Add kyoo admin apikey for personal use

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

apps/authentik.yaml

@@ -17,7 +17,7 @@ spec:
   source:
     repoURL: https://charts.goauthentik.io
     chart: authentik
-    targetRevision: 2025.10.1
+    targetRevision: 2025.10.2
     helm:
       valuesObject:
         authentik:

apps/kyoo-v5.yaml

@@ -13,7 +13,7 @@ spec:
       prune: true
       selfHeal: true
     syncOptions:
-    - CreateNamespace=true
+      - CreateNamespace=true
   source:
     repoURL: https://github.com/zoriya/Kyoo
     path: chart
@@ -30,11 +30,23 @@ spec:
           postgres:
             shared:
               host: kyoo-v5-postgres
+          extraEnv:
+            - name: OTEL_EXPORTER_OTLP_ENDPOINT
+              value: "http://otel-collector.otel.svc:4317"
+            - name: OTEL_EXPORTER_OTLP_PROTOCOL
+              value: "grpc"
         postgres:
           enabled: true
         kyoo:
           address: https://beta.sdg.moe
           transcoderAcceleration: nvidia
+          auth:
+            apikeys:
+              extra:
+                - name: admin
+                  existingSecret: admin-apikey
+                  apikeyKey: uuid
+                  claims: '{"permissions": ["users.read", "users.write", "apikeys.read", "apikeys.write", "users.delete", "core.read", "core.write", "core.play", "scanner.trigger"], "verified": true}'
         transcoder:
           runtimeClass: nvidia
         ingress:
@@ -63,7 +75,7 @@ spec:
               name: kyoo-v5-medias
             spec:
               accessModes:
-              - ReadWriteOnce
+                - ReadWriteOnce
               capacity:
                 storage: 200Ti
               csi:
@@ -81,7 +93,20 @@ spec:
               storageClassName: ""
               volumeName: kyoo-v5-medias
               accessModes:
-              - ReadWriteOnce
+                - ReadWriteOnce
               resources:
                 requests:
                   storage: 200Ti
+
+          - apiVersion: external-secrets.io/v1
+            kind: ExternalSecret
+            metadata:
+              name: admin-apikey
+            spec:
+              refreshPolicy: CreatedOnce
+              dataFrom:
+                - sourceRef:
+                    generatorRef:
+                      apiVersion: generators.external-secrets.io/v1alpha1
+                      kind: ClusterGenerator
+                      name: uuid

apps/otel/otel-rbac.yaml

@@ -0,0 +1,24 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: otel-collector
+rules:
+  - apiGroups: [""]
+    resources: ["pods", "namespaces", "nodes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["apps"]
+    resources: ["deployments", "statefulsets", "daemonsets", "replicasets"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: otel-collector
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: otel-collector
+subjects:
+  - kind: ServiceAccount
+    name: otel-collector
+    namespace: otel

apps/otel/otel.yaml

@@ -38,6 +38,8 @@ spec:
       #     paging:
       otlp:
         protocols:
+          grpc:
+            endpoint: 0.0.0.0:4317
           http:
             endpoint: 0.0.0.0:4318
             auth:
@@ -52,6 +54,15 @@ spec:
         send_batch_size: 2000
         send_batch_max_size: 2000
         timeout: 5s
+      k8sattributes:
+        extract:
+          metadata:
+            - k8s.namespace.name
+            - k8s.pod.name
+            - k8s.pod.start_time
+            - k8s.pod.uid
+            - k8s.deployment.name
+            - k8s.node.name
 
     exporters:
       debug:
@@ -88,13 +99,13 @@ spec:
       pipelines:
         traces:
           receivers: [otlp]
-          processors: [memory_limiter, batch]
+          processors: [k8sattributes, memory_limiter, batch]
           exporters: [clickhouse]
         metrics:
           receivers: [otlp] #[otlp, hostmetrics]
-          processors: [memory_limiter, batch]
+          processors: [k8sattributes, memory_limiter, batch]
           exporters: [debug, clickhouse]
         logs:
           receivers: [otlp]
-          processors: [memory_limiter, batch]
+          processors: [k8sattributes, memory_limiter, batch]
           exporters: [clickhouse]