apiVersion: operator.victoriametrics.com/v1beta1
kind: VMCluster
metadata:
  name: cp9-metrics
  labels:
    app.kubernetes.io/part-of: cp9-o11y
spec:
  retentionPeriod: 1d
  replicationFactor: 1
  vminsert:
    replicaCount: 1
    disableSelfServiceScrape: true
    image:
      repository: docker.io/victoriametrics/vminsert
      tag: v1.117.1-cluster@sha256:43a45510a794726a98e1b4b000c9abf19308b671a4c64f8642779868569d3fe5
    resources:
      requests:
        cpu: 50m
        memory: 64Mi
      limits:
        cpu: 500m
        memory: 512Mi
  vmselect:
    replicaCount: 1
    disableSelfServiceScrape: true
    cacheMountPath: /select-cache
    image:
      repository: docker.io/victoriametrics/vmselect
      tag: v1.117.1-cluster@sha256:29ad423762138afb179c5ce8b68480db817831c30bcd45276a97642ab3452216
    storage:
      emptyDir:
        sizeLimit: 256Mi
    resources:
      requests:
        cpu: 50m
        memory: 64Mi
      limits:
        cpu: 500m
        memory: 1Gi
  vmstorage:
    replicaCount: 1
    disableSelfServiceScrape: true
    storageDataPath: /vm-data
    image:
      repository: docker.io/victoriametrics/vmstorage
      tag: v1.117.1-cluster@sha256:38e8ba6a14a01b9de36d7cdfa09d81bdf91c12711a7269d9dcd32fe200bf0a5f
    storage:
      volumeClaimTemplate:
        spec:
          accessModes:
            - ReadWriteOnce
          storageClassName: local-path
          resources:
            requests:
              storage: 1Gi
    resources:
      requests:
        cpu: 50m
        memory: 128Mi
      limits:
        cpu: 1
        memory: 1500Mi
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: globalserver
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: data-account-segment
data:
  data-account-key-start-id: "1"
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: regional-server-controller-manager
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: globalserver
rules:
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "list", "watch", "create", "update", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: globalserver
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: globalserver
subjects:
  - kind: ServiceAccount
    name: globalserver
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cp9-o11y-regional-server
rules:
  - apiGroups: ["", "apps", "batch", "coordination.k8s.io", "monitoring.coreos.com", "networking.k8s.io", "observability.pingcap.com", "operator.victoriametrics.com", "rbac.authorization.k8s.io"]
    resources: ["*"]
    verbs: ["*"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cp9-o11y-regional-server
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cp9-o11y-regional-server
subjects:
  - kind: ServiceAccount
    name: regional-server-controller-manager
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: globalserver
  labels:
    app.kubernetes.io/name: globalserver
    app.kubernetes.io/part-of: cp9-o11y
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: globalserver
  template:
    metadata:
      labels:
        app.kubernetes.io/name: globalserver
        app.kubernetes.io/part-of: cp9-o11y
    spec:
      serviceAccountName: globalserver
      imagePullSecrets:
        - name: cp9-staging-ecr-pull
      containers:
        - name: globalserver
          image: 385595570414.dkr.ecr.us-west-2.amazonaws.com/observability@sha256:adfa2fd37b03376a7cb603f985286a25a1ee3a1311a64ea964cb4db315075724
          command: ["/usr/local/bin/observability-global-server"]
          args:
            - --port=8080
            - --metrics-port=8082
            - --health-probe-bind-address=:8084
            - --env=dev
            - --vendor=aws
            - --region=__CP9_TARGET_REGION__
            - --enable-auditlog=false
            - --log-level=info
          env:
            - name: AWS_REGION
              value: __CP9_TARGET_REGION__
            - name: AWS_ROLE_ARN
              value: __CP9_REMOTE_RUNTIME_ROLE_ARN__
            - name: AWS_WEB_IDENTITY_TOKEN_FILE
              value: /var/run/cp9-sts/web-identity-token
            - name: AWS_ENDPOINT_URL_STS
              value: http://127.0.0.1:8085
          ports:
            - name: http
              containerPort: 8080
            - name: metrics
              containerPort: 8082
            - name: health
              containerPort: 8084
          readinessProbe:
            httpGet:
              path: /readyz
              port: health
            periodSeconds: 2
            failureThreshold: 30
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 500m
              memory: 256Mi
          volumeMounts:
            - name: ec2-sts-compat
              mountPath: /var/run/cp9-sts
              readOnly: true
        - name: ec2-sts-compat
          image: public.ecr.aws/docker/library/python:3.12-alpine@sha256:6d43704baacd1bfbe7c295d7f13079d5d8104ed33568873133f8fc69980419df
          command: ["python", "/var/run/cp9-sts/ec2-sts-compat.py"]
          env:
            - name: CP9_EXPECTED_ROLE_ARN
              value: __CP9_REMOTE_RUNTIME_ROLE_ARN__
            - name: PYTHONDONTWRITEBYTECODE
              value: "1"
          readinessProbe:
            exec:
              command:
                - python
                - -c
                - import urllib.request; urllib.request.urlopen("http://127.0.0.1:8085/healthz", timeout=1)
            timeoutSeconds: 5
            periodSeconds: 2
            failureThreshold: 30
          securityContext:
            runAsNonRoot: true
            runAsUser: 65532
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
          resources:
            requests:
              cpu: 5m
              memory: 16Mi
            limits:
              cpu: 100m
              memory: 64Mi
          volumeMounts:
            - name: ec2-sts-compat
              mountPath: /var/run/cp9-sts
              readOnly: true
      volumes:
        - name: ec2-sts-compat
          configMap:
            name: cp9-o11y-ec2-sts-compat
---
apiVersion: v1
kind: Service
metadata:
  name: globalserver
  annotations:
    konghq.com/path: /api/v1
spec:
  selector:
    app.kubernetes.io/name: globalserver
  ports:
    - name: http
      port: 8080
      targetPort: http
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: regionalserver
  labels:
    app.kubernetes.io/name: regionalserver
    app.kubernetes.io/part-of: cp9-o11y
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: regionalserver
  template:
    metadata:
      labels:
        app.kubernetes.io/name: regionalserver
        app.kubernetes.io/part-of: cp9-o11y
    spec:
      serviceAccountName: regional-server-controller-manager
      imagePullSecrets:
        - name: cp9-staging-ecr-pull
      containers:
        - name: regionalserver
          image: 385595570414.dkr.ecr.us-west-2.amazonaws.com/observability@sha256:4c1bec334a51dff8e3bd1d979175e765530b84c769dad3db291aa829c3d16c3d
          args: ["--vendor=aws", "--client-mode=true", "--log-level=info"]
          env:
            - name: AWS_REGION
              value: __CP9_TARGET_REGION__
          ports:
            - name: http
              containerPort: 8081
            - name: metrics
              containerPort: 8083
          resources:
            requests:
              cpu: 50m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 1Gi
          volumeMounts:
            - name: config
              mountPath: /config
      volumes:
        - name: config
          configMap:
            name: regionalserver
---
apiVersion: v1
kind: Service
metadata:
  name: regionalservice
spec:
  selector:
    app.kubernetes.io/name: regionalserver
  ports:
    - name: http
      port: 8081
      targetPort: http
---
apiVersion: v1
kind: Service
metadata:
  name: o11y-metrics-insert
  annotations:
    konghq.com/path: /insert
spec:
  selector:
    app.kubernetes.io/component: monitoring
    app.kubernetes.io/instance: cp9-metrics
    app.kubernetes.io/name: vminsert
  ports:
    - name: http
      port: 8480
      targetPort: 8480
---
apiVersion: v1
kind: Service
metadata:
  name: o11y-metrics-select
  annotations:
    konghq.com/path: /select
spec:
  selector:
    app.kubernetes.io/component: monitoring
    app.kubernetes.io/instance: cp9-metrics
    app.kubernetes.io/name: vmselect
  ports:
    - name: http
      port: 8481
      targetPort: 8481
    - name: metrics
      port: 8083
      targetPort: metrics
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: data-server
  labels:
    app.kubernetes.io/name: data-server
    app.kubernetes.io/part-of: cp9-o11y
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: data-server
  template:
    metadata:
      labels:
        app.kubernetes.io/name: data-server
        app.kubernetes.io/part-of: cp9-o11y
    spec:
      serviceAccountName: regional-server-controller-manager
      imagePullSecrets:
        - name: cp9-staging-ecr-pull
      containers:
        - name: data-server
          image: 385595570414.dkr.ecr.us-west-2.amazonaws.com/observability@sha256:7925b74f376cee4b6b9628ba751dfc24046d2b30dc7a1b33b5abd6dae6f19c3d
          args: ["--vendor=aws", "--client-mode=true", "--log-level=info"]
          env:
            - name: AWS_REGION
              value: __CP9_TARGET_REGION__
          ports:
            - name: http
              containerPort: 8081
            - name: metrics
              containerPort: 8084
          resources:
            requests:
              cpu: 25m
              memory: 64Mi
            limits:
              cpu: 250m
              memory: 512Mi
          volumeMounts:
            - name: config
              mountPath: /config
      volumes:
        - name: config
          configMap:
            name: regionalserver
---
apiVersion: v1
kind: Service
metadata:
  name: regional-data-service
spec:
  selector:
    app.kubernetes.io/name: data-server
  ports:
    - name: http
      port: 8081
      targetPort: http