refactor: 前后端目录结构模块化 + v2 优化移植与缺陷修复
前端: - src/srv/api → src/api，按域分文件夹(auth/cluster/host/storage/deployment/collector) - 新增 http.ts 引擎(http.get/post/put/delete)，域模块改用语义化调用 - index.html 增加 favicon(匹配应用 logo 的 emerald + Activity 脉冲) 后端分层增强(保留包名): - 新增 repository/：从 models 拆出 JsonDB 持久化层(InitDB/GetDB/Shutdown/RequestSave) - 新增 dto/：从 controllers 抽出各域请求契约(带 binding 校验) - 新增 pkg/crypto、pkg/jwt：从 utils 拆出安全原语(外部 jwt 别名 jwtv5 避免冲突) - models 只留领域实体 + sanitizer；utils 只留 gin/应用相关(response/errors) v2 优化移植与缺陷修复: - 移植密钥分离/SSH TOFU/并发写安全/Loki 生产级配置/Docker 加固 - 修复 deployment.go 并发丢更新、Helm values 重复键、EncryptField 哨兵、loki-gateway 端点等审计缺陷 - 实现真正的优雅关停(main.go http.Server + signal + repository.Shutdown) - 修复登录契约:后端返回 accessToken，前端 auth.ts/Login.tsx 对齐 - 补 crypto/jwt/repository 单元测试(含并发写回归) 验证: go build/vet/test 全绿；npm run build 通过；登录→鉴权→优雅关停冒烟通过 Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Logan.LiandClaude committed
1 parent
fb8d10231a
commit
327e282356
93 files changed
+8433
-3089
No files matched your search
@@ -6,17 +6,35 @@ import (
|
||||
)
|
||||
|
||||
// PromtailConfig 主机 Promtail 配置（推送至 lokiEndpoint，采集 logPath）
|
||||
// 生产级配置：持久化位置文件、批处理、重试、CRI日志格式解析
|
||||
func PromtailConfig(lokiEndpoint, logPath string) string {
|
||||
return fmt.Sprintf(`server:
|
||||
http_listen_port: 9080
|
||||
grpc_listen_port: 0
|
||||
log_level: info
|
||||
log_format: logfmt
|
||||
|
||||
positions:
|
||||
filename: /tmp/positions.yaml
|
||||
filename: /var/lib/promtail/positions.yaml
|
||||
sync_period: 10s
|
||||
|
||||
clients:
|
||||
- url: %s/loki/api/v1/push
|
||||
batchwait: 1s
|
||||
batchsize: 1048576
|
||||
timeout: 10s
|
||||
backoff_config:
|
||||
min_period: 500ms
|
||||
max_period: 5m
|
||||
max_retries: 10
|
||||
external_labels:
|
||||
job: host-logs
|
||||
|
||||
limits_config:
|
||||
readline_rate_enabled: false
|
||||
readline_rate: 1000
|
||||
readline_burst: 10000
|
||||
max_streams: 0
|
||||
|
||||
scrape_configs:
|
||||
- job_name: app
|
||||
@@ -26,28 +44,104 @@ scrape_configs:
|
||||
job: app
|
||||
host: ${HOSTNAME}
|
||||
__path__: %s
|
||||
pipeline_stages:
|
||||
- cri: {}
|
||||
- match:
|
||||
selector: '{job="app"}'
|
||||
stages:
|
||||
- timestamp:
|
||||
source: time
|
||||
format: RFC3339Nano
|
||||
- limit:
|
||||
rate: 1000
|
||||
burst: 10000
|
||||
drop: true
|
||||
`, lokiEndpoint, logPath)
|
||||
}
|
||||
|
||||
// PromtailHelmValues DaemonSet 模式 Promtail Helm values
|
||||
// PromtailHelmValues DaemonSet 模式 Promtail Helm values（生产级）
|
||||
// 包含：cri解析、kubernetes标签、批处理配置、资源限制
|
||||
func PromtailHelmValues(lokiEndpoint string) string {
|
||||
return fmt.Sprintf(`config:
|
||||
clients:
|
||||
- url: %s/loki/api/v1/push
|
||||
batchwait: 1s
|
||||
batchsize: 1048576
|
||||
timeout: 10s
|
||||
backoff_config:
|
||||
min_period: 500ms
|
||||
max_period: 5m
|
||||
max_retries: 10
|
||||
external_labels:
|
||||
cluster: ${CLUSTER_NAME:-unknown}
|
||||
positions:
|
||||
filename: /run/promtail/positions.yaml
|
||||
scrape_configs:
|
||||
- job_name: kubernetes-pods
|
||||
kubernetes_sd_configs:
|
||||
- role: pod
|
||||
pipeline_stages:
|
||||
- cri: {}
|
||||
- match:
|
||||
selector: '{app!=""}'
|
||||
stages:
|
||||
- docker: {}
|
||||
- match:
|
||||
selector: '{app!=""}'
|
||||
stages:
|
||||
- labels:
|
||||
app:
|
||||
namespace:
|
||||
pod:
|
||||
container:
|
||||
- limit:
|
||||
rate: 1000
|
||||
burst: 10000
|
||||
drop: true
|
||||
relabel_configs:
|
||||
- source_labels: [__meta_kubernetes_pod_controller_name]
|
||||
regex: ([0-9a-z-.]+?)(-[0-9a-f]{8,10})?
|
||||
action: replace
|
||||
target_label: __tmp_controller_name
|
||||
- source_labels: [__meta_kubernetes_pod_label_app_kubernetes_io_name]
|
||||
regex: .+
|
||||
action: replace
|
||||
target_label: app
|
||||
- source_labels: [__meta_kubernetes_pod_label_app]
|
||||
regex: .+
|
||||
action: replace
|
||||
target_label: app
|
||||
- source_labels: [__meta_kubernetes_pod_annotation_kubernetes_io_config_hash]
|
||||
regex: .+
|
||||
action: replace
|
||||
target_label: config_hash
|
||||
- action: replace
|
||||
source_labels: ['__meta_kubernetes__pod_name']
|
||||
target_label: 'pod'
|
||||
- action: replace
|
||||
source_labels: ['__meta_kubernetes_namespace']
|
||||
target_label: 'namespace'
|
||||
- action: replace
|
||||
source_labels: ['__meta_kubernetes_pod_container_name']
|
||||
target_label: 'container'
|
||||
- action: replace
|
||||
source_labels: ['__meta_kubernetes_pod_node_name']
|
||||
target_label: 'node_name'
|
||||
- replacement: /var/log/pods/*$1/*.log
|
||||
separator: /
|
||||
source_labels: [__meta_kubernetes_pod_uid, __meta_kubernetes_pod_container_name]
|
||||
target_label: __path__
|
||||
|
||||
daemonset:
|
||||
enabled: true
|
||||
|
||||
serviceAccount:
|
||||
create: true
|
||||
|
||||
resources:
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 128Mi
|
||||
memory: 256Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 64Mi
|
||||
memory: 128Mi
|
||||
|
||||
extraVolumes:
|
||||
- name: varlog
|
||||
@@ -56,6 +150,9 @@ extraVolumes:
|
||||
- name: varlibdockercontainers
|
||||
hostPath:
|
||||
path: /var/lib/docker/containers
|
||||
- name: promtail-run
|
||||
hostPath:
|
||||
path: /run/promtail
|
||||
|
||||
extraVolumeMounts:
|
||||
- name: varlog
|
||||
@@ -64,33 +161,63 @@ extraVolumeMounts:
|
||||
- name: varlibdockercontainers
|
||||
mountPath: /var/lib/docker/containers
|
||||
readOnly: true
|
||||
- name: promtail-run
|
||||
mountPath: /run/promtail
|
||||
`, lokiEndpoint)
|
||||
}
|
||||
|
||||
// FluentbitConfig Sidecar 模式 Fluent Bit 配置（采集 logPath，推送至 lokiHost:lokiPort）
|
||||
// 生产级配置：kubernetes过滤器、内存缓冲、健康检查
|
||||
func FluentbitConfig(lokiHost, lokiPort, logPath, app, namespace string) string {
|
||||
return fmt.Sprintf(`[SERVICE]
|
||||
Flush 5
|
||||
Flush 1
|
||||
Log_Level info
|
||||
HTTP_Server On
|
||||
HTTP_Listen 0.0.0.0
|
||||
HTTP_Port 2020
|
||||
Parsers_File parsers.conf
|
||||
storage.path /tmp/flb-storage/
|
||||
storage.sync normal
|
||||
storage.checksum off
|
||||
storage.max_chunks_pause On
|
||||
storage.backlog.mem_limit 5M
|
||||
Health_Check On
|
||||
HC_Errors_Count 5
|
||||
HC_Retry_Failure_Count 5
|
||||
HC_Period 60
|
||||
|
||||
[INPUT]
|
||||
Name tail
|
||||
Path %s
|
||||
Tag app.%s
|
||||
Refresh_Interval 5
|
||||
Mem_Buf_Limit 5MB
|
||||
Mem_Buf_Limit 10MB
|
||||
Skip_Long_Lines On
|
||||
Read_from_Head True
|
||||
DB /tmp/flb.db
|
||||
DB.Sync Normal
|
||||
Buffer_Max_Size 1MB
|
||||
storage.type filesystem
|
||||
|
||||
[FILTER]
|
||||
Name modify
|
||||
Match app.*
|
||||
Add namespace %s
|
||||
Add app %s
|
||||
Add source fluent-bit
|
||||
|
||||
[FILTER]
|
||||
Name kubernetes
|
||||
Match app.*
|
||||
Kube_URL https://kubernetes.default.svc:443
|
||||
Kube_CA_File /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
||||
Kube_Token_File /var/run/secrets/kubernetes.io/serviceaccount/token
|
||||
Merge_Log On
|
||||
Keep_Log Off
|
||||
K8S-Logging.Parser On
|
||||
K8S-Logging.Exclude On
|
||||
Labels On
|
||||
Annotations Off
|
||||
|
||||
[OUTPUT]
|
||||
Name loki
|
||||
@@ -98,6 +225,10 @@ func FluentbitConfig(lokiHost, lokiPort, logPath, app, namespace string) string
|
||||
Host %s
|
||||
Port %s
|
||||
Labels job=fluent-bit, app=%s, namespace=%s
|
||||
Drop_Records_Without_Labels On
|
||||
Line_Format json
|
||||
Auto_Kubernetes_Labels On
|
||||
Retry_Limit 10
|
||||
`, logPath, app, namespace, app, lokiHost, lokiPort, app, namespace)
|
||||
}
|
||||
|
||||
@@ -115,6 +246,7 @@ data:
|
||||
}
|
||||
|
||||
// SidecarPatchYAML strategic merge patch：为 Deployment 注入 Fluent Bit sidecar 容器
|
||||
// 生产级配置：资源限制、健康检查、安全上下文
|
||||
const SidecarPatchYAML = `spec:
|
||||
template:
|
||||
spec:
|
||||
@@ -128,6 +260,10 @@ const SidecarPatchYAML = `spec:
|
||||
- name: fluent-bit
|
||||
image: cr.fluentbit.io/fluent/fluent-bit:3.1.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 2020
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
- name: app-logs
|
||||
mountPath: /var/log/app
|
||||
@@ -141,6 +277,24 @@ const SidecarPatchYAML = `spec:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
`
|
||||
|
||||
// SidecarRemovePatchYAML strategic merge patch：从 Deployment 移除 Fluent Bit sidecar（卸载）
|
||||
|
||||
Reference in new issue
Block a user