jakman85andClaude Opus 4.8
a108d5ab98
Operator directive: don't diverge architecture to avoid asking for credentials; provision them upfront via SOPS and keep the existing (unified) graph. Roadmap reconciliation: Phase 2 = Network/Storage/TLS/DNS/Ingress, so cert-manager/externaldns/gateway (the credential-gated pieces) ARE Phase 2; monitoring is Phase 4. Earlier A2/rollout scope was inverted by credential-avoidance. Reverts (credential-driven): remove clusters/dev/rollout/ + the $patch:delete's; restore unified base graph (dev = ../base + cluster-vars + SOPS decryption, R-ENV-02 intact); restore monitoring files (Phase 4). Kept non-credential improvements: tofu for_each/rejoin, Kyverno parametrization + webhook excludes. platform/kustomization.yaml now phased (single shared list): Phase-2 set = kyverno, cilium, longhorn, cert-manager, externaldns, gateway; later components commented with phase markers. SOPS activated: .sops.yaml at repo root; bootstrap/sops/secret-templates/*.yaml.example for all secrets (cloudflare x2, grafana, alertmanager-smtp, keycloak, oauth2-proxy, pia); bootstrap/sops/CREDENTIALS.md checklist; pre-wired commented cloudflare-api-token lines in cert-manager + externaldns; filled non-secret ACME email. Agents never touch real secret values (operator encrypts). Validated: kubectl kustomize dev(unified)/prod/platform(Phase-2 only), templates inert, make -C ci gate PASS. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
93 lines
3.1 KiB
YAML
93 lines
3.1 KiB
YAML
---
|
|
# Loki — log aggregation (docs/10). Serves R-OBS-01. PVC size is an overlay knob (R-ENV-02).
|
|
#
|
|
# DEV-SCOPED for the ~22 GiB ceiling. Deployment mode is SingleBinary (one pod, filesystem
|
|
# storage) — the scalable read/write/backend split is prod-only. CRITICAL RAM TRIM: the grafana
|
|
# loki chart's default memcached caches (chunksCache/resultsCache) request ~8-9 GiB EACH; both are
|
|
# disabled here. The nginx `gateway`, self-monitoring, and the canary/test hooks are disabled too.
|
|
#
|
|
# Retention is enforced by the COMPACTOR (retention_enabled: true) — a retention_period alone does
|
|
# nothing (docs/10, and a known-gotcha carried from the legacy stack).
|
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: loki
|
|
namespace: monitoring
|
|
spec:
|
|
interval: 30m
|
|
chart:
|
|
spec:
|
|
chart: loki
|
|
version: ">=6.0.0 <7.0.0" # TODO(WS-OBS): pin at bring-up; Renovate maintains
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: grafana
|
|
namespace: monitoring
|
|
install:
|
|
remediation:
|
|
retries: 3
|
|
upgrade:
|
|
remediation:
|
|
retries: 3
|
|
values:
|
|
deploymentMode: SingleBinary
|
|
|
|
loki:
|
|
auth_enabled: false
|
|
commonConfig:
|
|
replication_factor: 1 # single binary — no ring replication
|
|
storage:
|
|
type: filesystem
|
|
schemaConfig:
|
|
configs:
|
|
- from: "2024-04-01"
|
|
store: tsdb
|
|
object_store: filesystem
|
|
schema: v13
|
|
index:
|
|
prefix: loki_index_
|
|
period: 24h
|
|
limits_config:
|
|
# NOTE: Loki's LOG retention has no dedicated cluster-vars knob (only the 3 monitoring vars
|
|
# exist). Held to a dev-friendly 72h to mirror the dev metrics retention; promote to an
|
|
# overlay knob if per-env log retention is ever needed. See README / report.
|
|
retention_period: 72h
|
|
compactor:
|
|
retention_enabled: true # REQUIRED — a period alone does not delete (docs/10)
|
|
delete_request_store: filesystem
|
|
|
|
singleBinary:
|
|
replicas: 1
|
|
persistence:
|
|
enabled: true
|
|
storageClass: longhorn # replicated tier (ADR-0003)
|
|
size: ${MONITORING_LOKI_PVC_SIZE} # overlay knob (dev 5Gi / prod large)
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 192Mi
|
|
limits:
|
|
memory: 512Mi
|
|
|
|
# Not used in SingleBinary mode — pinned to 0 so a chart default can't spin up extra pods.
|
|
backend:
|
|
replicas: 0
|
|
read:
|
|
replicas: 0
|
|
write:
|
|
replicas: 0
|
|
|
|
# --- RAM trims: kill the memory-hungry / non-essential-for-dev pieces ---
|
|
chunksCache:
|
|
enabled: false # default memcached requests ~8-9Gi — must stay off in dev
|
|
resultsCache:
|
|
enabled: false
|
|
gateway:
|
|
enabled: false # no nginx front door needed for a single binary in-cluster
|
|
lokiCanary:
|
|
enabled: false
|
|
test:
|
|
enabled: false
|
|
# Alloy ships logs here (in-cluster service DNS, no gateway):
|
|
# http://loki.monitoring.svc.cluster.local:3100/loki/api/v1/push
|