AWS EKS (Tokyo Region) 部署 VictoriaTraces Cluster 跨 AZ 高可用與資料複寫安全實戰指南 ¶

# 01-storageclass-ebs-gp3-encrypted.yaml
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: ebs-gp3-tokyo-encrypted
provisioner: ebs.csi.aws.com
volumeBindingMode: WaitForFirstConsumer
allowVolumeExpansion: true
reclaimPolicy: Retain
parameters:
  type: gp3
  fsType: ext4
  encrypted: "true"
  # （選用）指定東京區域自管 KMS CMK ARN
  # kmsKeyId: "arn:aws:kms:ap-northeast-1:123456789012:key/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  iops: "6000"
  throughput: "250"

# 02-vtcluster-multi-az.yaml
apiVersion: operator.victoriametrics.com/v1beta1
kind: VTCluster
metadata:
  name: vt-tokyo-aza
  namespace: tracing
spec:
  retentionPeriod: "14d"
  # 1. 無狀態 OTLP 寫入層 (鎖定於 ap-northeast-1a)
  vtinsert:
    replicaCount: 2
    nodeSelector:
      topology.kubernetes.io/zone: ap-northeast-1a
    resources:
      requests:
        cpu: "500m"
        memory: "1Gi"
      limits:
        cpu: "2"
        memory: "4Gi"

  # 2. 有狀態鏈路儲存層 (分片落盤於 ap-northeast-1a 加密 EBS gp3)
  vtstorage:
    replicaCount: 2
    nodeSelector:
      topology.kubernetes.io/zone: ap-northeast-1a
    # 強制同 AZ 內不同 vtstorage 分片分散於不同 EC2 實體節點
    affinity:
      podAntiAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchLabels:
                app.kubernetes.io/name: vtstorage
                app.kubernetes.io/instance: vt-tokyo-aza
            topologyKey: kubernetes.io/hostname
    storageDataPath: "/vtstorage-data"
    storage:
      volumeClaimTemplate:
        spec:
          storageClassName: ebs-gp3-tokyo-encrypted
          accessModes: ["ReadWriteOnce"]
          resources:
            requests:
              storage: 300Gi
    resources:
      requests:
        cpu: "1"
        memory: "4Gi"
      limits:
        cpu: "4"
        memory: "12Gi"

  # 3. 無狀態查詢層 (提供 Jaeger Query API 與 VMUI)
  vtselect:
    replicaCount: 2
    nodeSelector:
      topology.kubernetes.io/zone: ap-northeast-1a
    resources:
      requests:
        cpu: "500m"
        memory: "2Gi"
      limits:
        cpu: "2"
        memory: "6Gi"
---
apiVersion: operator.victoriametrics.com/v1beta1
kind: VTCluster
metadata:
  name: vt-tokyo-azc
  namespace: tracing
spec:
  retentionPeriod: "14d"
  # 鏡像災備叢集完整部署於 ap-northeast-1c
  vtinsert:
    replicaCount: 2
    nodeSelector:
      topology.kubernetes.io/zone: ap-northeast-1c
    resources:
      requests:
        cpu: "500m"
        memory: "1Gi"
      limits:
        cpu: "2"
        memory: "4Gi"

  vtstorage:
    replicaCount: 2
    nodeSelector:
      topology.kubernetes.io/zone: ap-northeast-1c
    affinity:
      podAntiAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchLabels:
                app.kubernetes.io/name: vtstorage
                app.kubernetes.io/instance: vt-tokyo-azc
            topologyKey: kubernetes.io/hostname
    storageDataPath: "/vtstorage-data"
    storage:
      volumeClaimTemplate:
        spec:
          storageClassName: ebs-gp3-tokyo-encrypted
          accessModes: ["ReadWriteOnce"]
          resources:
            requests:
              storage: 300Gi
    resources:
      requests:
        cpu: "1"
        memory: "4Gi"
      limits:
        cpu: "4"
        memory: "12Gi"

  vtselect:
    replicaCount: 2
    nodeSelector:
      topology.kubernetes.io/zone: ap-northeast-1c
    resources:
      requests:
        cpu: "500m"
        memory: "2Gi"
      limits:
        cpu: "2"
        memory: "6Gi"

# 04-vmauth-traces-gateway.yaml
apiVersion: v1
kind: Secret
metadata:
  name: vmauth-vt-config
  namespace: tracing
stringData:
  config.yml: |
    users:
      - username: "grafana-traces-reader"
        password: "${GRAFANA_TRACES_PASSWORD}"
        url_map:
          - src_paths:
              - "/select/.*"
            # 主備叢集自動 Failover (埠 10471 為 vtselect 服務埠)
            url_prefix:
              - "http://vtselect-vt-tokyo-aza.tracing.svc.cluster.local:10471"
              - "http://vtselect-vt-tokyo-azc.tracing.svc.cluster.local:10471"
            load_balancing_policy: first_available
            retry_status_codes: [500, 502, 503, 504]

# values-tokyo-traces-single-cluster.yaml
vtstorage:
  replicaCount: 6 # 橫跨 1a, 1c, 1d 每個 AZ 各部署 2 個分片節點
  retentionPeriod: "14d"
  retentionMaxDiskSpaceUsageBytes: "250GiB" # 預留 15% 空間供 LSM-Tree Compaction
  persistentVolume:
    enabled: true
    size: 300Gi
    storageClassName: "ebs-gp3-tokyo-encrypted"
  topologySpreadConstraints:
    - maxSkew: 1
      topologyKey: topology.kubernetes.io/zone
      whenUnsatisfiable: DoNotSchedule
      labelSelector:
        matchLabels:
          app.kubernetes.io/name: victoria-traces-cluster
          app.kubernetes.io/component: vtstorage
  podDisruptionBudget:
    enabled: true
    maxUnavailable: 1

vtinsert:
  replicaCount: 3
  topologySpreadConstraints:
    - maxSkew: 1
      topologyKey: topology.kubernetes.io/zone
      whenUnsatisfiable: DoNotSchedule
      labelSelector:
        matchLabels:
          app.kubernetes.io/name: victoria-traces-cluster
          app.kubernetes.io/component: vtinsert

vtselect:
  replicaCount: 3
  topologySpreadConstraints:
    - maxSkew: 1
      topologyKey: topology.kubernetes.io/zone
      whenUnsatisfiable: DoNotSchedule
      labelSelector:
        matchLabels:
          app.kubernetes.io/name: victoria-traces-cluster
          app.kubernetes.io/component: vtselect

vmauth:
  enabled: true
  replicaCount: 3