Add platform infrastructure configuration

2026-08-28 17:35:41 +09:00
parent fa76531e5b
commit 16c337bcc9
302 changed files with 83259 additions and 1 deletions
@@ -0,0 +1,32 @@
+# Observability Local PersistentVolumes
+
+This kustomization reserves six workload-specific Local PV binding contracts on
+the root SSD. Each owner has a dedicated `kubernetes.io/no-provisioner`
+StorageClass with `WaitForFirstConsumer`, `Retain`, and volume expansion
+disabled. Every PV is `ReadWriteOnce`, retains its data after claim deletion,
+and is affined to `donghyeon-system-product-name`.
+
+| Owner | Host path | Capacity | StorageClass | Directory owner |
+| --- | --- | ---: | --- | --- |
+| Prometheus | `/srv/k3s/ssd/observability/prometheus` | `20Gi` | `ssd-local-observability-prometheus-retain` | `1000:2000` |
+| Grafana | `/srv/k3s/ssd/observability/grafana` | `2Gi` | `ssd-local-observability-grafana-retain` | `472:472` |
+| Alertmanager | `/srv/k3s/ssd/observability/alertmanager` | `1Gi` | `ssd-local-observability-alertmanager-retain` | `1000:2000` |
+| Alloy | `/srv/k3s/ssd/observability/alloy` | `2Gi` | `ssd-local-observability-alloy-retain` | `473:473` |
+| Loki | `/srv/k3s/ssd/observability/loki` | `5Gi` | `ssd-local-observability-loki-retain` | `10001:10001` |
+| Tempo | `/srv/k3s/ssd/observability/tempo` | `5Gi` | `ssd-local-observability-tempo-retain` | `10001:10001` |
+
+The declared 35 GiB is a Kubernetes binding contract, not an ext4 directory
+quota. Project quota is not active. All six directories share root-filesystem
+free space, so the later operational protections remain mandatory:
+
+- Prometheus `retentionSize=16GB` is not a whole-filesystem cap and does not cap
+  WAL plus head data.
+- Loki's 512 MB setting limits WAL replay RAM; it is not a disk quota.
+- Loki `disk_full_threshold=0.90` uses `Statfs` on the WAL filesystem.
+- Tempo 2.10.7 has no WAL byte limit or disk-full guard.
+- Root-filesystem 75%, 85%, and 90% alerts, apply/smoke `du` and `df` caps, and
+  acceptance of the root-90%-full ingest-stop runbook are still required.
+
+Run `bash scripts/bootstrap/prepare-observability-local-paths.sh` to inspect the
+read-only plan. The separately confirmed `--execute` mode prepares the exact
+paths at mode `0770`; it does not apply Kubernetes resources.
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - storage-classes.yaml
+  - persistent-volumes.yaml
@@ -0,0 +1,155 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: observability-prometheus-local-pv
+  labels:
+    app.kubernetes.io/part-of: observability
+    app.kubernetes.io/component: prometheus
+spec:
+  capacity:
+    storage: 20Gi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ssd-local-observability-prometheus-retain
+  local:
+    path: /srv/k3s/ssd/observability/prometheus
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - donghyeon-system-product-name
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: observability-grafana-local-pv
+  labels:
+    app.kubernetes.io/part-of: observability
+    app.kubernetes.io/component: grafana
+spec:
+  capacity:
+    storage: 2Gi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ssd-local-observability-grafana-retain
+  local:
+    path: /srv/k3s/ssd/observability/grafana
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - donghyeon-system-product-name
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: observability-alertmanager-local-pv
+  labels:
+    app.kubernetes.io/part-of: observability
+    app.kubernetes.io/component: alertmanager
+spec:
+  capacity:
+    storage: 1Gi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ssd-local-observability-alertmanager-retain
+  local:
+    path: /srv/k3s/ssd/observability/alertmanager
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - donghyeon-system-product-name
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: observability-alloy-local-pv
+  labels:
+    app.kubernetes.io/part-of: observability
+    app.kubernetes.io/component: alloy
+spec:
+  capacity:
+    storage: 2Gi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ssd-local-observability-alloy-retain
+  local:
+    path: /srv/k3s/ssd/observability/alloy
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - donghyeon-system-product-name
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: observability-loki-local-pv
+  labels:
+    app.kubernetes.io/part-of: observability
+    app.kubernetes.io/component: loki
+spec:
+  capacity:
+    storage: 5Gi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ssd-local-observability-loki-retain
+  local:
+    path: /srv/k3s/ssd/observability/loki
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - donghyeon-system-product-name
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: observability-tempo-local-pv
+  labels:
+    app.kubernetes.io/part-of: observability
+    app.kubernetes.io/component: tempo
+spec:
+  capacity:
+    storage: 5Gi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ssd-local-observability-tempo-retain
+  local:
+    path: /srv/k3s/ssd/observability/tempo
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - donghyeon-system-product-name
@@ -0,0 +1,53 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: ssd-local-observability-prometheus-retain
+provisioner: kubernetes.io/no-provisioner
+reclaimPolicy: Retain
+volumeBindingMode: WaitForFirstConsumer
+allowVolumeExpansion: false
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: ssd-local-observability-grafana-retain
+provisioner: kubernetes.io/no-provisioner
+reclaimPolicy: Retain
+volumeBindingMode: WaitForFirstConsumer
+allowVolumeExpansion: false
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: ssd-local-observability-alertmanager-retain
+provisioner: kubernetes.io/no-provisioner
+reclaimPolicy: Retain
+volumeBindingMode: WaitForFirstConsumer
+allowVolumeExpansion: false
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: ssd-local-observability-alloy-retain
+provisioner: kubernetes.io/no-provisioner
+reclaimPolicy: Retain
+volumeBindingMode: WaitForFirstConsumer
+allowVolumeExpansion: false
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: ssd-local-observability-loki-retain
+provisioner: kubernetes.io/no-provisioner
+reclaimPolicy: Retain
+volumeBindingMode: WaitForFirstConsumer
+allowVolumeExpansion: false
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: ssd-local-observability-tempo-retain
+provisioner: kubernetes.io/no-provisioner
+reclaimPolicy: Retain
+volumeBindingMode: WaitForFirstConsumer
+allowVolumeExpansion: false