# Single-node ClickHouse for the otel-debug-receiver, applied as one file:
#   kubectl apply -f k8s/clickhouse.yaml
#
# A single instance (per request): one StatefulSet replica. Data lives on
# serber's local disk at /srv/monitoring-db (hostPath), so the pod is pinned to
# that node. It used to be an nfs-client PVC on a spinning-disk NAS, where
# synchronous writes cost ~120 ms and every query paid that latency; see
# k8s/migrate/clickhouse-nfs-to-local.yaml for the one-off data move.
# Resources sized for a small cluster; adjust before production use.
apiVersion: v1
kind: Namespace
metadata:
  name: otel-debug
---
apiVersion: v1
kind: Secret
metadata:
  name: clickhouse-auth
  namespace: monitoring
type: Opaque
stringData:
  # Change these before applying. ClickHouse will honor the values from
  # the users.d override mounted below, so no post-install SQL is needed.
  username: otel
  password: CHANGE_ME
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: clickhouse-config
  namespace: monitoring
data:
  users.d-otel.xml: |
    <clickhouse>
      <users>
        <otel>
          <password from_env="CLICKHOUSE_PASSWORD"/>
          <networks><ip>::/0</ip></networks>
          <grants>
            <grant><query>GRANT ALL ON otel.*</query></grant>
          </grants>
        </otel>
      </users>
    </clickhouse>
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: clickhouse
  namespace: monitoring
spec:
  serviceName: clickhouse
  replicas: 1
  selector:
    matchLabels:
      app: clickhouse
  template:
    metadata:
      labels:
        app: clickhouse
    spec:
      nodeSelector:
        kubernetes.io/hostname: serber
      securityContext:
        fsGroup: 101
      initContainers:
      # hostPath directories are created root-owned and fsGroup does not apply
      # to them; ClickHouse runs as uid/gid 101.
      - name: fix-data-perms
        image: busybox:1.36
        command: ["sh", "-c", "chown -R 101:101 /var/lib/clickhouse"]
        securityContext:
          runAsUser: 0
        volumeMounts:
        - name: data
          mountPath: /var/lib/clickhouse
      containers:
      - name: clickhouse
        image: clickhouse/clickhouse-server:24.8
        ports:
        - containerPort: 9000
          name: native
        - containerPort: 8123
          name: http
        env:
        - name: CLICKHOUSE_PASSWORD
          valueFrom:
            secretKeyRef:
              name: clickhouse-auth
              key: password
        volumeMounts:
        - name: data
          mountPath: /var/lib/clickhouse
        # Mount the user override as a single file: ConfigMap volumes are
        # read-only, and the entrypoint needs to write its own
        # default-user.xml into the users.d directory on first start.
        - name: user-config
          mountPath: /etc/clickhouse-server/users.d/otel.xml
          subPath: users.d-otel.xml
        readinessProbe:
          httpGet:
            path: /ping
            port: http
          initialDelaySeconds: 10
          periodSeconds: 10
        livenessProbe:
          httpGet:
            path: /ping
            port: http
          initialDelaySeconds: 30
          periodSeconds: 30
        resources:
          requests:
            memory: "512Mi"
            cpu: "250m"
          limits:
            memory: "2Gi"
            cpu: "1"
      volumes:
      - name: data
        hostPath:
          path: /srv/monitoring-db
          type: DirectoryOrCreate
      - name: user-config
        configMap:
          name: clickhouse-config
          items:
          - key: users.d-otel.xml
            path: users.d-otel.xml
---
apiVersion: v1
kind: Service
metadata:
  name: clickhouse
  namespace: monitoring
spec:
  selector:
    app: clickhouse
  ports:
  - name: native
    port: 9000
    targetPort: 9000
  - name: http
    port: 8123
    targetPort: 8123
  type: ClusterIP