在 Linux x86_64 上创建一个 ClickHouseKeeper 数据存储

确保满足下列先决条件：

• 在线或离线主机准备从外部存储库中提取图像。
• 已添加Helm软件源。

有关详细信息，请参阅 “准备安装数据存储操作员 ”。

销钉式Helm图或操作员版本需要以下图像。

要在线安装ClickHouse-keeper，请完成以下步骤。

1. 检查群集中是否存在 "instana-clickhouse命名空间。 如果不存在，您可以现在创建。

   1. 检查 "instana-clickhouse命名空间是否存在。

      kubectl get namespace | grep clickhouse

   2. 如果 "instana-clickhouse命名空间不存在，请立即创建。

      kubectl create namespace instana-clickhouse

   3. 创建 clickhousekeeper 服务账户。

      kubectl create serviceaccount clickhousekeeper -n instana-clickhouse

2. 为ClickHouse图像创建图像提取秘密。 将 "<download_key>替换为您自己的下载密钥。

   kubectl create secret docker-registry instana-registry \
   --namespace=instana-clickhouse \
   --docker-username=_ \
   --docker-password=<download_key> \
   --docker-server=artifact-public.instana.io
    

3. 如果您使用的是 Red Hat® OpenShift® 集群，请在部署 ClickHouse 操作员之前创建安全上下文约束（SCC）。 创建一个名为 YAML 的文件，例如 clickhouse-scc.yaml，其中包含 SecurityContextConstraints （SCC）的定义。

   apiVersion: security.openshift.io/v1
   kind: SecurityContextConstraints
   metadata:
     name: clickhouse-scc
   runAsUser:
     type: MustRunAs
     uid: 1001
   seLinuxContext:
     type: RunAsAny
   fsGroup:
     type: RunAsAny
   allowHostDirVolumePlugin: false
   allowHostNetwork: true
   allowHostPorts: true
   allowPrivilegedContainer: false
   allowHostIPC: true
   allowHostPID: true
   readOnlyRootFilesystem: false
   users:
     - system:serviceaccount:instana-clickhouse:clickhouse-operator
     - system:serviceaccount:instana-clickhouse:clickhouse-operator-ibm-clickhouse-operator
     - system:serviceaccount:instana-clickhouse:clickhouse
     - system:serviceaccount:instana-clickhouse:clickhousekeeper
    

4. 创建 SCC 资源。

   kubectl apply -f clickhouse-scc.yaml
    

5. 安装ClickHouse操作器。

   helm install clickhouse-operator instana/ibm-clickhouse-operator -n instana-clickhouse --version=v1.2.0 --set operator.image.repository=artifact-public.instana.io/clickhouse-operator --set operator.image.tag=v1.2.39 --set imagePullSecrets[0].name="instana-registry"
    

6. 创建一个名为 YAML 的文件，例如 clickhouse_keeper.yaml，其中包含资源 ClickHouseKeeperInstallation 定义。

   apiVersion: "clickhouse-keeper.altinity.com/v1"
   kind: "ClickHouseKeeperInstallation"
   metadata:
     name: clickhouse-keeper
     namespace: instana-clickhouse
   spec:
     configuration:
       clusters:
         - name: "local"
           layout:
             replicasCount: 3
       settings:
           logger/level: "information"
           logger/console: "true"
           listen_host: "0.0.0.0"
           keeper_server/snapshot_storage_path: /var/lib/clickhouse-keeper/coordination/snapshots/store
           keeper_server/log_storage_path: /var/lib/clickhouse-keeper/coordination/logs/store
           keeper_server/storage_path: /var/lib/clickhouse-keeper/
           keeper_server/tcp_port: "2181"
           keeper_server/four_letter_word_white_list: "*"
           keeper_server/coordination_settings/raft_logs_level: "information"
           keeper_server/raft_configuration/server/port: "9444"
           prometheus/endpoint: "/metrics"
           prometheus/port: "7000"
           prometheus/metrics: "true"
           prometheus/events: "true"
           prometheus/asynchronous_metrics: "true"
           prometheus/status_info: "false"
           zookeeper/node/host: "localhost"
           zookeeper/node/port: "9181"
     templates:
       podTemplates:
         - name: clickhouse-keeper
           spec:
             # Add the following Affinity snippet to schedule each pod on a different node. 
             # affinity:
             #   podAntiAffinity:
             #     requiredDuringSchedulingIgnoredDuringExecution:
             #       - labelSelector:
             #           matchLabels:
             #             app: clickhouse-keeper
             #         topologyKey: "kubernetes.io/hostname"
             containers:
               - name: clickhouse-keeper
                 imagePullPolicy: IfNotPresent
                 image: artifact-public.instana.io/clickhouse:25.8.13.73-7-lts-ibm
                 command:
                   - clickhouse-keeper
                   - --config-file=/etc/clickhouse-keeper/keeper_config.xml
                 resources:
                   requests:
                     memory: "1Gi"
             serviceAccountName: clickhousekeeper
             imagePullSecrets:
               - name: instana-registry
             securityContext:
               fsGroup: 0
               runAsGroup: 0
               runAsUser: 1001
             initContainers:
               - name: server-id-injector
                 imagePullPolicy: IfNotPresent
                 image:  artifact-public.instana.io/clickhouse:25.8.13.73-7-lts-ibm
       volumeClaimTemplates:
         - name: log-storage-path
           spec:
             storageClassName: <storage_class_name>
             accessModes:
               - ReadWriteOnce
             resources:
               requests:
                 storage: 20Gi
         - name: snapshot-storage-path
           spec:
             storageClassName: <storage_class_name>
             accessModes:
               - ReadWriteOnce
             resources:
               requests:
                 storage: 20Gi
    

7. 完成部署和验证 ClickHousekeeper （联机和脱机） 中的步骤。

将ClickHouse操作器安装在有气隙的环境中。

如果在准备安装时没有从外部注册表中提取ClickHouse映像，现在可以提取。 在 bastion 主机上运行以下命令 然后，将这些图像复制到位于物理隔离环境中的 Instana 主机上。

docker pull artifact-public.instana.io/clickhouse-operator:v1.2.39
docker pull artifact-public.instana.io/clickhouse:25.8.13.73-7-lts-ibm
         

要在物理隔离环境中安装 ClickHouse 操作员，请在您的 Instana 主机上完成以下步骤。

1. 将图像重新标记到内部图像注册表。

   docker tag artifact-public.instana.io/clickhouse-operator:v1.2.39 <internal-image-registry>/clickhouse-operator:v1.2.39
   docker tag artifact-public.instana.io/clickhouse:25.8.13.73-7-lts-ibm <internal-image-registry>/clickhouse:25.8.13.73-7-lts-ibm
                  

2. 将图像推送到内部图像注册表。

   docker push <internal-image-registry>/clickhouse-operator:v1.2.39
   docker push <internal-image-registry>/clickhouse:25.8.13.73-7-lts-ibm
                  

3. 创建一个名为 YAML 的文件，例如 clickhouse-scc.yaml，其中包含 SecurityContextConstraints （SCC）的定义。

   apiVersion: security.openshift.io/v1
   kind: SecurityContextConstraints
   metadata:
     name: clickhouse-scc
   runAsUser:
     type: MustRunAs
     uid: 1001
   seLinuxContext:
     type: RunAsAny
   fsGroup:
     type: RunAsAny
   allowHostDirVolumePlugin: false
   allowHostNetwork: true
   allowHostPorts: true
   allowPrivilegedContainer: false
   allowHostIPC: true
   allowHostPID: true
   readOnlyRootFilesystem: false
   users:
     - system:serviceaccount:instana-clickhouse:clickhouse-operator
     - system:serviceaccount:instana-clickhouse:clickhouse-operator-ibm-clickhouse-operator
     - system:serviceaccount:instana-clickhouse:clickhouse
     - system:serviceaccount:instana-clickhouse:clickhousekeeper
    

4. 创建 SCC 资源。

   kubectl apply -f clickhouse-scc.yaml
    

5. 检查群集中是否存在 "instana-clickhouse命名空间。 如果不存在，您可以现在创建。

   1. 检查 "instana-clickhouse命名空间是否存在。

      kubectl get namespace | grep clickhouse
       

   2. 如果 "instana-clickhouse命名空间不存在，请立即创建。

      kubectl create namespace instana-clickhouse
       

   3. 创建服务 clickhousekeeper 账户。

   kubectl create serviceaccount clickhousekeeper  -n instana-clickhouse
    

6. 如果您的内部图像注册表需要身份验证，请创建图像拉取密钥。

   kubectl create secret docker-registry <secret_name> --namespace instana-clickhouse \
   --docker-username=<registry_username> \
   --docker-password=<registry_password> \
   --docker-server=<internal-image-registry>:<internal-image-registry-port> \
   --docker-email=<registry_email>
    

7. 安装ClickHouse操作器。 如果在上一步中创建了图像提取密钥，请在以下命令中添加 --set imagePullSecrets[0].name="<internal-image-registry-pull-secret>" 。

   helm install clickhouse-operator ibm-clickhouse-operator-v1.2.0.tgz -n instana-clickhouse --version=v1.2.0 --set operator.image.repository=<internal-image-registry>/clickhouse-operator --set operator.image.tag=v1.2.39
                  

8. 创建一个名为 YAML 的文件，例如 clickhouse_keeper.yaml，其中包含资源 "ClickHouseKeeperInstallation 定义。

    apiVersion: "clickhouse-keeper.altinity.com/v1"
    kind: "ClickHouseKeeperInstallation"
    metadata:
      name: clickhouse-keeper
      namespace: instana-clickhouse
    spec:
      configuration:
        clusters:
          - name: "local"
            layout:
              replicasCount: 3
        settings:
            logger/level: "information"
            logger/console: "true"
            listen_host: "0.0.0.0"
            keeper_server/snapshot_storage_path: /var/lib/clickhouse-keeper/coordination/snapshots/store
            keeper_server/log_storage_path: /var/lib/clickhouse-keeper/coordination/logs/store
            keeper_server/storage_path: /var/lib/clickhouse-keeper/
            keeper_server/tcp_port: "2181"
            keeper_server/four_letter_word_white_list: "*"
            keeper_server/coordination_settings/raft_logs_level: "information"
            keeper_server/raft_configuration/server/port: "9444"
            prometheus/endpoint: "/metrics"
            prometheus/port: "7000"
            prometheus/metrics: "true"
            prometheus/events: "true"
            prometheus/asynchronous_metrics: "true"
            prometheus/status_info: "false"
            zookeeper/node/host: "localhost"
            zookeeper/node/port: "9181"
      templates:
        podTemplates:
          - name: clickhouse-keeper
            spec:
              # Add the following Affinity snippet to schedule each pod on a different node. 
              # affinity:
              #   podAntiAffinity:
              #     requiredDuringSchedulingIgnoredDuringExecution:
              #       - labelSelector:
              #           matchLabels:
              #             app: clickhouse-keeper
              #         topologyKey: "kubernetes.io/hostname"
              containers:
                - name: clickhouse-keeper
                  imagePullPolicy: IfNotPresent
                  image:  <internal-image-registry>/clickhouse:25.8.13.73-7-lts-ibm
                  command:
                    - clickhouse-keeper
                    - --config-file=/etc/clickhouse-keeper/keeper_config.xml
                  resources:
                    requests:
                      memory: "1Gi"
                # Optional: if you created an image pull secret for your internal registry, uncomment the following lines and update the image pull secret information.
                # imagePullSecrets:
                #   - name: <internal-image-registry-pull-secret>
              serviceAccountName: clickhousekeeper
              securityContext:
                fsGroup: 0
                runAsGroup: 0
                runAsUser: 1001
              initContainers:
                - name: server-id-injector
                  imagePullPolicy: IfNotPresent
                  image:  <internal-image-registry>/clickhouse:25.8.13.73-7-lts-ibm
        volumeClaimTemplates:
          - name: log-storage-path
            spec:
              storageClassName: <storage_class_name>
              accessModes:
                - ReadWriteOnce
              resources:
                requests:
                  storage: 20Gi
          - name: snapshot-storage-path
            spec:
              storageClassName: <storage_class_name>
              accessModes:
                - ReadWriteOnce
              resources:
                requests:
                  storage: 20Gi
    

9. 完成部署和验证ClickHouseKeeper（联机和脱机）中的步骤。

要部署ClickHouseKeeper实例并创建数据存储，请完成以下步骤。

1. 部署ClickHouseKeeper。

   kubectl apply -f clickhouse_keeper.yaml -n instana-clickhouse
    

2. 验证ClickHouse操作员和ClickhouseKeeper的部署。

   kubectl get all -n instana-clickhouse
    

   如果ClickHouse操作员部署成功，命令输出将显示操作员状态为 "Running，如下例所示：

    NAME                                                               READY   STATUS    RESTARTS   AGE
    pod/clickhouse-keeper-0                                            1/1     Running   0          2d7h
    pod/clickhouse-keeper-1                                            1/1     Running   0          2d8h
    pod/clickhouse-keeper-2                                            1/1     Running   0          2d8h
    pod/clickhouse-operator-ibm-clickhouse-operator-7754679687-bpwlx   1/1     Running   0          2d8h
   
    NAME                                                          TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)                      AGE
    service/clickhouse-keeper                                     ClusterIP   172.30.115.37    <none>        2181/TCP,7000/TCP            13d
    service/clickhouse-keeper-headless                            ClusterIP   None             <none>        9444/TCP                     13d
   
    NAME                                                          READY   UP-TO-DATE   AVAILABLE   AGE
    deployment.apps/clickhouse-operator-ibm-clickhouse-operator   1/1     1            1           79d
   
    NAME                                                                     DESIRED   CURRENT   READY   AGE
    replicaset.apps/clickhouse-operator-ibm-clickhouse-operator-7754679687   1         1         1       79d
   
    NAME                                     READY   AGE
    statefulset.apps/clickhouse-keeper       3/3     13d