +05:30
parent 45c25a95af
commit b8575bb8b9
6889 changed files with 1217125 additions and 0 deletions
@@ -0,0 +1,251 @@
+# logHouse (central-prd) - overrides only.
+# Google SSO via oauth2-proxy; ClickHouse ingress disabled.
+oauth2Proxy:
+  enabled: true
+
+# nginx audit proxy maps X-Forwarded-Email → X-ClickHouse-Setting-log_comment
+# so system.query_log.log_comment shows the SSO email of who ran each query.
+auditProxy:
+  enabled: true
+  replicas: 2
+  image: "nginx:1.27-alpine"
+  tolerations:
+    - key: "dedicated"
+      operator: "Equal"
+      value: "loghouse"
+      effect: "NoSchedule"
+
+externalSecret:
+  enabled: true
+  path: meesho/prd/cntr/devop/loghouse
+  secretName: loghouse-oauth2-secret
+  annotations: {}
+
+# --- Bitnami ClickHouse subchart ---
+clickhouse:
+  replicaCount: 3
+  global:
+    security:
+      allowInsecureImages: true
+
+  image:
+    registry: asia-southeast1-docker.pkg.dev
+    repository: meesho-devops-admin-0622/prd/sis/clickhouse
+    tag: 25.6.2-debian-12-r0
+
+  auth:
+    username: default
+    password: ""
+    existingSecret: "loghouse-oauth2-secret"
+    existingSecretKey: "clickhouse-password"
+
+
+  # Enable sampling so Bitnami's 08-sampling.xml preserves query_log,
+  # text_log, metric_log etc. All queries are recorded in system.query_log.
+  sampling:
+    enabled: true
+
+  usersdFiles:
+    grant_all.xml: |
+      <yandex>
+        <users>
+          <default>
+            <access_management>1</access_management>
+            <named_collection_control>1</named_collection_control>
+          </default>
+        </users>
+      </yandex>
+    log_queries.xml: |
+      <clickhouse>
+        <profiles>
+          <default>
+            <log_queries>1</log_queries>
+            <log_query_threads>0</log_query_threads>
+          </default>
+        </profiles>
+      </clickhouse>
+
+  initContainers:
+    - name: copy-usersd-config
+      image: busybox:1.36
+      command:
+        - /bin/sh
+        - -ec
+        - cp -R /src/. /dst/
+      volumeMounts:
+        - name: usersd-configuration-configuration
+          mountPath: /src
+          readOnly: true
+        - name: clickhouse-users-d
+          mountPath: /dst
+
+  persistence:
+    storageClass: "premium-rwo"
+    size: 80Gi
+    mountPath: /var/lib/clickhouse
+
+
+  extraEnvVars:
+    - name: CLICKHOUSE_USER
+      value: "default"
+    - name: CLICKHOUSE_PASSWORD
+      valueFrom:
+        secretKeyRef:
+          name: loghouse-oauth2-secret
+          key: clickhouse-password
+  extraVolumes:
+    - name: clickhouse-users-d
+      emptyDir:
+        sizeLimit: 100Mi
+    - name: clickhouse-logs
+      emptyDir:
+        sizeLimit: 500Mi
+    - name: fluentbit-config
+      configMap:
+        name: loghouse-fluentbit-config
+  extraVolumeMounts:
+    - name: clickhouse-users-d
+      mountPath: /etc/clickhouse-server/users.d
+    - name: clickhouse-logs
+      mountPath: /var/log/clickhouse-server
+
+  sidecars:
+    - name: query-log-tailer
+      image: "asia-southeast1-docker.pkg.dev/meesho-devops-admin-0622/prd/sis/clickhouse:25.6.2-debian-12-r0"
+      command:
+        - /bin/sh
+        - -c
+        - |
+          while true; do
+            clickhouse-client --host 127.0.0.1 --port 9000 --user default --password "$CLICKHOUSE_PASSWORD" --query="SELECT event_time, user, query_id, query, client_hostname FROM system.query_log WHERE type = 'QueryFinish' AND event_time > now() - INTERVAL 10 SECOND FORMAT JSONEachRow" 2>/dev/null;
+            sleep 10;
+          done
+      env:
+        - name: CLICKHOUSE_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: loghouse-oauth2-secret
+              key: clickhouse-password
+      volumeMounts:
+        - name: clickhouse-logs
+          mountPath: /var/log/clickhouse-server
+          readOnly: true
+      resources:
+        requests:
+          cpu: 10m
+          memory: 32Mi
+        limits:
+          cpu: 50m
+          memory: 64Mi
+    - name: fluentbit
+      image: fluent/fluent-bit:3.1
+      resources:
+        requests:
+          cpu: 25m
+          memory: 50Mi
+        limits:
+          cpu: 100m
+          memory: 100Mi
+      volumeMounts:
+        - name: clickhouse-logs
+          mountPath: /var/log/clickhouse-server
+          readOnly: true
+        - name: fluentbit-config
+          mountPath: /fluent-bit/etc
+          readOnly: true
+
+  defaultInitContainers:
+    volumePermissions:
+      enabled: false
+      image:
+        registry: asia-southeast1-docker.pkg.dev
+        repository: meesho-devops-admin-0622/prd/sis/os-shell
+        tag: 12-debian-12-r47
+
+  resourcesPreset: "none"
+  # Chart maps these inversely: values.requests -> pod limits, values.limits -> pod requests
+  resources:
+    requests:
+      cpu: "6"
+      memory: 40Gi
+    limits:
+      cpu: "6"
+      memory: 40Gi
+
+  tolerations:
+    - key: "dedicated"
+      operator: "Equal"
+      value: "loghouse"
+      effect: "NoSchedule"
+
+  # Disabled when oauth2Proxy.enabled is true (oauth2-proxy handles ingress)
+  ingress:
+    enabled: false
+
+  networkPolicy:
+    enabled: true
+    allowExternal: true
+    allowExternalEgress: true
+
+  keeper:
+    enabled: false
+
+
+oauth2-proxy:
+  replicaCount: 3
+  config:
+    existingSecret: loghouse-oauth2-secret
+    requiredSecretKeys:
+      - client-id
+      - client-secret
+      - cookie-secret
+  extraArgs:
+    provider: google
+    redirect-url: "http://loghouse-central.prd.meesho.int/oauth2/callback"
+    upstream: "http://loghouse-central-prd-audit-proxy:8123"
+    email-domain: "meesho.com"
+    proxy-prefix: "/oauth2"
+    pass-host-header: "true"
+    proxy-websockets: "true"
+    real-client-ip-header: "X-Forwarded-For"
+    cookie-secure: "false"
+    cookie-expire: "0s"
+    custom-templates-dir: "/templates"
+    skip-jwt-bearer-tokens: "true"
+    oidc-issuer-url: "https://accounts.google.com"
+    extra-jwt-issuers: "https://accounts.google.com=32555940559.apps.googleusercontent.com"
+    pass-user-headers: "true"
+    set-xauthrequest: "true"
+    request-logging: "true"
+    auth-logging: "true"
+    standard-logging: "true"
+  extraVolumes:
+    - name: custom-templates
+      configMap:
+        name: '{{ .Release.Name }}-oauth2-proxy-templates'
+  extraVolumeMounts:
+    - name: custom-templates
+      mountPath: /templates
+      readOnly: true
+  service:
+    portNumber: 80
+  ingress:
+    enabled: true
+    className: contour-internal-1
+    path: /
+    pathType: Prefix
+    hosts:
+      - loghouse-central.prd.meesho.int
+    annotations: {}
+    tls: []
+  sessionStorage:
+    type: cookie
+  redis-ha:
+    enabled: false
+  resources:
+    requests:
+      cpu: 50m
+      memory: 64Mi
+    limits:
+      cpu: 200m
+      memory: 128Mi