feat: infra - remove openobserve, add loki

2026-07-16 17:41:09 +02:00 · 2025-06-08 14:18:23 +08:00
parent 77ed0378d1
commit e12afe7cea
11 changed files with 139 additions and 105 deletions
@@ -0,0 +1,90 @@
+# ==============================================
+# Buckets
+# ==============================================
+
+resource "minio_s3_bucket" "k3s-test-1-loki-chunks" {
+  bucket = "k3s-test-1-loki-chunks"
+  acl    = "private"
+}
+
+resource "minio_s3_bucket" "k3s-test-1-loki-ruler" {
+  bucket = "k3s-test-1-loki-ruler"
+  acl    = "private"
+}
+
+resource "minio_s3_bucket" "k3s-test-1-loki-admin" {
+  bucket = "k3s-test-1-loki-admin"
+  acl    = "private"
+}
+
+# ==============================================
+# User & Permission
+# ==============================================
+
+
+resource "minio_iam_user" "loki" {
+  name          = "loki"
+  force_destroy = true
+  tags = {
+    env       = "prod"
+    managedBy = "terraform"
+  }
+}
+
+resource "minio_iam_service_account" "loki" {
+  target_user = minio_iam_user.loki.name
+}
+
+resource "minio_iam_policy" "loki" {
+  name   = "loki"
+  policy = <<EOF
+{
+  "Version":"2012-10-17",
+  "Statement": [
+    {
+      "Sid": "ObjectFullAccess",
+      "Action": [
+        "s3:PutObject",
+        "s3:GetObject",
+        "s3:ListBucket",
+        "s3:DeleteObject"
+      ],
+      "Effect": "Allow",
+      "Resource": [
+        "arn:aws:s3:::k3s-test-1-loki-chunks/*",
+        "arn:aws:s3:::k3s-test-1-loki-ruler/*",
+        "arn:aws:s3:::k3s-test-1-loki-admin/*"
+      ]
+    }
+  ]
+}
+EOF
+}
+
+resource "minio_iam_user_policy_attachment" "loki-1" {
+  user_name   = minio_iam_user.loki.id
+  policy_name = minio_iam_policy.loki.id
+}
+
+# ======================================================
+
+output "loki-chunks_url" {
+  value = minio_s3_bucket.k3s-test-1-loki-chunks.bucket_domain_name
+}
+
+output "loki-ruler_url" {
+  value = minio_s3_bucket.k3s-test-1-loki-ruler.bucket_domain_name
+}
+
+output "loki-admin_url" {
+  value = minio_s3_bucket.k3s-test-1-loki-admin.bucket_domain_name
+}
+
+output "loki_accesskey" {
+  value = minio_iam_service_account.loki.access_key
+}
+
+output "loki_secretkey" {
+  value     = minio_iam_service_account.loki.secret_key
+  sensitive = true
+}