# Pulls the web server's journal every 15 minutes and hands it to Vector.
# On www.azit.se, the key can only run /usr/local/sbin/logpull-journal (see homelab-site, deploy/DEPLOY.md);
# the server has no way to connect here.
apiVersion: v1
kind: Service
metadata:
  name: www-logpull-in
  namespace: logging
spec:
  type: ClusterIP                 # inside the cluster only, unlike Vector's syslog LoadBalancer
  selector:
    app.kubernetes.io/instance: vector
    app.kubernetes.io/component: Stateless-Aggregator
  ports:
    - name: www-pull
      port: 8090
      targetPort: 8090
      protocol: TCP
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: www-logpull
  namespace: logging
spec:
  schedule: "*/15 * * * *"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 1
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      backoffLimit: 0             # no blind retry: the next run picks up from the server's cursor
      activeDeadlineSeconds: 600
      template:
        spec:
          restartPolicy: Never
          automountServiceAccountToken: false
          securityContext:
            seccompProfile: { type: RuntimeDefault }
          volumes:
            - name: keys
              secret: { secretName: www-logpull, defaultMode: 0400 }
          containers:
            - name: pull
              image: alpine:3.22
              securityContext: { allowPrivilegeEscalation: false }
              resources:
                requests: { cpu: 10m, memory: 32Mi }
                limits:   { cpu: 500m, memory: 128Mi }
              volumeMounts:
                - { name: keys, mountPath: /keys, readOnly: true }
              command: ["/bin/sh", "-euc"]
              args:
                - |
                  apk add --no-cache --quiet openssh-client-default curl
                  ssh -T -i /keys/id_ed25519 -o IdentitiesOnly=yes -o BatchMode=yes \
                      -o UserKnownHostsFile=/keys/known_hosts -o StrictHostKeyChecking=yes \
                      -o ConnectTimeout=20 logpull@www.azit.se > /tmp/batch.jsonl
                  echo "pulled $(wc -l < /tmp/batch.jsonl) entries"
                  [ -s /tmp/batch.jsonl ] || exit 0
                  curl -sS --fail --retry 5 --retry-all-errors --retry-delay 10 \
                       -H 'Content-Type: application/x-ndjson' --data-binary @/tmp/batch.jsonl \
                       http://www-logpull-in.logging.svc:8090/
                  echo "handed to Vector"