#Installation

# 1. SASL password Secret. On Alauda OS / FIPS hosts the password MUST be
# at least 32 characters; below that, the broker rejects the KafkaUser with
# UnacceptableCredential. Generate with one of:
#   openssl rand -base64 24 | tr -d '\n'   # 32 chars base64
#   openssl rand -hex 16                   # 32 chars hex
apiVersion: v1
kind: Secret
metadata:
  name: platform-logging-password
  namespace: cpaas-system
type: Opaque
stringData:
  password: "<generate a strong password of at least 32 characters>"
---
# 2. The Kafka cluster. Alauda's `RdsKafka` is a strimzi fork whose
# schema differs from upstream Kafka: `version` / `config` / `replicas`
# / `mode` / `controller` / `storage` sit at `spec.*` top level (NOT
# under `spec.kafka.*`), and `spec.kafka.listeners` is a MAP keyed by
# `plain` / `tls` / `external` (NOT a list). Listener authentication is
# SCRAM-SHA-512. The five `config` values below are MANDATORY for
# logging — the broker defaults are too small for the audit-ingest
# batch size and will silently drop audit batches otherwise.
apiVersion: middleware.alauda.io/v1
kind: RdsKafka
metadata:
  name: cpaas-kafka
  namespace: cpaas-system
spec:
  version: 4.2.0
  mode: KRaft                       # MANDATORY: v4.4 kafka runs in KRaft mode (no ZooKeeper)
  replicas: 3                       # broker count — 1 for single-node evaluation, 3 for production
  upgradeOption:
    autoUpgrade: false              # SRE pins the version; set true only if you accept rolling upgrades on CSV bumps
  storage:
    class: ""                       # fill in your StorageClass; leave "" to use the cluster default
    size: 100Gi
  resources:                        # broker pod sizing — tune to your traffic
    limits:
      cpu: "2"
      memory: 4Gi
    requests:
      cpu: 200m
      memory: 1Gi
  config:
    # MANDATORY. Broker default 1 MiB is too small for K8s audit batches
    # (~1.1-1.5 MiB decompressed) and rejects all audit ingest. Value
    # aligns with razor producer max.request.size (10 MiB).
    message.max.bytes: "10485760"
    # MANDATORY. Must be >= message.max.bytes or replica sync stalls.
    replica.fetch.max.bytes: "10485760"
    # MANDATORY. Supports an 8 MiB batch envelope plus SASL overhead.
    socket.request.max.bytes: "104857600"
    # MANDATORY. Prevents ghost topics when razor / aggregate-vector are
    # temporarily misconfigured.
    auto.create.topics.enable: "false"
    # MANDATORY. Prevents silent data loss on broker crash.
    unclean.leader.election.enable: "false"
    # Production replication defaults for a 3-broker cluster. For a
    # single-broker evaluation cluster set every "3" below to "1" and
    # min.insync.replicas / transaction.state.log.min.isr to "1".
    default.replication.factor: "3"
    min.insync.replicas: "2"
    offsets.topic.replication.factor: "3"
    transaction.state.log.replication.factor: "3"
    transaction.state.log.min.isr: "2"
    # Retention sizing — razor consumes within seconds, 48h window is
    # the usual production SLO for replay / incident forensics.
    log.retention.ms: "172800000"             # 48 hours
    log.retention.bytes: "4928307200"         # ~4.6 GiB / partition
    num.partitions: "30"                      # default when auto.create is on; topics below pin this explicitly
  controller:                       # MANDATORY in KRaft mode: dedicated controller quorum
    replicas: 3                     # 1 for single-node evaluation, 3 for production quorum
    roles: [controller]
    storage:
      class: ""                     # same as broker; leave "" for cluster default SC
      size: 5Gi                     # controller logs are small, 5Gi is enough
    resources:
      limits:
        cpu: "1"
        memory: 2Gi
      requests:
        cpu: 200m
        memory: 512Mi
    template:
      pod:
        tolerations:                # tolerate control-plane taint so single-node evaluation clusters schedule
          - operator: Exists
  kafka:
    authorization:
      type: simple
    listeners:                      # MAP keyed by `plain` / `tls` / `external`, NOT a list
      plain:                        # SASL/SCRAM over plain TCP on :9092
        authentication:
          type: scram-sha-512
      # To enable SASL-over-TLS on :9093, add a `tls:` entry here (same
      # `authentication` block as `plain:`) and set `tls.ca` + bootstrap
      # port 9093 in the mq-conn Secret below.
    template:
      pod:
        tolerations:
          - operator: Exists
  entityOperator:
    topicOperator:
      resources:
        limits:
          cpu: 500m
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 256Mi
    userOperator:
      resources:
        limits:
          cpu: 500m
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 256Mi
    template:
      pod:
        tolerations:
          - operator: Exists
  kafkaExporter:                    # exposes broker metrics for the aggregate-vector lag watchdog and dashboards
    resources:
      limits:
        cpu: 200m
        memory: 256Mi
      requests:
        cpu: 100m
        memory: 128Mi
    template:
      pod:
        tolerations:
          - operator: Exists
---
# 3. The SASL account. The nine ACL rules below are ALL required — the
# storage operator's preflight check reports each missing rule by name
# and refuses to roll out until they are in place.
apiVersion: middleware.alauda.io/v1
kind: RdsKafkaUser
metadata:
  name: platform-logging
  namespace: cpaas-system
  labels:
    middleware.alauda.io/cluster: cpaas-kafka
spec:
  authentication:
    type: scram-sha-512
    password:
      valueFrom:
        secretKeyRef:
          name: platform-logging-password
          key: password
  authorization:
    type: simple
    acls:
      # (a) All permissions on the three topics.
      - resource: {type: topic, name: ALAUDA_LOG_TOPIC,   patternType: literal}
        operation: All
        host: "*"
      - resource: {type: topic, name: ALAUDA_EVENT_TOPIC, patternType: literal}
        operation: All
        host: "*"
      - resource: {type: topic, name: ALAUDA_AUDIT_TOPIC, patternType: literal}
        operation: All
        host: "*"
      # (b) Read on the three aggregate-vector consumer groups.
      - resource: {type: group, name: alauda_log,   patternType: literal}
        operation: Read
        host: "*"
      - resource: {type: group, name: alauda_event, patternType: literal}
        operation: Read
        host: "*"
      - resource: {type: group, name: alauda_audit, patternType: literal}
        operation: Read
        host: "*"
      # (c) Read on the razor and LogForward consumer-group prefixes.
      # Without these, razor and LogForward tenants get silent
      # GroupAuthorizationFailed and drop to 0 throughput.
      - resource: {type: group, name: razor-,      patternType: prefix}
        operation: Read
        host: "*"
      - resource: {type: group, name: logforward-, patternType: prefix}
        operation: Read
        host: "*"
      # (d) DescribeConfigs on the cluster (used by the preflight check).
      - resource: {type: cluster, name: kafka-cluster, patternType: literal}
        operation: DescribeConfigs
        host: "*"
---
# 4. The three topics. `spec.topicName` must match the values you put in
# the Kafka connection Secret in Section 1.3 and the ACL literal names
# in step 3. Set `replicas` to `1` for a single-node evaluation cluster
# and `3` for a production three-broker cluster.
apiVersion: middleware.alauda.io/v1
kind: RdsTopic
metadata:
  name: alauda-log-topic                 # DNS-safe CR name
  namespace: cpaas-system                # must match the RdsKafka cluster's namespace
  labels:
    middleware.alauda.io/cluster: cpaas-kafka
spec:
  topicName: ALAUDA_LOG_TOPIC            # broker-side topic name (uppercase)
  partitions: 30
  replicas: 3
  config:
    retention.ms: "172800000"            # 48 hours
    max.message.bytes: "10485760"        # MANDATORY, must match broker
---
apiVersion: middleware.alauda.io/v1
kind: RdsTopic
metadata:
  name: alauda-event-topic
  namespace: cpaas-system
  labels:
    middleware.alauda.io/cluster: cpaas-kafka
spec:
  topicName: ALAUDA_EVENT_TOPIC
  partitions: 30
  replicas: 3
  config:
    retention.ms: "172800000"
    max.message.bytes: "10485760"
---
apiVersion: middleware.alauda.io/v1
kind: RdsTopic
metadata:
  name: alauda-audit-topic
  namespace: cpaas-system
  labels:
    middleware.alauda.io/cluster: cpaas-kafka
spec:
  topicName: ALAUDA_AUDIT_TOPIC
  partitions: 30
  replicas: 3
  config:
    retention.ms: "172800000"
    max.message.bytes: "10485760"

apiVersion: v1
kind: Secret
metadata:
  name: platform-default-mq-conn
  namespace: cpaas-system
type: Opaque
stringData:
  # Required. Comma-separated host:port. The bootstrap Service name is
  # `<RdsKafka name>-kafka-bootstrap` and the plain SASL listener runs on
  # :9092. Defaults in this example match the RdsKafka in Section 1.1.
  bootstrap: "cpaas-kafka-kafka-bootstrap.cpaas-system.svc:9092"

  # Required. Name of the Kafka cluster CR.
  kafkaClusterName: "cpaas-kafka"

  # Required. SASL username.
  username: "platform-logging"

  # Required. SASL password.
  password: "<kafka-password>"

  # Optional. Defaults to SCRAM-SHA-512.
  # Allowed: SCRAM-SHA-512, SCRAM-SHA-256, PLAIN.
  sasl_mechanism: "SCRAM-SHA-512"

  # Optional. Topic names. Defaults shown. Must match the topics you created.
  topics.log: "ALAUDA_LOG_TOPIC"
  topics.event: "ALAUDA_EVENT_TOPIC"
  topics.audit: "ALAUDA_AUDIT_TOPIC"

  # SASL-over-TLS is optional. If you enabled the `tls:` listener in the
  # RdsKafka above, change `bootstrap` to port :9093 and add a `tls.ca` key
  # here with the broker CA PEM — read it from the strimzi-maintained
  # Secret `<RdsKafka name>-cluster-ca-cert` (key `ca.crt`). Omit `tls.ca`
  # entirely for the plain :9092 listener shown above.

apiVersion: v1
kind: Secret
metadata:
  name: platform-default-ch-conn
  namespace: cpaas-system
type: Opaque
stringData:
  # Required. HTTP endpoint, scheme and port included.
  #   http://…:8123     (plain HTTP)
  #   https://…:8443    (HTTPS)
  endpoint: "http://clickhouse-cpaas-clickhouse.cpaas-system.svc:8123"

  # Required. Must match spec.configuration.clusters[0].name on the CHI.
  # ACP baseline default: replicated
  cluster: "replicated"

  # Required. Target database. Must exist. ACP baseline default: observability
  database: "observability"

  # Required. Account with full permission on the target database.
  # ACP baseline default: platform-logging
  username: "platform-logging"
  password: "<clickhouse-password>"

  # Optional. TLS CA for HTTPS with a private CA. Omit for plain HTTP or a
  # trusted CA.
  tls.ca: |-
    -----BEGIN CERTIFICATE-----
    <clickhouse-ca-certificate>
    -----END CERTIFICATE-----

apiVersion: v1
kind: Secret
metadata:
  name: platform-default-os-conn
  namespace: cpaas-system
type: Opaque
stringData:
  # Required. Comma-separated HTTP(S) URLs. Put the highly-available
  # coordinator or load balancer first; some data paths use only the first
  # entry.
  endpoints: "https://cpaas-opensearch.cpaas-system.svc:9200"

  # Required unless the OpenSearch cluster allows anonymous access.
  # ACP baseline default: platform-logging
  username: "platform-logging"
  password: "<opensearch-password>"

apiVersion: log.alauda.io/v1alpha1
kind: PlatformLogForward
metadata:
  name: platform-default                            # fixed singleton name; do not change
spec:
  output:
    type: clickhouse                                # required for ClickHouse
  externalStorage:
    type: clickhouse
    shards: 1                                       # match the profile from Section 1.1.2
    replicas: 1                                     # match the profile from Section 1.1.2
    secretRef:
      name: platform-default-ch-conn
      namespace: cpaas-system
  externalMessageQueue:
    type: kafka
    secretRef:
      name: platform-default-mq-conn
      namespace: cpaas-system
  aggregateVector:
    replicas: 1                                     # Kafka→CH ingest tier; raise to 3+ for production throughput
  razor:
    replicas: 1                                     # query-plane serving tier; raise for heavier query load
    resources:
      limits:
        cpu: "4"
        memory: 2Gi
      requests:
        cpu: "1"
        memory: 512Mi

apiVersion: log.alauda.io/v1alpha1
kind: PlatformLogForward
metadata:
  name: platform-default                            # fixed singleton name; do not change
spec:
  # No `output.type` on OpenSearch — `externalStorage.type` is the source of
  # truth for backend routing (added in pt L, 2026-08). The ClickHouse branch
  # predates that refactor and its admission + provisioning paths still read
  # `output.type: clickhouse`; the OpenSearch branch was added after and never
  # inherited that legacy field. Setting `output.type: clickhouse` on an
  # OpenSearch PLF is accepted but ignored — the scenario is still routed
  # by `externalStorage.type`.
  externalStorage:
    type: opensearch
    shards: 1                                       # informational on the OS branch; keep as 1
    replicas: 1                                     # informational on the OS branch; keep as 1
    secretRef:
      name: platform-default-os-conn
      namespace: cpaas-system
  externalMessageQueue:
    type: kafka
    secretRef:
      name: platform-default-mq-conn
      namespace: cpaas-system
  aggregateVector:
    replicas: 1                                     # Kafka→OS ingest tier; raise to 3+ for production throughput
  razor:
    replicas: 1                                     # query-plane serving tier; raise for heavier query load
    resources:
      limits:
        cpu: "4"
        memory: 2Gi
      requests:
        cpu: "1"
        memory: 512Mi

apiVersion: cluster.alauda.io/v1alpha1
kind: ModuleInfo
metadata:
  annotations:
    cpaas.io/display-name: logagent
    cpaas.io/module-name: '{"en": "Alauda Container Platform Log Collector", "zh": "Alauda Container Platform Log Collector"}'
  labels:
    cpaas.io/cluster-name: <collector-cluster>
    cpaas.io/module-name: logagent
    cpaas.io/module-type: plugin
    cpaas.io/product: Platform-Center
  name: <collector-cluster>-logagent
spec:
  version: v4.4.0                                   # substitute the version reported by ModuleConfig
  config:
    crossClusterDependency:
      logstorage: <storage-cluster>                 # cluster where PlatformLogForward is Ready
    dataSource:
      audit: true
      event: true
      kubernetes: false
      platform: false
      system: true
      workload: true
    components:
      nevermore:
        storageSpec:
          dataDir: /cpaas/data/nevermore            # on Alauda OS: /var/cpaas/data/nevermore
    storage:
      type: Standard                                # v4.4 data path via log-storage-operator

apiVersion: cluster.alauda.io/v1alpha1
kind: ModuleInfo
metadata:
  annotations:
    cpaas.io/display-name: log-api
    cpaas.io/module-name: '{"en": "Alauda Container Platform Log Essentials", "zh": "Alauda Container Platform Log Essentials"}'
  labels:
    cpaas.io/cluster-name: global
    cpaas.io/module-name: log-api
    cpaas.io/module-type: plugin
    cpaas.io/product: Platform-Center
  name: global-log-api
spec:
  version: v4.4.0                                   # substitute the version reported by ModuleConfig