252 lines
6.4 KiB
YAML
252 lines
6.4 KiB
YAML
# logHouse (central-prd) - overrides only.
|
|
# Google SSO via oauth2-proxy; ClickHouse ingress disabled.
|
|
oauth2Proxy:
|
|
enabled: true
|
|
|
|
# nginx audit proxy maps X-Forwarded-Email → X-ClickHouse-Setting-log_comment
|
|
# so system.query_log.log_comment shows the SSO email of who ran each query.
|
|
auditProxy:
|
|
enabled: true
|
|
replicas: 2
|
|
image: "nginx:1.27-alpine"
|
|
tolerations:
|
|
- key: "cloud.google.com/compute-class"
|
|
operator: "Equal"
|
|
value: "loghouse"
|
|
effect: "NoSchedule"
|
|
|
|
externalSecret:
|
|
enabled: true
|
|
path: meesho/prd/cntr/devop/loghouse
|
|
secretName: loghouse-oauth2-secret
|
|
annotations: {}
|
|
|
|
# --- Bitnami ClickHouse subchart ---
|
|
clickhouse:
|
|
replicaCount: 3
|
|
global:
|
|
security:
|
|
allowInsecureImages: true
|
|
|
|
image:
|
|
registry: asia-southeast1-docker.pkg.dev
|
|
repository: meesho-devops-admin-0622/prd/sis/clickhouse
|
|
tag: 25.6.2-debian-12-r0
|
|
|
|
auth:
|
|
username: default
|
|
password: ""
|
|
existingSecret: "loghouse-oauth2-secret"
|
|
existingSecretKey: "clickhouse-password"
|
|
|
|
|
|
# Enable sampling so Bitnami's 08-sampling.xml preserves query_log,
|
|
# text_log, metric_log etc. All queries are recorded in system.query_log.
|
|
sampling:
|
|
enabled: true
|
|
|
|
usersdFiles:
|
|
grant_all.xml: |
|
|
<yandex>
|
|
<users>
|
|
<default>
|
|
<access_management>1</access_management>
|
|
<named_collection_control>1</named_collection_control>
|
|
</default>
|
|
</users>
|
|
</yandex>
|
|
log_queries.xml: |
|
|
<clickhouse>
|
|
<profiles>
|
|
<default>
|
|
<log_queries>1</log_queries>
|
|
<log_query_threads>0</log_query_threads>
|
|
</default>
|
|
</profiles>
|
|
</clickhouse>
|
|
|
|
initContainers:
|
|
- name: copy-usersd-config
|
|
image: busybox:1.36
|
|
command:
|
|
- /bin/sh
|
|
- -ec
|
|
- cp -R /src/. /dst/
|
|
volumeMounts:
|
|
- name: usersd-configuration-configuration
|
|
mountPath: /src
|
|
readOnly: true
|
|
- name: clickhouse-users-d
|
|
mountPath: /dst
|
|
|
|
persistence:
|
|
storageClass: "hyperdisk-balanced"
|
|
size: 100Gi
|
|
mountPath: /var/lib/clickhouse
|
|
|
|
|
|
extraEnvVars:
|
|
- name: CLICKHOUSE_USER
|
|
value: "default"
|
|
- name: CLICKHOUSE_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: loghouse-oauth2-secret
|
|
key: clickhouse-password
|
|
extraVolumes:
|
|
- name: clickhouse-users-d
|
|
emptyDir:
|
|
sizeLimit: 100Mi
|
|
- name: clickhouse-logs
|
|
emptyDir:
|
|
sizeLimit: 500Mi
|
|
- name: fluentbit-config
|
|
configMap:
|
|
name: loghouse-fluentbit-config
|
|
extraVolumeMounts:
|
|
- name: clickhouse-users-d
|
|
mountPath: /etc/clickhouse-server/users.d
|
|
- name: clickhouse-logs
|
|
mountPath: /var/log/clickhouse-server
|
|
|
|
sidecars:
|
|
- name: query-log-tailer
|
|
image: "asia-southeast1-docker.pkg.dev/meesho-devops-admin-0622/prd/sis/clickhouse:25.6.2-debian-12-r0"
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
while true; do
|
|
clickhouse-client --host 127.0.0.1 --port 9000 --user default --password "$CLICKHOUSE_PASSWORD" --query="SELECT event_time, user, query_id, query, client_hostname FROM system.query_log WHERE type = 'QueryFinish' AND event_time > now() - INTERVAL 10 SECOND FORMAT JSONEachRow" 2>/dev/null;
|
|
sleep 10;
|
|
done
|
|
env:
|
|
- name: CLICKHOUSE_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: loghouse-oauth2-secret
|
|
key: clickhouse-password
|
|
volumeMounts:
|
|
- name: clickhouse-logs
|
|
mountPath: /var/log/clickhouse-server
|
|
readOnly: true
|
|
resources:
|
|
requests:
|
|
cpu: 10m
|
|
memory: 32Mi
|
|
limits:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
- name: fluentbit
|
|
image: fluent/fluent-bit:3.1
|
|
resources:
|
|
requests:
|
|
cpu: 25m
|
|
memory: 50Mi
|
|
limits:
|
|
cpu: 100m
|
|
memory: 100Mi
|
|
volumeMounts:
|
|
- name: clickhouse-logs
|
|
mountPath: /var/log/clickhouse-server
|
|
readOnly: true
|
|
- name: fluentbit-config
|
|
mountPath: /fluent-bit/etc
|
|
readOnly: true
|
|
|
|
defaultInitContainers:
|
|
volumePermissions:
|
|
enabled: false
|
|
image:
|
|
registry: asia-southeast1-docker.pkg.dev
|
|
repository: meesho-devops-admin-0622/prd/sis/os-shell
|
|
tag: 12-debian-12-r47
|
|
|
|
resourcesPreset: "none"
|
|
# Chart maps these inversely: values.requests -> pod limits, values.limits -> pod requests
|
|
resources:
|
|
requests:
|
|
cpu: "6"
|
|
memory: 40Gi
|
|
limits:
|
|
cpu: "6"
|
|
memory: 40Gi
|
|
|
|
tolerations:
|
|
- key: "cloud.google.com/compute-class"
|
|
operator: "Equal"
|
|
value: "loghouse"
|
|
effect: "NoSchedule"
|
|
|
|
# Disabled when oauth2Proxy.enabled is true (oauth2-proxy handles ingress)
|
|
ingress:
|
|
enabled: false
|
|
|
|
networkPolicy:
|
|
enabled: true
|
|
allowExternal: true
|
|
allowExternalEgress: true
|
|
|
|
keeper:
|
|
enabled: false
|
|
|
|
|
|
oauth2-proxy:
|
|
replicaCount: 3
|
|
config:
|
|
existingSecret: loghouse-oauth2-secret
|
|
requiredSecretKeys:
|
|
- client-id
|
|
- client-secret
|
|
- cookie-secret
|
|
extraArgs:
|
|
provider: google
|
|
redirect-url: "http://loghouse-central.prd.meesho.int/oauth2/callback"
|
|
upstream: "http://loghouse-central-a-prd-audit-proxy:8123"
|
|
email-domain: "meesho.com"
|
|
proxy-prefix: "/oauth2"
|
|
pass-host-header: "true"
|
|
proxy-websockets: "true"
|
|
real-client-ip-header: "X-Forwarded-For"
|
|
cookie-secure: "false"
|
|
cookie-expire: "0s"
|
|
custom-templates-dir: "/templates"
|
|
skip-jwt-bearer-tokens: "true"
|
|
oidc-issuer-url: "https://accounts.google.com"
|
|
extra-jwt-issuers: "https://accounts.google.com=32555940559.apps.googleusercontent.com"
|
|
pass-user-headers: "true"
|
|
set-xauthrequest: "true"
|
|
request-logging: "true"
|
|
auth-logging: "true"
|
|
standard-logging: "true"
|
|
extraVolumes:
|
|
- name: custom-templates
|
|
configMap:
|
|
name: '{{ .Release.Name }}-oauth2-proxy-templates'
|
|
extraVolumeMounts:
|
|
- name: custom-templates
|
|
mountPath: /templates
|
|
readOnly: true
|
|
service:
|
|
portNumber: 80
|
|
ingress:
|
|
enabled: true
|
|
className: contour-internal-1
|
|
path: /
|
|
pathType: Prefix
|
|
hosts:
|
|
- loghouse-central.prd.meesho.int
|
|
annotations: {}
|
|
tls: []
|
|
sessionStorage:
|
|
type: cookie
|
|
redis-ha:
|
|
enabled: false
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 128Mi
|