Stéphane Tailland
9a889127ca
Point OTEL_TRACES_ENDPOINT at Tempo instead of Jaeger. The variable is a cluster-wide default, so this moves all five domains at once; Jaeger stays deployed but no longer receives anything. Tempo derives RED span metrics and the service graph from these traces on its own, and its trace ids correlate with the audit logs below. Add a Loki output to the audit collector. Kong's http-log payload is a JSON object per request and Loki has no endpoint that accepts it, so Fluent Bit is the translator between the two formats. The `domain` label comes from $TAG, which the http input derives from the request URI. That makes the path a domain posts to its identity here, so one output block covers every domain and onboarding the next one is a single AUDIT_LOG_ENDPOINT change on its side rather than another block. The file output stays on Match * so the on-disk audit trail continues for every domain, which keeps the switch reversible. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
27 lines
1.4 KiB
YAML
27 lines
1.4 KiB
YAML
# Cluster-wide defaults for the dataplane-template ${VAR}s. NOT part of
|
|
# dataplane-template/ itself (that folder is what gets built+applied once
|
|
# per domain into its own namespace — this ConfigMap is applied once,
|
|
# cluster-wide, in flux-system). Each domain's Kustomization lists this
|
|
# FIRST in postBuild.substituteFrom, then its own ConfigMap/Secret after —
|
|
# Flux applies "last wins" precedence across substituteFrom entries, so a
|
|
# domain can still override any of these if it ever needs to.
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: dataplane-template-defaults
|
|
namespace: flux-system
|
|
data:
|
|
KONNECT_SERVER_URL: eu.api.konghq.com
|
|
GATEWAY_IMAGE: kong/kong-gateway:3.15
|
|
REPLICAS: "1"
|
|
OIDC_ISSUER: https://keycloak.sttlab.eu/realms/sttlab # Keycloak today, but this template shouldn't assume it stays that way
|
|
CORS_ORIGINS: https://*.sttlab.local
|
|
RATE_LIMIT_MINUTE: "300"
|
|
REQUEST_MAX_BODY_SIZE: "10" # MB
|
|
# Tempo (OTLP-native), ns observability, cluster-wide — shared by every
|
|
# domain, not domain-specific. Replaced Jaeger on 2026-08-25: Tempo is the
|
|
# trace backend of the infra-observability stack, so its span metrics feed
|
|
# Prometheus and its traces correlate with the Loki logs from the same
|
|
# requests. Jaeger is still deployed but no longer receives anything.
|
|
OTEL_TRACES_ENDPOINT: http://tempo.observability.svc.cluster.local:4318/v1/traces
|