more otel

k8s/deployment.yaml

@@ -2,6 +2,10 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: otel-debug-receiver
+  namespace: monitoring
+  annotations:
+    k8s-helper.io/git-ssh: git@git.k6n.net:mats/go-otel.git
+    k8s-helper.io/git-url: https://git.k6n.net/mats/go-otel
 spec:
   replicas: 1
   selector:
@@ -12,6 +16,7 @@ spec:
       labels:
         app: otel-debug-receiver
     spec:
+      serviceAccountName: otel-debug-receiver
       securityContext:
         runAsNonRoot: true
         runAsUser: 1000
@@ -40,9 +45,77 @@ spec:
           value: "info"
         - name: OTELLOG_PATH
           value: "/logs/otel-agent.log"
+        - name: OTEL_SOURCEMAP_DIR
+          value: "/sourcemaps"
+        - name: OTEL_OIDC_ISSUER
+          value: "https://users.k6n.net"
+        - name: OTEL_OIDC_CLIENT_ID
+          value: "otel-debug"
+        # Service credential for non-interactive debugging agents. It grants
+        # access to protected /api debug endpoints, not OTLP ingest.
+        - name: OTEL_AGENT_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: otel-agent-auth
+              key: token
+              # The debug API must not start without its service credential.
+              # Leaving this optional makes the pod appear healthy while every
+              # protected API request can only return 401.
+              optional: false
+        # ClickHouse storage: enables the aggregate stats endpoints
+        # (/api/stats/*). Falls back to the file store if unreachable.
+        - name: OTEL_CLICKHOUSE_ADDR
+          value: "clickhouse.monitoring.svc.cluster.local:9000"
+        - name: OTEL_CLICKHOUSE_DB
+          value: "otel"
+        - name: OTEL_CLICKHOUSE_USER
+          valueFrom:
+            secretKeyRef:
+              name: clickhouse-auth
+              key: username
+              optional: true
+        - name: OTEL_CLICKHOUSE_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: clickhouse-auth
+              key: password
+              optional: true
+        # Connection pool tuning to prevent "acquire conn timeout" under ingest bursts
+        - name: OTEL_CLICKHOUSE_MAX_OPEN_CONNS
+          value: "10"
+        - name: OTEL_CLICKHOUSE_MAX_IDLE_CONNS
+          value: "5"
+        - name: OTEL_CLICKHOUSE_DIAL_TIMEOUT
+          value: "30s"
+        - name: OTEL_CLICKHOUSE_CONN_MAX_LIFETIME
+          value: "10m"
+        - name: OTEL_STORE_WORKERS
+          value: "4"
+        # Optional rollout observation. The watcher is read-only and uses the
+        # service account below. Leave Prometheus unset when unavailable.
+        - name: OTEL_KUBERNETES_NAMESPACE
+          value: ""
+        # - name: OTEL_PROMETHEUS_URL
+        #   value: "http://prometheus.monitoring.svc.cluster.local:9090"
+        # Private token for an ingress-side synchronizer. If absent, the
+        # promoted-IP endpoint stays disabled.
+        - name: OTEL_HONEYPOT_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: honeypot-auth
+              key: token
+              optional: true
+        - name: OTEL_HONEYPOT_THRESHOLD
+          value: "3"
+        - name: OTEL_HONEYPOT_WINDOW
+          value: "15m"
+        - name: OTEL_HONEYPOT_TTL
+          value: "1h"
         volumeMounts:
         - name: log-dir
           mountPath: /logs
+        - name: sourcemap-dir
+          mountPath: /sourcemaps
         livenessProbe:
           httpGet:
             path: /health
@@ -65,3 +138,39 @@ spec:
       volumes:
       - name: log-dir
         emptyDir: {}
+      - name: sourcemap-dir
+        emptyDir: {}
+
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: otel-debug-receiver
+  namespace: monitoring
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: otel-debug-receiver-rollout-reader
+rules:
+- apiGroups: ["apps"]
+  resources: ["deployments", "replicasets"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: [""]
+  resources: ["pods", "events"]
+  verbs: ["get", "list", "watch"]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: otel-debug-receiver-rollout-reader
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: otel-debug-receiver-rollout-reader
+subjects:
+- kind: ServiceAccount
+  name: otel-debug-receiver
+  namespace: monitoring