Add clickhouse users

apps/otel/otel-clickhouse.yaml

@@ -3,25 +3,6 @@ kind: ClickHouseInstallation
 metadata:
   name: otel-cluster
 spec:
-  templates:
-    podTemplates:
-      - name: clickhouse-pod-template
-        spec:
-          containers:
-            - name: clickhouse
-              image: altinity/clickhouse-server:25.3.6.10034.altinitystable
-              volumeMounts:
-                - name: clickhouse-storage
-                  mountPath: /var/lib/clickhouse
-    volumeClaimTemplates:
-      - name: clickhouse-storage
-        reclaimPolicy: Retain
-        spec:
-          accessModes:
-            - ReadWriteOnce
-          resources:
-            requests:
-              storage: 5Gi
   configuration:
     clusters:
       - name: otel-cluster
@@ -30,3 +11,84 @@ spec:
           replicasCount: 1
         templates:
           podTemplate: clickhouse-pod-template
+    users:
+      collector/password:
+        valueFrom:
+          secretKeyRef:
+            name: clickhouse-passwords
+            key: collector
+      collector/networks/ip: "::/0"
+      collector/grants/query:
+        - GRANT SELECT, INSERT, UPDATE, DROP, DELETE, ALTER, CREATE ON otel.*
+        - GRANT CREATE DATABASE ON *.*
+      grafana/password:
+        valueFrom:
+          secretKeyRef:
+            name: clickhouse-passwords
+            key: grafana
+      grafana/networks/ip: "::/0"
+      grafana/grants/query:
+        - GRANT SELECT ON otel.*
+  defaults:
+    templates:
+      podTemplate: pod-template
+      dataVolumeClaimTemplate: data-volume-template
+      logVolumeClaimTemplate: log-volume-template
+  templates:
+    podTemplates:
+      - name: pod-template
+        spec:
+          containers:
+            - name: clickhouse
+              image: clickhouse/clickhouse-server:latest
+              env:
+                - name: CLICKHOUSE_ALWAYS_RUN_INITDB_SCRIPTS
+                  value: "true"
+              volumeMounts:
+                - name: bootstrap-configmap-volume
+                  mountPath: /docker-entrypoint-initdb.d
+          volumes:
+            - name: bootstrap-configmap-volume
+              configMap:
+                name: bootstrap-mounted-configmap
+    volumeClaimTemplates:
+      - name: data-volume-template
+        spec:
+          accessModes:
+            - ReadWriteOnce
+          resources:
+            requests:
+              storage: 10Gi
+      - name: log-volume-template
+        spec:
+          accessModes:
+            - ReadWriteOnce
+          resources:
+            requests:
+              storage: 1Gi
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: clickhouse-passwords
+spec:
+  refreshPolicy: CreatedOnce
+  dataFrom:
+    - sourceRef:
+        generatorRef:
+          apiVersion: generators.external-secrets.io/v1alpha1
+          kind: ClusterGenerator
+          name: uuid
+      rewrite:
+        - regexp:
+            source: uuid
+            target: collector
+    - sourceRef:
+        generatorRef:
+          apiVersion: generators.external-secrets.io/v1alpha1
+          kind: ClusterGenerator
+          name: uuid
+      rewrite:
+        - regexp:
+            source: uuid
+            target: grafana

apps/otel/otel.yaml

@@ -4,6 +4,12 @@ metadata:
   name: otel
 spec:
   mode: daemonset
+  env:
+  - name: CLICKHOUSE_PASSWORD
+    valueFrom:
+      secretKeyRef:
+        name: clickhouse-passwords
+        key: collector
   config:
     receivers:
       # hostmetrics:
@@ -38,13 +44,13 @@ spec:
       debug:
         verbosity: detailed
       clickhouse:
-        endpoint: tcp://clickhouse-otel-cluster:9000?dial_timeout=10s&compress=lz4&async_insert=1
+        endpoint: tcp://clickhouse-otel-cluster.otel.svc.cluster.local:9000?dial_timeout=10s&compress=lz4&async_insert=1
+        username: collector
+        password: ${env:CLICKHOUSE_PASSWORD}
         ttl: 168h # a week
-        traces_table_name: otel_traces
-        logs_table_name: otel_logs
         create_schema: true
         timeout: 5s
-        database: default
+        database: otel
         sending_queue:
           queue_size: 1000
         retry_on_failure:
@@ -53,7 +59,6 @@ spec:
           max_interval: 30s
           max_elapsed_time: 300s
 
-
     extensions:
       health_check:
         endpoint: 0.0.0.0:13133