Files
panxiao81 834f654941
yaml / yaml (push) Successful in 35s
terraform / validate (push) Successful in 1m43s
ansible / collection-test (push) Successful in 1m55s
ansible / lint (push) Successful in 2m48s
接入 OpenBao 受鉴权监控并修复快照续期 (#162)
Co-authored-by: panxiao81 <[email protected]>
2026-09-25 20:39:31 +00:00

93 lines
2.0 KiB
YAML

apiVersion: operator.victoriametrics.com/v1beta1
kind: VMAgent
metadata:
name: main
namespace: monitoring
spec:
replicaCount: 1
selectAllByDefault: true
scrapeInterval: 30s
remoteWrite:
- url: http://vmsingle-main.monitoring.svc:8428/api/v1/write
resources:
requests:
cpu: 100m
memory: 256Mi
limits:
cpu: '1'
memory: 1Gi
volumes:
- name: bao-agent-config
configMap:
name: bao-metrics-agent
- name: bao-metrics-token
emptyDir:
medium: Memory
- name: bao-metrics-jwt
projected:
sources:
- serviceAccountToken:
path: token
expirationSeconds: 3600
volumeMounts:
- name: bao-metrics-token
mountPath: /var/run/bao-metrics
readOnly: true
containers:
- name: bao-metrics-agent
image: quay.io/openbao/openbao:2.6.1
command:
- bao
args:
- agent
- -config=/etc/bao-agent/config.hcl
env:
- name: HOME
value: /tmp
securityContext:
runAsNonRoot: true
runAsUser: 65534
runAsGroup: 65534
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
drop:
- ALL
resources:
requests:
cpu: 10m
memory: 32Mi
limits:
cpu: 100m
memory: 128Mi
volumeMounts:
- name: bao-agent-config
mountPath: /etc/bao-agent
readOnly: true
- name: bao-metrics-token
mountPath: /var/run/bao-metrics
- name: bao-metrics-jwt
mountPath: /var/run/bao-jwt
readOnly: true
securityContext:
fsGroup: 65534
initContainers:
- name: prepare-bao-token-file
image: quay.io/openbao/openbao:2.6.1
command:
- sh
- -ec
- 'umask 0022; : > /var/run/bao-metrics/token'
securityContext:
runAsNonRoot: true
runAsUser: 65534
runAsGroup: 65534
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
drop:
- ALL
volumeMounts:
- name: bao-metrics-token
mountPath: /var/run/bao-metrics