ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/victorialogs/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - logs.yaml
+  - vlagent-namespace.yaml
+  - vlagent.yaml
+  - vlagent-network-policies.yaml
+  - network-policies.yaml

vendor/platform/victorialogs/logs.yaml

@@ -0,0 +1,48 @@
+apiVersion: operator.victoriametrics.com/v1
+kind: VLCluster
+metadata:
+  name: main
+  namespace: victorialogs
+spec:
+  useStrictSecurity: true
+  vlinsert:
+    image:
+      tag: v1.53.0
+    replicaCount: 2
+    resources:
+      requests:
+        cpu: 100m
+        memory: 256Mi
+      limits:
+        memory: 1Gi
+  vlselect:
+    image:
+      tag: v1.53.0
+    replicaCount: 2
+    resources:
+      requests:
+        cpu: 100m
+        memory: 256Mi
+      limits:
+        memory: 1Gi
+  vlstorage:
+    image:
+      tag: v1.53.0
+    replicaCount: 1
+    retentionPeriod: 30d
+    storageDataPath: /vl-data
+    storage:
+      volumeClaimTemplate:
+        spec:
+          storageClassName: longhorn-double
+          accessModes:
+            - ReadWriteOnce
+          resources:
+            requests:
+              storage: 50Gi
+    resources:
+      requests:
+        cpu: 250m
+        memory: 1Gi
+      limits:
+        memory: 4Gi

vendor/platform/victorialogs/namespace.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: victorialogs
+  labels:
+    pod-security.kubernetes.io/enforce: restricted
+    pod-security.kubernetes.io/audit: restricted
+    pod-security.kubernetes.io/warn: restricted

vendor/platform/victorialogs/network-policies.yaml

@@ -0,0 +1,65 @@
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: victorialogs
+  namespace: victorialogs
+spec:
+  endpointSelector:
+    matchLabels:
+      managed-by: vm-operator
+  ingress:
+    - fromEntities:
+        - host
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: victorialogs
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: victoriametrics
+            app.kubernetes.io/name: vmagent
+            app.kubernetes.io/instance: main
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: victoriametrics
+            app.kubernetes.io/name: vmauth
+            app.kubernetes.io/instance: main
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: vlagent
+      toPorts:
+        - ports:
+            - port: "9481"
+              protocol: TCP
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: victorialogs
+    - toEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: host-egress-victorialogs
+spec:
+  nodeSelector: {}
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: victorialogs
+            managed-by: vm-operator

vendor/platform/victorialogs/vlagent-namespace.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: vlagent
+  labels:
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/warn: privileged

vendor/platform/victorialogs/vlagent-network-policies.yaml

@@ -0,0 +1,69 @@
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: vlagent
+  namespace: vlagent
+spec:
+  endpointSelector:
+    matchLabels:
+      managed-by: vm-operator
+  ingress:
+    - fromEntities:
+        - host
+        - remote-node
+      toPorts:
+        - ports:
+            - port: "9429"
+              protocol: TCP
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: victoriametrics
+            app.kubernetes.io/name: vmagent
+            app.kubernetes.io/instance: main
+      toPorts:
+        - ports:
+            - port: "9429"
+              protocol: TCP
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: victorialogs
+            managed-by: vm-operator
+      toPorts:
+        - ports:
+            - port: "9481"
+              protocol: TCP
+    - toEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: host-egress-vlagent
+spec:
+  nodeSelector: {}
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: vlagent
+            app.kubernetes.io/name: vlagent
+            app.kubernetes.io/instance: main
+      toPorts:
+        - ports:
+            - port: "9429"
+              protocol: TCP

vendor/platform/victorialogs/vlagent.yaml

@@ -0,0 +1,35 @@
+apiVersion: operator.victoriametrics.com/v1
+kind: VLAgent
+metadata:
+  name: main
+  namespace: vlagent
+spec:
+  useStrictSecurity: true
+  image:
+    repository: victoriametrics/vlagent
+    tag: v1.53.0
+  remoteWrite:
+    - url: http://vlinsert-main.victorialogs.svc.cluster.local:9481/internal/insert
+  remoteWriteSettings:
+    tmpDataPath: /var/lib/vlagent
+    maxDiskUsagePerURL: 1GiB
+  k8sCollector:
+    enabled: true
+    extraFields: '{"cluster":"quorate"}'
+    excludeFilter: kubernetes.pod_name:=%{HOSTNAME}
+  extraArgs:
+    envflag.enable: "true"
+  volumes:
+    - name: vlagent-data
+      hostPath:
+        path: /var/lib/vlagent
+        type: DirectoryOrCreate
+  volumeMounts:
+    - name: vlagent-data
+      mountPath: /var/lib/vlagent
+  resources:
+    requests:
+      cpu: 50m
+      memory: 128Mi
+    limits:
+      memory: 512Mi