added repo
This commit is contained in:
Your Name
@@ -0,0 +1,18 @@
|
||||
apiVersion: v2
|
||||
name: clickhouse
|
||||
description: ClickHouse (Bitnami) - OLAP database with optional Google SSO via oauth2-proxy.
|
||||
type: application
|
||||
version: 1.0.0
|
||||
appVersion: "25.6.2"
|
||||
dependencies:
|
||||
- name: clickhouse
|
||||
version: "9.3.8"
|
||||
repository: "oci://registry-1.docker.io/bitnamicharts"
|
||||
- name: oauth2-proxy
|
||||
version: "10.1.4"
|
||||
repository: https://oauth2-proxy.github.io/manifests
|
||||
condition: oauth2Proxy.enabled
|
||||
keywords:
|
||||
- clickhouse
|
||||
- olap
|
||||
- database
|
||||
@@ -0,0 +1,122 @@
|
||||
{{- if and .Values.oauth2Proxy.enabled ((.Values.auditProxy).enabled) }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-audit-proxy-config
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: audit-proxy
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
data:
|
||||
nginx.conf: |
|
||||
worker_processes 2;
|
||||
error_log /dev/stderr warn;
|
||||
events { worker_connections 1024; }
|
||||
http {
|
||||
log_format audit '$remote_addr - $http_x_forwarded_email [$time_local] '
|
||||
'"$request" $status $body_bytes_sent rt=$request_time';
|
||||
access_log /dev/stdout audit;
|
||||
server {
|
||||
listen 8080;
|
||||
client_max_body_size 64m;
|
||||
proxy_read_timeout 600s;
|
||||
proxy_send_timeout 600s;
|
||||
proxy_connect_timeout 10s;
|
||||
proxy_buffering off;
|
||||
location / {
|
||||
set $user_email $http_x_forwarded_email;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-ClickHouse-Setting-log_comment $user_email;
|
||||
proxy_set_header Authorization "";
|
||||
proxy_pass_request_headers on;
|
||||
if ($request_method = POST) {
|
||||
set $args $args&log_comment=$user_email;
|
||||
}
|
||||
proxy_pass http://{{ .Release.Name }}-clickhouse:8123;
|
||||
}
|
||||
location /healthz {
|
||||
return 200 'ok';
|
||||
add_header Content-Type text/plain;
|
||||
}
|
||||
}
|
||||
}
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-audit-proxy
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: audit-proxy
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
spec:
|
||||
replicas: {{ (.Values.auditProxy).replicas | default 2 }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: audit-proxy
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: audit-proxy
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
annotations:
|
||||
checksum/config: {{ .Values.auditProxy | toJson | sha256sum }}
|
||||
spec:
|
||||
{{- with (.Values.auditProxy).tolerations }}
|
||||
tolerations: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: nginx
|
||||
image: {{ (.Values.auditProxy).image | default "nginx:1.27-alpine" }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8080
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /etc/nginx/nginx.conf
|
||||
subPath: nginx.conf
|
||||
readOnly: true
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: http
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: http
|
||||
initialDelaySeconds: 2
|
||||
periodSeconds: 5
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 32Mi
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 128Mi
|
||||
volumes:
|
||||
- name: config
|
||||
configMap:
|
||||
name: {{ .Release.Name }}-audit-proxy-config
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-audit-proxy
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: audit-proxy
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app.kubernetes.io/name: audit-proxy
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
ports:
|
||||
- name: http
|
||||
port: 8123
|
||||
targetPort: 8080
|
||||
{{- end }}
|
||||
@@ -0,0 +1,25 @@
|
||||
{{- if .Values.externalSecret.enabled }}
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: {{ .Values.externalSecret.secretName }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "-5"
|
||||
{{- if .Values.externalSecret.annotations }}
|
||||
{{- toYaml .Values.externalSecret.annotations | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
dataFrom:
|
||||
- extract:
|
||||
conversionStrategy: Default
|
||||
key: {{ .Values.externalSecret.path | quote }}
|
||||
refreshInterval: 15s
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault-backend
|
||||
target:
|
||||
creationPolicy: Owner
|
||||
deletionPolicy: Retain
|
||||
name: {{ .Values.externalSecret.secretName }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,49 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: loghouse-fluentbit-config
|
||||
namespace: {{ .Release.Namespace }}
|
||||
data:
|
||||
fluent-bit.conf: |
|
||||
[SERVICE]
|
||||
Flush 5
|
||||
Daemon Off
|
||||
Log_Level warn
|
||||
Parsers_File parsers.conf
|
||||
|
||||
[INPUT]
|
||||
Name tail
|
||||
Path /var/log/clickhouse-server/clickhouse-server.log
|
||||
Tag clickhouse.server
|
||||
Parser clickhouse_log
|
||||
Refresh_Interval 5
|
||||
Read_from_Head True
|
||||
DB /tmp/fluentbit-ch.db
|
||||
|
||||
[INPUT]
|
||||
Name tail
|
||||
Path /var/log/clickhouse-server/clickhouse-server.err.log
|
||||
Tag clickhouse.error
|
||||
Refresh_Interval 5
|
||||
Read_from_Head True
|
||||
DB /tmp/fluentbit-ch-err.db
|
||||
|
||||
[FILTER]
|
||||
Name modify
|
||||
Match *
|
||||
Add component clickhouse-query-audit
|
||||
Add k8s_cluster k8s-central-prd-ase1
|
||||
Add k8s_namespace prd-loghouse
|
||||
|
||||
[OUTPUT]
|
||||
Name stackdriver
|
||||
Match *
|
||||
resource global
|
||||
|
||||
parsers.conf: |
|
||||
[PARSER]
|
||||
Name clickhouse_log
|
||||
Format regex
|
||||
Regex ^(?<time>\d{4}\.\d{2}\.\d{2} \d{2}:\d{2}:\d{2}\.\d+) \[ (?<thread>\d+) \] \{(?<query_id>[^}]*)\} <(?<level>[^>]+)> (?<message>.*)$
|
||||
Time_Key time
|
||||
Time_Format %Y.%m.%d %H:%M:%S.%L
|
||||
@@ -0,0 +1,228 @@
|
||||
{{- if .Values.oauth2Proxy.enabled }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-oauth2-proxy-templates
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: oauth2-proxy
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
data:
|
||||
sign_in.html: |
|
||||
{{`{{define "sign_in.html"}}`}}
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>LogHouse — Sign In</title>
|
||||
<style>
|
||||
*, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
|
||||
|
||||
body {
|
||||
min-height: 100vh;
|
||||
display: flex;
|
||||
align-items: center;
|
||||
justify-content: center;
|
||||
font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
|
||||
background: linear-gradient(135deg, #0f172a 0%, #1e293b 50%, #0f172a 100%);
|
||||
color: #e2e8f0;
|
||||
}
|
||||
|
||||
.container {
|
||||
width: 100%;
|
||||
max-width: 420px;
|
||||
padding: 2rem;
|
||||
}
|
||||
|
||||
.card {
|
||||
background: rgba(30, 41, 59, 0.8);
|
||||
backdrop-filter: blur(20px);
|
||||
border: 1px solid rgba(148, 163, 184, 0.1);
|
||||
border-radius: 16px;
|
||||
padding: 2.5rem 2rem;
|
||||
box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.5);
|
||||
}
|
||||
|
||||
.logo-section {
|
||||
text-align: center;
|
||||
margin-bottom: 2rem;
|
||||
}
|
||||
|
||||
.logo-icon {
|
||||
width: 56px;
|
||||
height: 56px;
|
||||
background: linear-gradient(135deg, #f59e0b, #f97316);
|
||||
border-radius: 14px;
|
||||
display: inline-flex;
|
||||
align-items: center;
|
||||
justify-content: center;
|
||||
margin-bottom: 1rem;
|
||||
box-shadow: 0 8px 24px rgba(245, 158, 11, 0.25);
|
||||
}
|
||||
|
||||
.logo-icon svg {
|
||||
width: 28px;
|
||||
height: 28px;
|
||||
fill: #fff;
|
||||
}
|
||||
|
||||
.logo-section h1 {
|
||||
font-size: 1.5rem;
|
||||
font-weight: 700;
|
||||
color: #f8fafc;
|
||||
letter-spacing: -0.025em;
|
||||
}
|
||||
|
||||
.logo-section p {
|
||||
font-size: 0.875rem;
|
||||
color: #94a3b8;
|
||||
margin-top: 0.375rem;
|
||||
}
|
||||
|
||||
.divider {
|
||||
height: 1px;
|
||||
background: linear-gradient(90deg, transparent, rgba(148, 163, 184, 0.2), transparent);
|
||||
margin: 1.5rem 0;
|
||||
}
|
||||
|
||||
.sso-btn {
|
||||
display: flex;
|
||||
align-items: center;
|
||||
justify-content: center;
|
||||
gap: 0.75rem;
|
||||
width: 100%;
|
||||
padding: 0.875rem 1.5rem;
|
||||
background: #fff;
|
||||
color: #1e293b;
|
||||
font-size: 0.9375rem;
|
||||
font-weight: 600;
|
||||
border: none;
|
||||
border-radius: 10px;
|
||||
cursor: pointer;
|
||||
transition: all 0.2s ease;
|
||||
text-decoration: none;
|
||||
box-shadow: 0 1px 3px rgba(0,0,0,0.12);
|
||||
}
|
||||
|
||||
.sso-btn:hover {
|
||||
background: #f1f5f9;
|
||||
box-shadow: 0 4px 12px rgba(0,0,0,0.15);
|
||||
transform: translateY(-1px);
|
||||
}
|
||||
|
||||
.sso-btn:active {
|
||||
transform: translateY(0);
|
||||
}
|
||||
|
||||
.sso-btn svg {
|
||||
width: 20px;
|
||||
height: 20px;
|
||||
flex-shrink: 0;
|
||||
}
|
||||
|
||||
.info-bar {
|
||||
display: flex;
|
||||
align-items: center;
|
||||
gap: 0.5rem;
|
||||
margin-top: 1.25rem;
|
||||
padding: 0.625rem 0.875rem;
|
||||
background: rgba(59, 130, 246, 0.08);
|
||||
border: 1px solid rgba(59, 130, 246, 0.15);
|
||||
border-radius: 8px;
|
||||
font-size: 0.8125rem;
|
||||
color: #93c5fd;
|
||||
}
|
||||
|
||||
.info-bar svg {
|
||||
width: 16px;
|
||||
height: 16px;
|
||||
flex-shrink: 0;
|
||||
fill: #60a5fa;
|
||||
}
|
||||
|
||||
.alert-bar {
|
||||
display: flex;
|
||||
align-items: center;
|
||||
gap: 0.5rem;
|
||||
margin-bottom: 1.25rem;
|
||||
padding: 0.625rem 0.875rem;
|
||||
background: rgba(239, 68, 68, 0.1);
|
||||
border: 1px solid rgba(239, 68, 68, 0.2);
|
||||
border-radius: 8px;
|
||||
font-size: 0.8125rem;
|
||||
color: #fca5a5;
|
||||
}
|
||||
|
||||
.footer {
|
||||
text-align: center;
|
||||
margin-top: 1.5rem;
|
||||
font-size: 0.75rem;
|
||||
color: #475569;
|
||||
}
|
||||
|
||||
.footer a { color: #64748b; text-decoration: none; }
|
||||
.footer a:hover { color: #94a3b8; }
|
||||
|
||||
@media (max-width: 480px) {
|
||||
.container { padding: 1rem; }
|
||||
.card { padding: 2rem 1.5rem; }
|
||||
}
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<div class="container">
|
||||
<div class="card">
|
||||
<div class="logo-section">
|
||||
<div class="logo-icon">
|
||||
<svg viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
|
||||
<path d="M12 2L2 7l10 5 10-5-10-5zM2 17l10 5 10-5M2 12l10 5 10-5"/>
|
||||
</svg>
|
||||
</div>
|
||||
<h1>LogHouse</h1>
|
||||
<p>ClickHouse Analytics Platform</p>
|
||||
</div>
|
||||
|
||||
<div class="divider"></div>
|
||||
|
||||
{{`{{ if eq .StatusCode 400 401 }}`}}
|
||||
<div class="alert-bar">
|
||||
<svg viewBox="0 0 24 24" fill="currentColor"><path d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm-2 15l-5-5 1.41-1.41L10 14.17l7.59-7.59L19 8l-9 9z"/></svg>
|
||||
<span>Authentication failed. Please try again.</span>
|
||||
</div>
|
||||
{{`{{ end }}`}}
|
||||
|
||||
<form method="GET" action="{{`{{.ProxyPrefix}}`}}/start">
|
||||
<input type="hidden" name="rd" value="{{`{{.Redirect}}`}}"/>
|
||||
<button type="submit" class="sso-btn">
|
||||
<svg viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
|
||||
<path d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92a5.06 5.06 0 0 1-2.2 3.32v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.1z" fill="#4285F4"/>
|
||||
<path d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z" fill="#34A853"/>
|
||||
<path d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z" fill="#FBBC05"/>
|
||||
<path d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z" fill="#EA4335"/>
|
||||
</svg>
|
||||
Sign in with Google
|
||||
</button>
|
||||
</form>
|
||||
|
||||
</div>
|
||||
|
||||
<div class="footer">
|
||||
Secured by OAuth2 Proxy
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<script>
|
||||
if (window.location.hash) {
|
||||
var inputs = document.getElementsByName('rd');
|
||||
for (var i = 0; i < inputs.length; i++) {
|
||||
var idx = inputs[i].value.indexOf('#');
|
||||
if (idx >= 0) inputs[i].value = inputs[i].value.substr(0, idx);
|
||||
inputs[i].value += window.location.hash;
|
||||
}
|
||||
}
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
{{`{{end}}`}}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,174 @@
|
||||
---
|
||||
# Default values for third-party/clickhouse (Bitnami ClickHouse subchart).
|
||||
# Override per deployment with -f values_v3/cntr/<app>/values.yaml
|
||||
# All ClickHouse keys are under "clickhouse:" for the subchart.
|
||||
|
||||
# --- Google SSO (oauth2-proxy) ---
|
||||
oauth2Proxy:
|
||||
enabled: false
|
||||
|
||||
# --- External Secret (Vault → K8s Secret) ---
|
||||
externalSecret:
|
||||
enabled: false
|
||||
path: ""
|
||||
secretName: ""
|
||||
annotations: {}
|
||||
|
||||
# --- Bitnami ClickHouse subchart ---
|
||||
clickhouse:
|
||||
fullnameOverride: ""
|
||||
|
||||
global:
|
||||
imageRegistry: ""
|
||||
imagePullSecrets: []
|
||||
storageClass: ""
|
||||
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: bitnami/clickhouse
|
||||
tag: ""
|
||||
digest: ""
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
clusterName: default
|
||||
shards: 1
|
||||
replicaCount: 3
|
||||
|
||||
keeper:
|
||||
enabled: false
|
||||
replicaCount: 3
|
||||
persistence:
|
||||
enabled: true
|
||||
size: 8Gi
|
||||
storageClass: ""
|
||||
|
||||
auth:
|
||||
username: default
|
||||
password: ""
|
||||
existingSecret: ""
|
||||
existingSecretKey: ""
|
||||
|
||||
persistence:
|
||||
enabled: true
|
||||
size: 8Gi
|
||||
storageClass: ""
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
mountPath: /bitnami/clickhouse
|
||||
|
||||
ingress:
|
||||
enabled: false
|
||||
hostname: ""
|
||||
path: /
|
||||
pathType: ImplementationSpecific
|
||||
ingressClassName: ""
|
||||
tls: false
|
||||
certManager: false
|
||||
annotations: {}
|
||||
extraHosts: []
|
||||
extraTls: []
|
||||
extraRules: []
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
http: 8123
|
||||
native: 9000
|
||||
interserver: 9009
|
||||
nodePorts: {}
|
||||
annotations: {}
|
||||
|
||||
networkPolicy:
|
||||
enabled: false
|
||||
allowExternal: true
|
||||
ingress: {}
|
||||
egress: {}
|
||||
|
||||
podSecurityContext:
|
||||
enabled: true
|
||||
fsGroup: 1001
|
||||
|
||||
containerSecurityContext:
|
||||
enabled: true
|
||||
runAsUser: 1001
|
||||
runAsNonRoot: true
|
||||
|
||||
resources:
|
||||
requests: {}
|
||||
limits: {}
|
||||
|
||||
tolerations: []
|
||||
|
||||
affinity: {}
|
||||
podAntiAffinityPreset: ""
|
||||
podAffinityPreset: ""
|
||||
nodeAffinityPreset:
|
||||
type: ""
|
||||
key: ""
|
||||
values: []
|
||||
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate: {}
|
||||
|
||||
podManagementPolicy: OrderedReady
|
||||
|
||||
defaultInitContainers:
|
||||
volumePermissions:
|
||||
enabled: true
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: bitnami/os-shell
|
||||
tag: ""
|
||||
digest: ""
|
||||
pullPolicy: IfNotPresent
|
||||
copyOsShell:
|
||||
enabled: false
|
||||
image: {}
|
||||
|
||||
extraEnvVars: []
|
||||
extraEnvVarsCM: ""
|
||||
extraEnvVarsSecret: ""
|
||||
extraVolumes: []
|
||||
extraVolumeMounts: []
|
||||
extraContainers: []
|
||||
extraInitContainers: []
|
||||
sidecars: []
|
||||
|
||||
metrics:
|
||||
enabled: false
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
prometheusRule:
|
||||
enabled: false
|
||||
|
||||
commonConfiguration: ""
|
||||
customConfiguration: ""
|
||||
customUsersConfiguration: ""
|
||||
customProfilesConfiguration: ""
|
||||
customZookeeperConfiguration: ""
|
||||
customClickhouseConfiguration: ""
|
||||
|
||||
# --- oauth2-proxy subchart defaults (overridden per deployment) ---
|
||||
oauth2-proxy:
|
||||
replicaCount: 3
|
||||
config:
|
||||
existingSecret: ""
|
||||
extraArgs: {}
|
||||
extraVolumes:
|
||||
- name: custom-templates
|
||||
configMap:
|
||||
name: '{{ .Release.Name }}-oauth2-proxy-templates'
|
||||
extraVolumeMounts:
|
||||
- name: custom-templates
|
||||
mountPath: /templates
|
||||
readOnly: true
|
||||
service:
|
||||
portNumber: 80
|
||||
ingress:
|
||||
enabled: false
|
||||
sessionStorage:
|
||||
type: cookie
|
||||
redis-ha:
|
||||
enabled: false
|
||||
resources: {}
|
||||
Reference in New Issue
Block a user