refactor(k8s): Reorganize into 5-layer structure with production kustomizations

2026-07-16 14:28:19 -07:00
parent a81b9b6169
commit 2d7330798b
214 changed files with 405 additions and 885 deletions
@@ -0,0 +1,124 @@
+#!/usr/bin/env bash
+# logging/bootstrap.sh
+# Deploys MinIO + Loki + Promtail + Grafana into the logging namespace.
+#
+# Prerequisites:
+#   - kubectl configured (KUBECONFIG pointing to cluster-config/kubeconfig)
+#   - helm >= 3.x installed
+#   - logging/.env file containing:
+#       GRAFANA_ADMIN_PASSWORD=...
+#       MINIO_ROOT_USER=...
+#       MINIO_ROOT_PASSWORD=...
+#     OR those variables already exported in the calling shell.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+KUBECONFIG="${KUBECONFIG:-${SCRIPT_DIR}/../cluster-config/kubeconfig}"
+export KUBECONFIG
+
+# ── Load credentials ──────────────────────────────────────────────────────────
+if [[ -f "${SCRIPT_DIR}/.env" ]]; then
+  # shellcheck source=/dev/null
+  source "${SCRIPT_DIR}/.env"
+fi
+
+for var in GRAFANA_ADMIN_PASSWORD MINIO_ROOT_USER MINIO_ROOT_PASSWORD; do
+  if [[ -z "${!var:-}" ]]; then
+    echo "ERROR: ${var} is not set. Export it or place it in logging/.env"
+    exit 1
+  fi
+done
+
+# ── Namespace ─────────────────────────────────────────────────────────────────
+echo "==> Creating logging namespace with privileged pod security..."
+kubectl create namespace logging --dry-run=client -o yaml | kubectl apply -f -
+kubectl label namespace logging \
+  pod-security.kubernetes.io/enforce=privileged \
+  pod-security.kubernetes.io/enforce-version=latest \
+  --overwrite
+
+# ── Helm repos ────────────────────────────────────────────────────────────────
+echo "==> Adding Helm repositories..."
+helm repo add minio https://charts.min.io
+helm repo add grafana https://grafana.github.io/helm-charts
+helm repo update minio grafana
+
+# ── MinIO ─────────────────────────────────────────────────────────────────────
+echo "==> Installing MinIO..."
+helm upgrade --install minio minio/minio \
+  --namespace logging \
+  --values "${SCRIPT_DIR}/minio-values.yaml" \
+  --set auth.rootUser="${MINIO_ROOT_USER}" \
+  --set auth.rootPassword="${MINIO_ROOT_PASSWORD}" \
+  --wait \
+  --timeout 5m
+
+echo "==> Waiting for MinIO Deployment to be ready..."
+kubectl rollout status deployment/minio -n logging --timeout=120s
+
+# ── Create Loki buckets in MinIO ──────────────────────────────────────────────
+echo "==> Creating Loki buckets in MinIO..."
+MINIO_POD=$(kubectl get pod -n logging -l app=minio,release=minio -o jsonpath='{.items[0].metadata.name}')
+
+# Read the actual credentials MinIO is running with from the cluster secret
+ACTUAL_MINIO_USER=$(kubectl get secret minio -n logging -o jsonpath='{.data.rootUser}' | base64 --decode)
+ACTUAL_MINIO_PASS=$(kubectl get secret minio -n logging -o jsonpath='{.data.rootPassword}' | base64 --decode)
+
+kubectl exec -n logging "${MINIO_POD}" -- \
+  mc alias set local http://localhost:9000 "${ACTUAL_MINIO_USER}" "${ACTUAL_MINIO_PASS}"
+for bucket in loki-chunks loki-ruler loki-admin; do
+  kubectl exec -n logging "${MINIO_POD}" -- \
+    mc mb --ignore-existing "local/${bucket}"
+  echo "  bucket: ${bucket} ready"
+done
+
+# ── Loki ──────────────────────────────────────────────────────────────────────
+echo "==> Installing Loki (SingleBinary + MinIO backend)..."
+helm upgrade --install loki grafana/loki \
+  --namespace logging \
+  --values "${SCRIPT_DIR}/loki-values.yaml" \
+  --set loki.storage.s3.access_key_id="${ACTUAL_MINIO_USER}" \
+  --set loki.storage.s3.secret_access_key="${ACTUAL_MINIO_PASS}" \
+  --wait \
+  --timeout 5m
+
+echo "==> Waiting for Loki StatefulSet to be ready..."
+kubectl rollout status statefulset/loki -n logging --timeout=120s
+
+# ── Promtail ──────────────────────────────────────────────────────────────────
+echo "==> Installing Promtail..."
+helm upgrade --install promtail grafana/promtail \
+  --namespace logging \
+  --values "${SCRIPT_DIR}/promtail-values.yaml" \
+  --wait \
+  --timeout 3m
+
+echo "==> Waiting for Promtail DaemonSet to be ready..."
+kubectl rollout status daemonset/promtail -n logging --timeout=60s
+
+# ── Grafana ───────────────────────────────────────────────────────────────────
+echo "==> Installing Grafana..."
+helm upgrade --install grafana grafana/grafana \
+  --namespace logging \
+  --values "${SCRIPT_DIR}/grafana-values.yaml" \
+  --set adminPassword="${GRAFANA_ADMIN_PASSWORD}" \
+  --wait \
+  --timeout 5m
+
+echo "==> Waiting for Grafana Deployment to be ready..."
+kubectl rollout status deployment/grafana -n logging --timeout=120s
+
+# ── Done ──────────────────────────────────────────────────────────────────────
+echo ""
+echo "==> Logging stack is up."
+echo ""
+echo "Grafana (log explorer UI):"
+echo "  kubectl port-forward -n logging svc/grafana 3000:80"
+echo "  http://localhost:3000  (admin / <your GRAFANA_ADMIN_PASSWORD>)"
+echo ""
+echo "MinIO console (S3 object browser):"
+echo "  kubectl port-forward -n logging svc/minio 9001:9001"
+echo "  http://localhost:9001  (${MINIO_ROOT_USER} / <your MINIO_ROOT_PASSWORD>)"
+echo ""
+echo "MinIO S3 endpoint for other apps:"
+echo "  http://minio.logging.svc.cluster.local:9000"