Add platform infrastructure configuration

2026-08-28 17:35:41 +09:00
parent fa76531e5b
commit 16c337bcc9
302 changed files with 83259 additions and 1 deletions
@@ -0,0 +1,16 @@
+# Loki
+
+This root renders `grafana-community/loki` chart `18.7.1` as one Loki
+`3.7.4` monolithic StatefulSet in `observability`.
+
+- The image is pinned to the reviewed amd64 digest.
+- Logs use the `loki` AIStor bucket through `loki-object-storage`; no root
+  credential is referenced.
+- Retention is 30 days. The WAL and working data use the dedicated 5Gi
+  Retain Local PV.
+- Gateway, canary, caches, embedded MinIO, tests, and rule sidecars are
+  disabled.
+- The only client-facing service is ClusterIP port 3100.
+
+Do not delete the PVC or bucket during rollback. Scale the StatefulSet down,
+preserve its Retain volume, and investigate S3/WAL state before reapplying.
@@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: observability
+
+helmGlobals:
+  chartHome: .helm/charts
+
+helmCharts:
+  - name: loki
+    repo: https://grafana-community.github.io/helm-charts
+    version: 18.7.1
+    releaseName: loki
+    namespace: observability
+    valuesFile: values/home.yaml
+    includeCRDs: false
+    skipTests: true
@@ -0,0 +1,146 @@
+deploymentMode: Monolithic
+
+commonLabels:
+  observability.hyeonworks.com/instance: home
+
+defaults:
+  automountServiceAccountToken: false
+
+serviceAccount:
+  automountServiceAccountToken: false
+
+loki:
+  auth_enabled: false
+  image:
+    registry: docker.io
+    repository: grafana/loki
+    tag: "3.7.4"
+    digest: sha256:d80be589cf74b6d92747a1b155bec6f07bdd65e261f797fe93a78fb4e833032e
+  podSecurityContext:
+    runAsNonRoot: true
+    runAsUser: 10001
+    runAsGroup: 10001
+    fsGroup: 10001
+    fsGroupChangePolicy: OnRootMismatch
+    seccompProfile:
+      type: RuntimeDefault
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: true
+    capabilities:
+      drop:
+        - ALL
+    seccompProfile:
+      type: RuntimeDefault
+  commonConfig:
+    path_prefix: /var/loki
+    replication_factor: 1
+  schemaConfig:
+    configs:
+      - from: "2026-07-01"
+        store: tsdb
+        object_store: s3
+        schema: v13
+        index:
+          prefix: index_
+          period: 24h
+  storage:
+    type: s3
+    bucketNames:
+      chunks: loki
+      ruler: loki
+      admin: loki
+    s3:
+      endpoint: http://minio.object-storage.svc.cluster.local
+      s3ForcePathStyle: true
+      insecure: true
+      accessKeyId: ${AWS_ACCESS_KEY_ID}
+      secretAccessKey: ${AWS_SECRET_ACCESS_KEY}
+  useTestSchema: false
+  limits_config:
+    retention_period: 720h
+    ingestion_rate_mb: 4
+    ingestion_burst_size_mb: 6
+    max_line_size: 256KB
+    discover_log_levels: false
+    discover_service_name: []
+  ingester:
+    chunk_idle_period: 30m
+    max_chunk_age: 1h
+    wal:
+      checkpoint_duration: 5m
+      replay_memory_ceiling: 512MB
+      disk_full_threshold: 0.90
+      flush_on_shutdown: true
+  compactor:
+    retention_enabled: true
+    delete_request_store: s3
+    retention_delete_delay: 2h
+    retention_delete_worker_count: 10
+    max_compaction_parallelism: 1
+
+singleBinary:
+  replicas: 1
+  sidecar: false
+  podLabels:
+    platform.hyeonworks.com/aistor-client: "true"
+  service:
+    type: ClusterIP
+  resources:
+    requests:
+      cpu: 350m
+      memory: 768Mi
+    limits:
+      cpu: 1500m
+      memory: 1536Mi
+  extraEnv:
+    - name: AWS_ACCESS_KEY_ID
+      valueFrom:
+        secretKeyRef:
+          name: loki-object-storage
+          key: access-key-id
+    - name: AWS_SECRET_ACCESS_KEY
+      valueFrom:
+        secretKeyRef:
+          name: loki-object-storage
+          key: secret-access-key
+  persistence:
+    enabled: true
+    size: 5Gi
+    storageClass: ssd-local-observability-loki-retain
+    enableStatefulSetAutoDeletePVC: true
+    whenScaled: Retain
+    whenDeleted: Retain
+
+read:
+  replicas: 0
+write:
+  replicas: 0
+backend:
+  replicas: 0
+
+ruler:
+  sidecar: false
+
+gateway:
+  enabled: false
+lokiCanary:
+  enabled: false
+chunksCache:
+  enabled: false
+resultsCache:
+  enabled: false
+memcached:
+  enabled: false
+minio:
+  enabled: false
+test:
+  enabled: false
+sidecar:
+  rules:
+    enabled: false
+
+monitoring:
+  serviceMonitor:
+    enabled: true
+    interval: 30s