Add platform infrastructure configuration

2026-08-28 17:35:41 +09:00
parent fa76531e5b
commit 16c337bcc9
302 changed files with 83259 additions and 1 deletions
@@ -0,0 +1,15 @@
+# Tempo
+
+This root renders `grafana-community/tempo` chart `2.2.3` as one Tempo
+`2.10.7` StatefulSet in `observability`.
+
+- The image is rewritten to the reviewed amd64 digest.
+- Traces use the `tempo` AIStor bucket through `tempo-object-storage`; no root
+  credential is referenced.
+- Retention is seven days. WAL and local working data use the dedicated 5Gi
+  Retain Local PV.
+- Only the query/metrics port 3200 and OTLP/gRPC port 4317 are exposed.
+- OTLP/HTTP, Jaeger, Zipkin, metrics-generator, and tempo-query are disabled.
+
+Do not delete the PVC or bucket during rollback. Stop the StatefulSet and
+preserve its Retain volume while S3/WAL state is investigated.
@@ -0,0 +1,56 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: observability
+
+helmGlobals:
+  chartHome: .helm/charts
+
+helmCharts:
+  - name: tempo
+    repo: https://grafana-community.github.io/helm-charts
+    version: 2.2.3
+    releaseName: tempo
+    namespace: observability
+    valuesFile: values/home.yaml
+    includeCRDs: false
+    skipTests: true
+
+images:
+  - name: docker.io/grafana/tempo
+    newName: docker.io/grafana/tempo
+    digest: sha256:6616b00287a4d7001951b5de117828ad5c6f93744935c1b7a5e044736373352c
+
+patches:
+  - target:
+      group: ""
+      version: v1
+      kind: Service
+      name: tempo
+    patch: |-
+      - op: replace
+        path: /spec/ports
+        value:
+          - name: tempo-prom-metrics
+            port: 3200
+            protocol: TCP
+            targetPort: 3200
+          - name: grpc-tempo-otlp
+            port: 4317
+            protocol: TCP
+            targetPort: 4317
+  - target:
+      group: apps
+      version: v1
+      kind: StatefulSet
+      name: tempo
+    patch: |-
+      - op: replace
+        path: /spec/template/spec/containers/0/ports
+        value:
+          - containerPort: 3200
+            name: prom-metrics
+            protocol: TCP
+          - containerPort: 4317
+            name: otlp-grpc
+            protocol: TCP
@@ -0,0 +1,125 @@
+global:
+  commonLabels:
+    observability.hyeonworks.com/instance: home
+
+replicas: 1
+
+config: |
+  stream_over_http_enabled: false
+  memberlist:
+    cluster_label: "{{ .Release.Name }}.{{ .Release.Namespace }}"
+  multitenancy_enabled: false
+  usage_report:
+    reporting_enabled: false
+  compactor:
+    compaction:
+      block_retention: 168h
+  distributor:
+    receivers:
+      otlp:
+        protocols:
+          grpc:
+            endpoint: 0.0.0.0:4317
+  ingester:
+    trace_idle_period: 10s
+    max_block_duration: 5m
+    max_block_bytes: 100000000
+    complete_block_timeout: 15m
+    flush_all_on_shutdown: true
+  server:
+    http_listen_port: 3200
+  storage:
+    trace:
+      backend: s3
+      s3:
+        bucket: tempo
+        endpoint: minio.object-storage.svc.cluster.local:80
+        insecure: true
+        forcepathstyle: true
+        access_key: ${AWS_ACCESS_KEY_ID}
+        secret_key: ${AWS_SECRET_ACCESS_KEY}
+      wal:
+        path: /var/tempo/wal
+  querier: {}
+  query_frontend: {}
+  overrides:
+    defaults:
+      ingestion:
+        rate_limit_bytes: 5000000
+        burst_size_bytes: 10000000
+        max_traces_per_user: 5000
+      global:
+        max_bytes_per_trace: 5000000
+
+tempo:
+  registry: docker.io
+  repository: grafana/tempo
+  tag: 2.10.7
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: "1"
+      memory: 1Gi
+  memBallastSizeMbs: 0
+  reportingEnabled: false
+  metricsGenerator:
+    enabled: false
+  extraArgs:
+    config.expand-env: true
+  extraEnv:
+    - name: AWS_ACCESS_KEY_ID
+      valueFrom:
+        secretKeyRef:
+          name: tempo-object-storage
+          key: access-key-id
+    - name: AWS_SECRET_ACCESS_KEY
+      valueFrom:
+        secretKeyRef:
+          name: tempo-object-storage
+          key: secret-access-key
+  securityContext:
+    runAsNonRoot: true
+    allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: true
+    capabilities:
+      drop:
+        - ALL
+    seccompProfile:
+      type: RuntimeDefault
+
+tempoQuery:
+  enabled: false
+
+securityContext:
+  runAsUser: 10001
+  runAsGroup: 10001
+  runAsNonRoot: true
+  fsGroup: 10001
+  fsGroupChangePolicy: OnRootMismatch
+  seccompProfile:
+    type: RuntimeDefault
+
+serviceAccount:
+  automountServiceAccountToken: false
+
+service:
+  type: ClusterIP
+
+serviceMonitor:
+  enabled: true
+  interval: 30s
+  additionalLabels:
+    observability.hyeonworks.com/instance: home
+
+persistence:
+  enabled: true
+  enableStatefulSetAutoDeletePVC: false
+  storageClassName: ssd-local-observability-tempo-retain
+  accessModes:
+    - ReadWriteOnce
+  size: 5Gi
+
+podLabels:
+  platform.hyeonworks.com/aistor-client: "true"