apiVersion: apps/v1
kind: Deployment
metadata:
  name: otel-debug-receiver
  namespace: monitoring
  annotations:
    k8s-helper.io/git-ssh: git@git.k6n.net:mats/go-otel.git
    k8s-helper.io/git-url: https://git.k6n.net/mats/go-otel
spec:
  replicas: 1
  selector:
    matchLabels:
      app: otel-debug-receiver
  template:
    metadata:
      labels:
        app: otel-debug-receiver
    spec:
      serviceAccountName: otel-debug-receiver
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
      containers:
      - name: otel-debug
        image: matst80/otel-debug:latest
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          runAsUser: 1000
        ports:
        - containerPort: 8080
          name: http
        - containerPort: 4317
          name: grpc
        - containerPort: 4318
          name: otlp-http
        env:
        - name: GRPC_GO_LOG_SEVERITY_LEVEL
          value: "info"
        - name: OTELLOG_PATH
          value: "/logs/otel-agent.log"
        - name: OTEL_SOURCEMAP_DIR
          value: "/sourcemaps"
        - name: OTEL_OIDC_ISSUER
          value: "https://users.k6n.net"
        - name: OTEL_OIDC_CLIENT_ID
          value: "otel-debug"
        # Also accept tokens whose aud carries this service's URL (device-grant
        # dev tokens from the dev-console client, see k8s/auth-dev.yaml).
        - name: OTEL_OIDC_AUDIENCE
          value: "https://otel.k6n.net"
        # Service credential for non-interactive debugging agents. It grants
        # access to protected /api debug endpoints, not OTLP ingest.
        - name: OTEL_AGENT_TOKEN
          valueFrom:
            secretKeyRef:
              name: otel-agent-auth
              key: token
              # The debug API must not start without its service credential.
              # Leaving this optional makes the pod appear healthy while every
              # protected API request can only return 401.
              optional: false
        # ClickHouse storage: enables the aggregate stats endpoints
        # (/api/stats/*). Falls back to the file store if unreachable.
        - name: OTEL_CLICKHOUSE_ADDR
          value: "clickhouse.monitoring.svc.cluster.local:9000"
        - name: OTEL_CLICKHOUSE_DB
          value: "otel"
        - name: OTEL_CLICKHOUSE_USER
          valueFrom:
            secretKeyRef:
              name: clickhouse-auth
              key: username
              optional: true
        - name: OTEL_CLICKHOUSE_PASSWORD
          valueFrom:
            secretKeyRef:
              name: clickhouse-auth
              key: password
              optional: true
        # Connection pool tuning to prevent "acquire conn timeout" under ingest bursts
        - name: OTEL_CLICKHOUSE_MAX_OPEN_CONNS
          value: "10"
        - name: OTEL_CLICKHOUSE_MAX_IDLE_CONNS
          value: "5"
        - name: OTEL_CLICKHOUSE_DIAL_TIMEOUT
          value: "30s"
        - name: OTEL_CLICKHOUSE_CONN_MAX_LIFETIME
          value: "10m"
        - name: OTEL_STORE_WORKERS
          value: "4"
        # Optional rollout observation. The watcher is read-only and uses the
        # service account below. Leave Prometheus unset when unavailable.
        - name: OTEL_KUBERNETES_NAMESPACE
          value: ""
        # - name: OTEL_PROMETHEUS_URL
        #   value: "http://prometheus.monitoring.svc.cluster.local:9090"
        # Private token for an ingress-side synchronizer. If absent, the
        # promoted-IP endpoint stays disabled.
        - name: OTEL_HONEYPOT_TOKEN
          valueFrom:
            secretKeyRef:
              name: honeypot-auth
              key: token
              optional: true
        - name: OTEL_HONEYPOT_THRESHOLD
          value: "3"
        - name: OTEL_HONEYPOT_WINDOW
          value: "15m"
        - name: OTEL_HONEYPOT_TTL
          value: "1h"
        - name: OTEL_NEEDLE_ADDR
          value: "http://127.0.0.1:5005"
        volumeMounts:
        - name: log-dir
          mountPath: /logs
        - name: sourcemap-dir
          mountPath: /sourcemaps
        livenessProbe:
          httpGet:
            path: /health
            port: http
          initialDelaySeconds: 5
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /health
            port: http
          initialDelaySeconds: 5
          periodSeconds: 10
        resources:
          requests:
            memory: "128Mi"
            cpu: "100m"
          limits:
            memory: "256Mi"
            cpu: "500m"
      - name: needle-sidecar
        image: matst80/needle-sidecar:latest
        imagePullPolicy: Always
        ports:
        - containerPort: 5005
          name: needle-http
        env:
        - name: HOME
          value: "/app"
        - name: NEEDLE_PORT
          value: "5005"
        - name: NEEDLE_HOST
          value: "0.0.0.0"
        - name: NEEDLE_TELEMETRY
          value: "0"
        livenessProbe:
          httpGet:
            path: /health
            port: needle-http
          initialDelaySeconds: 5
          periodSeconds: 15
        readinessProbe:
          httpGet:
            path: /health
            port: needle-http
          initialDelaySeconds: 3
          periodSeconds: 10
        resources:
          requests:
            memory: "512Mi"
            cpu: "200m"
          limits:
            memory: "2Gi"
            cpu: "4000m"
      volumes:
      - name: log-dir
        emptyDir: {}
      - name: sourcemap-dir
        persistentVolumeClaim:
          claimName: otel-sourcemaps

---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: otel-sourcemaps
  namespace: monitoring
spec:
  accessModes: ["ReadWriteOnce"]
  resources:
    requests:
      storage: 1Gi
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: otel-debug-receiver
  namespace: monitoring

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: otel-debug-receiver-rollout-reader
rules:
- apiGroups: ["apps"]
  resources: ["deployments", "replicasets"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["pods", "events"]
  verbs: ["get", "list", "watch"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: otel-debug-receiver-rollout-reader
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: otel-debug-receiver-rollout-reader
subjects:
- kind: ServiceAccount
  name: otel-debug-receiver
  namespace: monitoring