feat: complete Loki query, insights, settings and deployment workflows

Add the Loki query UI, access policies, ingress insights, alert and registry settings, and their backend APIs. Include the related Kubernetes deployment and collector updates required by the integrated application. Validated with go test ./..., npm run build, and npm run lint.
2026-10-25 21:28:32 +08:00
1 parent f9c6c1d826
commit 2d73661dd1
@@ -12,360 +12,34 @@ import (
 	"io"
 	"net/http"
 	"net/url"
-	"os/exec"
-	"regexp"
 	"sort"
 	"strconv"
 	"strings"
 	"time"

 	"opsxloki/models"
-	"opsxloki/pkg/crypto"
 	"opsxloki/repository"
+	"k8s.io/client-go/rest"
 )

 const maxLogQueryLimit = 1000
+const logQueryTimeout = 120 * time.Second

-// ==================== 数据源 CRUD ====================
-
-func GetLogSource(id uint) *models.LogSource {
-	db := repository.GetDB()
-	db.RLock()
-	defer db.RUnlock()
-	for i := range db.LogSources {
-		if db.LogSources[i].ID == id {
-			s := db.LogSources[i]
-			return &s
-		}
-	}
-	return nil
+var lokiHTTPClients = [2]*http.Client{
+	{Timeout: logQueryTimeout, Transport: newLokiTransport(false)},
+	{Timeout: logQueryTimeout, Transport: newLokiTransport(true)},
 }

-func ListLogSources() []map[string]interface{} {
-	db := repository.GetDB()
-	db.RLock()
-	defer db.RUnlock()
-	out := make([]map[string]interface{}, 0, len(db.LogSources))
-	for i := range db.LogSources {
-		out = append(out, db.LogSources[i].Sanitized())
-	}
-	return out
-}
-
-func ListVisibleLogSources(userID uint, admin bool) []map[string]interface{} {
-	db := repository.GetDB()
-	db.RLock()
-	defer db.RUnlock()
-	out := make([]map[string]interface{}, 0)
-	for i := range db.LogSources {
-		s := &db.LogSources[i]
-		if admin || policyGroupAccess(db.LogPolicyGroups, s.ID, userID) != nil || sourceAccess(s, userID) != nil {
-			item := s.Sanitized()
-			if !admin {
-				item = map[string]interface{}{"id": s.ID, "name": s.Name, "isDefault": s.IsDefault}
-			}
-			out = append(out, item)
-		}
-	}
-	return out
-}
-
-func sourceAccess(src *models.LogSource, userID uint) *models.LogSourceAccess {
-	for i := range src.Access {
-		if src.Access[i].UserID == userID {
-			return &src.Access[i]
-		}
-	}
-	return nil
-}
-
-var labelNamePattern = regexp.MustCompile(`^[a-zA-Z_][a-zA-Z0-9_]*$`)
-
-func ValidLogLabelName(name string) bool { return labelNamePattern.MatchString(name) }
-
-// AuthorizedLogQuery constrains the Loki stream selector server-side. Non-admins must be explicitly granted access.
-func AuthorizedLogQuery(src *models.LogSource, userID uint, admin bool, query string) (string, error) {
-	if admin {
-		return query, nil
-	}
-	db := repository.GetDB()
-	var access *models.LogSourceAccess
-	if db != nil {
-		db.RLock()
-		access = policyGroupAccess(db.LogPolicyGroups, src.ID, userID)
-		db.RUnlock()
-	}
-	if access == nil {
-		access = sourceAccess(src, userID)
-	}
-	if access == nil {
-		return "", fmt.Errorf("无权查询此数据源")
-	}
-	q := strings.TrimSpace(query)
-	if !strings.HasPrefix(q, "{") {
-		return "", fmt.Errorf("普通用户查询必须以日志流选择器开头")
-	}
-	close := strings.IndexByte(q, '}')
-	if close < 0 || strings.Contains(q[close+1:], "{") {
-		return "", fmt.Errorf("查询只能包含一个日志流选择器")
-	}
-	if len(access.Labels) == 0 {
-		return q, nil
-	}
-	keys := make([]string, 0, len(access.Labels))
-	for k := range access.Labels {
-		if !labelNamePattern.MatchString(k) {
-			return "", fmt.Errorf("访问策略包含无效标签名")
-		}
-		keys = append(keys, k)
-	}
-	sort.Strings(keys)
-	matchers := make([]string, 0, len(keys))
-	for _, k := range keys {
-		v, _ := json.Marshal(access.Labels[k])
-		matchers = append(matchers, k+"="+string(v))
-	}
-	inner := strings.TrimSpace(q[1:close])
-	if inner != "" {
-		inner += ","
-	}
-	return "{" + inner + strings.Join(matchers, ",") + "}" + q[close+1:], nil
-}
-
-func CreateLogSource(s *models.LogSource) (*models.LogSource, error) {
-	if err := encryptSourceCredentials(s); err != nil {
-		return nil, err
-	}
-	db := repository.GetDB()
-	newID := db.NextID("logSources")
-	db.Lock()
-	defer db.Unlock()
-	s.ID = newID
-	if s.IsDefault {
-		for i := range db.LogSources {
-			db.LogSources[i].IsDefault = false
-		}
-	}
-	// 首个数据源自动设默认
-	if len(db.LogSources) == 0 {
-		s.IsDefault = true
-	}
-	db.LogSources = append(db.LogSources, *s)
-	db.RequestSave()
-	return s, nil
-}
-
-func encryptSourceCredentials(s *models.LogSource) error {
-	if s.BasicPass != "" {
-		v, err := crypto.EncryptField(s.BasicPass)
-		if err != nil {
-			return err
-		}
-		s.BasicPass = v
-	}
-	if s.BearerToken != "" {
-		v, err := crypto.EncryptField(s.BearerToken)
-		if err != nil {
-			return err
-		}
-		s.BearerToken = v
-	}
-	for name, value := range s.Headers {
-		if !validSourceHeader(name) {
-			return fmt.Errorf("自定义 Header 名称无效: %s", name)
-		}
-		v, err := crypto.EncryptField(value)
-		if err != nil {
-			return err
-		}
-		s.Headers[name] = v
-	}
-	return nil
-}
-
-func validSourceHeader(name string) bool {
-	if name == "" || strings.EqualFold(name, "Host") || strings.EqualFold(name, "Authorization") {
-		return false
-	}
-	for _, c := range name {
-		if !(c >= 'a' && c <= 'z' || c >= 'A' && c <= 'Z' || c >= '0' && c <= '9' || c == '-') {
-			return false
-		}
-	}
-	return true
-}
-
-func UpdateLogSource(id uint, patch map[string]interface{}) error {
-	db := repository.GetDB()
-	db.Lock()
-	defer db.Unlock()
-	for i := range db.LogSources {
-		if db.LogSources[i].ID != id {
-			continue
-		}
-		if v, ok := patch["name"].(string); ok && v != "" {
-			db.LogSources[i].Name = v
-		}
-		if v, ok := patch["namespace"].(string); ok {
-			db.LogSources[i].Namespace = v
-		}
-		if v, ok := patch["service"].(string); ok {
-			db.LogSources[i].Service = v
-		}
-		if v, ok := patch["port"].(float64); ok {
-			db.LogSources[i].Port = int(v)
-		}
-		if v, ok := patch["url"].(string); ok {
-			db.LogSources[i].URL = v
-		}
-		if v, ok := patch["authType"].(string); ok {
-			db.LogSources[i].AuthType = v
-		}
-		if v, ok := patch["basicUser"].(string); ok {
-			db.LogSources[i].BasicUser = v
-		}
-		if v, ok := patch["bearerToken"].(string); ok {
-			if v != "" {
-				enc, err := crypto.EncryptField(v)
-				if err != nil {
-					return err
-				}
-				db.LogSources[i].BearerToken = enc
-			}
-		}
-		if v, ok := patch["skipTLSVerify"].(bool); ok {
-			db.LogSources[i].SkipTLSVerify = v
-		}
-		if raw, ok := patch["headers"]; ok {
-			data, err := json.Marshal(raw)
-			if err != nil {
-				return err
-			}
-			var headers map[string]string
-			if err := json.Unmarshal(data, &headers); err != nil {
-				return err
-			}
-			for name, value := range headers {
-				if !validSourceHeader(name) {
-					return fmt.Errorf("自定义 Header 名称无效: %s", name)
-				}
-				if value == "" {
-					if old, ok := db.LogSources[i].Headers[name]; ok {
-						headers[name] = old
-					}
-					continue
-				}
-				enc, err := crypto.EncryptField(value)
-				if err != nil {
-					return err
-				}
-				headers[name] = enc
-			}
-			db.LogSources[i].Headers = headers
-		}
-		if v, ok := patch["basicPass"].(string); ok && v != "" {
-			if enc, err := crypto.EncryptField(v); err == nil {
-				db.LogSources[i].BasicPass = enc
-			}
-		}
-		if v, ok := patch["isDefault"].(bool); ok && v {
-			for j := range db.LogSources {
-				db.LogSources[j].IsDefault = db.LogSources[j].ID == id
-			}
-		}
-		if raw, ok := patch["access"]; ok {
-			data, err := json.Marshal(raw)
-			if err != nil {
-				return err
-			}
-			var access []models.LogSourceAccess
-			if err := json.Unmarshal(data, &access); err != nil {
-				return err
-			}
-			if err := ValidateSourceAccess(access); err != nil {
-				return err
-			}
-			db.LogSources[i].Access = access
-		}
-		db.LogSources[i].UpdatedAt = time.Now()
-		db.RequestSave()
-		return nil
-	}
-	return fmt.Errorf("数据源不存在")
-}
-
-func ValidateSourceAccess(access []models.LogSourceAccess) error {
-	seen := map[uint]bool{}
-	for _, rule := range access {
-		if rule.UserID == 0 || seen[rule.UserID] {
-			return fmt.Errorf("访问策略的用户 ID 无效或重复")
-		}
-		seen[rule.UserID] = true
-		for k := range rule.Labels {
-			if !labelNamePattern.MatchString(k) {
-				return fmt.Errorf("访问策略包含无效标签名: %s", k)
-			}
-		}
-	}
-	return nil
-}
-
-func DeleteLogSource(id uint) error {
-	db := repository.GetDB()
-	db.Lock()
-	defer db.Unlock()
-	for i := range db.LogSources {
-		if db.LogSources[i].ID == id {
-			db.LogSources = append(db.LogSources[:i], db.LogSources[i+1:]...)
-			groups := db.LogPolicyGroups[:0]
-			for _, group := range db.LogPolicyGroups {
-				if group.SourceID != id {
-					groups = append(groups, group)
-				}
-			}
-			db.LogPolicyGroups = groups
-			db.RequestSave()
-			return nil
-		}
-	}
-	return fmt.Errorf("数据源不存在")
-}
-
-// EnsureLogSourceForDeployment 部署成功后自动注册查询数据源(host-binary→url;k8s→cluster-svc)
-func EnsureLogSourceForDeployment(d *models.LokiDeployment) {
-	if d == nil || d.Endpoint == "" {
-		return
-	}
-	db := repository.GetDB()
-	db.RLock()
-	for i := range db.LogSources {
-		if db.LogSources[i].Name == d.Name {
-			db.RUnlock()
-			return
-		}
-	}
-	db.RUnlock()
-
-	svc := "loki"
-	port := 3100
-	src := &models.LogSource{
-		Name: d.Name, TargetType: "cluster-svc",
-		ClusterID: d.ClusterID, Namespace: d.Namespace, Service: svc, Port: port,
-		AuthType: "none",
-	}
-	if d.Mode == "host-binary" {
-		src.TargetType = "url"
-		src.URL = d.Endpoint
-		src.ClusterID = nil
-	}
-	_, _ = CreateLogSource(src)
+func newLokiTransport(skipTLSVerify bool) *http.Transport {
+	transport := http.DefaultTransport.(*http.Transport).Clone()
+	transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: skipTLSVerify} //nolint:gosec // 数据源显式配置
+	return transport
 }

 // ==================== Loki HTTP 访问 ====================

-// lokiProxyGET 对数据源执行 GET;cluster-svc 走 kubectl --raw service proxy。
+// lokiProxyGET 对数据源执行 GET；cluster-svc 使用 client-go 的认证传输访问 API Server Service Proxy。
 func lokiProxyGET(ctx context.Context, src *models.LogSource, path string, query url.Values) ([]byte, int, error) {
-	// cluster-svc:kubectl get --raw /api/v1/namespaces/{ns}/services/{svc}:{port}/proxy{path}?q
 	if src.TargetType == "cluster-svc" {
 		db := repository.GetDB()
 		db.RLock()
@@ -381,25 +55,39 @@ func lokiProxyGET(ctx context.Context, src *models.LogSource, path string, query
 		if cluster == nil {
 			return nil, 500, fmt.Errorf("数据源关联的集群不存在")
 		}
-		env, cleanup, err := kubeconfigEnv(cluster)
+		if !kubernetesNamespacePattern.MatchString(src.Namespace) || !kubernetesNamespacePattern.MatchString(src.Service) || src.Port < 1 || src.Port > 65535 {
+			return nil, 500, fmt.Errorf("Loki 数据源的命名空间、Service 或端口无效")
+		}
+		config, err := clusterRESTConfig(cluster, logQueryTimeout)
 		if err != nil {
 			return nil, 500, err
 		}
-		defer cleanup()
-
-		proxyPath := fmt.Sprintf("/api/v1/namespaces/%s/services/%s:%d/proxy%s",
+		client, err := rest.HTTPClientFor(config)
+		if err != nil {
+			return nil, 500, fmt.Errorf("创建 Kubernetes API 客户端失败: %w", err)
+		}
+		full := strings.TrimRight(config.Host, "/") + fmt.Sprintf("/api/v1/namespaces/%s/services/%s:%d/proxy%s",
 			src.Namespace, src.Service, src.Port, path)
-		full := proxyPath
 		if qs := query.Encode(); qs != "" {
 			full += "?" + qs
 		}
-		cmd := exec.CommandContext(ctx, "kubectl", "get", "--raw", full)
-		cmd.Env = env
-		out, err := cmd.CombinedOutput()
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, full, nil)
 		if err != nil {
-			return nil, 502, fmt.Errorf("kubectl 代理查询失败: %v\n%s", err, truncateStr(string(out), 300))
+			return nil, 500, err
 		}
-		return out, 200, nil
+		resp, err := client.Do(req)
+		if err != nil {
+			return nil, 502, fmt.Errorf("Kubernetes API 代理查询失败: %w", err)
+		}
+		defer resp.Body.Close()
+		body, err := io.ReadAll(io.LimitReader(resp.Body, 32<<20))
+		if err != nil {
+			return nil, 502, err
+		}
+		if resp.StatusCode >= 400 {
+			return body, resp.StatusCode, fmt.Errorf("Kubernetes API 代理返回 HTTP %d: %s", resp.StatusCode, truncateStr(string(body), 300))
+		}
+		return body, resp.StatusCode, nil
 	}

 	// url 直连
@@ -415,9 +103,10 @@ func lokiProxyGET(ctx context.Context, src *models.LogSource, path string, query
 		return nil, 500, err
 	}
 	applyLokiAuth(req, src)
-	client := &http.Client{Timeout: 60 * time.Second, Transport: &http.Transport{
-		TLSClientConfig: &tls.Config{InsecureSkipVerify: src.SkipTLSVerify},
-	}}
+	client := lokiHTTPClients[0]
+	if src.SkipTLSVerify {
+		client = lokiHTTPClients[1]
+	}
 	resp, err := client.Do(req)
 	if err != nil {
 		return nil, 502, err
@@ -477,6 +166,42 @@ type LogQueryResult struct {
 	NextCursor string        `json:"nextCursor"`
 }

+// ContextLogSelector uses stable stream identity labels. Loki can add per-entry
+// labels such as detected_level to query results; matching those would hide
+// adjacent lines whose detected level differs from the selected line.
+func ContextLogSelector(labels map[string]string) (string, error) {
+	for key := range labels {
+		if !ValidLogLabelName(key) {
+			return "", fmt.Errorf("标签名无效")
+		}
+	}
+	keys := []string{"cluster", "namespace", "app", "pod", "container", "filename"}
+	if labels["pod"] == "" {
+		keys = append(keys, "job", "instance", "host")
+	}
+	parts := make([]string, 0, len(keys))
+	for _, key := range keys {
+		if value := labels[key]; value != "" {
+			encoded, _ := json.Marshal(value)
+			parts = append(parts, key+"="+string(encoded))
+		}
+	}
+	if len(parts) == 0 {
+		for key, value := range labels {
+			if value == "" || key == "detected_level" || key == "level" || strings.HasPrefix(key, "__") {
+				continue
+			}
+			encoded, _ := json.Marshal(value)
+			parts = append(parts, key+"="+string(encoded))
+		}
+		sort.Strings(parts)
+	}
+	if len(parts) == 0 {
+		return "", fmt.Errorf("缺少可用于定位日志流的标签")
+	}
+	return "{" + strings.Join(parts, ",") + "}", nil
+}
+
 // QueryLokiLogs 日志查询:flatten streams → 统一行;cursor(最后一条纳秒时间戳)向后翻页
 func QueryLokiLogs(ctx context.Context, src *models.LogSource, query string, start, end int64, limit int, direction, cursor string) (*LogQueryResult, error) {
 	if limit <= 0 {