rlwj-lab/LokiStack
1
0 Fork 0
Code Issues Pull Requests Actions 32 Packages Projects Releases Wiki Activity

refactor: 资源名 opsx-loki/opsxloki → lokistack（线上已迁移完成）

Browse Source 
【已在线完成，零数据丢失】
K8s ns=log 资源全部改名：
  Deployment  opsx-loki          → lokistack
  Service     opsx-loki          → lokistack
  Service     opsx-loki-nodeport → lokistack-nodeport
  PVC         opsxloki-data      → lokistack-data
  Secret      opsxloki-secrets   → lokistack-secrets
  Label       app: opsx-loki     → app: lokistack
  Ingress     log.astx.club 后端  → lokistack-nodeport:8080
  镜像        lghost/opsxloki     → lghost/lokistack
  docker-compose 卷/容器名同步更名

【保留不变（改了会出事）】
  namespace: log
  数据文件名 opsxloki.json（代码硬编码）
  容器内路径 /app/data

【迁移过程】
  1. 备份 PVC 数据(32KB) + Secret 原值 + 旧 yaml → /root/lokistack-migration-backup-20261026-171141
  2. scale 旧 Deployment → 0，等 Pod 消失
  3. 复制 Secret（JWT sha256 校验一致）
  4. 新建 PVC lokistack-data（Bound 30Gi cbs）
  5. 临时 Pod 恢复数据（chown 1000:1000，opsxloki.json 保留 0600）
  6. apply 新 Deployment → 1/1 Running
  7. 修复 Ingress 后端（TKE qcloud 要求 NodePort）→ CLB 恢复 200
  8. 删除旧 Deployment / 失效 Service

【验证】
  lokistack 1/1，0 重启，镜像 lghost/lokistack:latest（statically linked）
  /api/v1/health → {"status":"ok","version":"2.0.0"}
  /app/data/opsxloki.json 610B 完整（admin 用户 + 配置）
  http://log.astx.club/ → HTTP 200
  镜像加固：admin123=0、/app/backend/=0、initial-admin-password.txt 存在

【回滚兜底（建议 7 天后删）】
  pvc/opsxloki-data、secret/opsxloki-secrets

【文档】
  README 新增「从 opsx-loki 升级」章节：
  K8s 七步迁移脚本 + docker-compose 卷迁移命令
This commit is contained in:
opsx committed 2026-10-26 17:16:15 +00:00
1 parent b65dcc9677
commit 3c9388658b
13 files changed
+230 -152
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

README.md
+78
View File
@@ -21,6 +21,84 @@
---
---
## 从 opsx-loki 升级（资源更名说明）
本版本把所有资源名从 `opsx-loki` / `opsxloki` 统一改为 **`lokistack`**，包括镜像、Deployment、
Service、PVC、Secret、docker-compose 卷名。
### Kubernetes 用户
资源名已变，**不能直接 `kubectl apply` 覆盖**（会新建空 PVC）。按下面顺序迁移，**零数据丢失**：
```bash
# 0) 先备份（数据只有几十 KB）
kubectl -n log exec deploy/opsx-loki -- tar czf - -C /app/data . > /tmp/data.tar.gz
kubectl -n log get secret opsxloki-secrets -o yaml > /tmp/secret-old.yaml
kubectl -n log get pvc opsxloki-data -o yaml > /tmp/pvc-old.yaml
# 1) 停旧服务（Recreate + RWO，必须停）
kubectl -n log scale deploy opsx-loki --replicas=0
kubectl -n log wait --for=delete pod -l app=opsx-loki --timeout=120s
# 2) 复制 Secret（值不变，密钥才不会失效）
kubectl -n log get secret opsxloki-secrets -o yaml \
| sed 's/name: opsxloki-secrets/name: lokistack-secrets/' \
| kubectl apply -f -
# 3) 只建新 PVC
kubectl apply -f kubernetes/pvc.yaml
kubectl -n log wait --for=jsonpath='{.status.phase}'=Bound pvc/lokistack-data --timeout=180s
# 4) 恢复数据到新 PVC（起临时 Pod 挂载）
kubectl -n log run restore --image=alpine:3.20 --restart=Never \
--overrides='{"spec":{"containers":[{"name":"r","image":"alpine:3.20","command":["sleep","600"],"volumeMounts":[{"name":"d","mountPath":"/data"}]}],"volumes":[{"name":"d","persistentVolumeClaim":{"claimName":"lokistack-data"}}]}}'
kubectl -n log wait --for=condition=Ready pod/restore --timeout=120s
kubectl -n log cp /tmp/data.tar.gz restore:/tmp/
kubectl -n log exec restore -- sh -c 'cd /data && tar xzf /tmp/data.tar.gz && chown -R 1000:1000 /data'
kubectl -n log delete po restore
# 5) 启动新服务
kubectl apply -f kubernetes/deployment.yaml -f kubernetes/service.yaml -f kubernetes/service-nodeport.yaml
kubectl -n log rollout status deploy/lokistack --timeout=240s
# 6) 若有 Ingress，改后端（TKE qcloud 要 NodePort）
kubectl -n log patch ingress <你的ingress名> --type=json \
-p='[{"op":"replace","path":"/spec/rules/0/http/paths/0/backend/service/name","value":"lokistack-nodeport"}]'
# 7) 确认服务正常后再删旧资源
kubectl -n log delete deploy opsx-loki
kubectl -n log delete svc opsx-loki opsx-loki-nodeport
# 旧 PVC / Secret 建议保留 7 天做回滚兜底
# kubectl -n log delete pvc opsxloki-data
# kubectl -n log delete secret opsxloki-secrets
```
### Docker Compose 用户
卷名 `opsxloki-data` → `lokistack-data`。**旧数据不会自动迁移**，需要手动拷：
```bash
# 停服务
docker compose down
# 创建新卷并迁移数据
docker volume create lokistack-data
docker run --rm -v opsxloki-data:/from -v lokistack-data:/to alpine \
sh -c 'cp -av /from/. /to/ && chown -R 1000:1000 /to'
# 重新启动（会用新卷）
docker compose up -d
# 验证数据在
docker compose exec lokistack cat /app/data/opsxloki.json | head -c 100
```
> **注意**：数据文件名仍叫 `opsxloki.json`（代码里硬编码，不改），只是目录/卷名变了。
---
## 快速开始
### 前置条件
docker-compose.prod.yml
+24 -24
View File
@@ -1,5 +1,5 @@
# ============================================================
# opsx-loki - Production Docker Compose Configuration
# lokistack - Production Docker Compose Configuration
# ============================================================
# Features:
# - Multi-instance deployment with load balancing
@@ -15,14 +15,14 @@ services:
# ---- Nginx Load Balancer ----
nginx:
image: nginx:1.27-alpine
container_name: opsxloki-lb
container_name: lokistack-lb
restart: unless-stopped
ports:
- "8080:8080"
volumes:
- ./nginx.conf:/etc/nginx/nginx.conf:ro
networks:
- opsxloki-net
- lokistack-net
healthcheck:
test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080/health"]
interval: 30s
@@ -52,21 +52,21 @@ services:
- /var/cache/nginx:noexec,nosuid,size=10m
- /var/run:noexec,nosuid,size=5m
depends_on:
opsxloki-1:
lokistack-1:
condition: service_healthy
opsxloki-2:
lokistack-2:
condition: service_healthy
# ---- Application Instance 1 ----
opsxloki-1:
lokistack-1:
build:
context: .
dockerfile: Dockerfile
args:
TARGETARCH: ${TARGETARCH:-amd64}
image: lghost/lokistack:latest
container_name: opsxloki-1
hostname: opsxloki-1
container_name: lokistack-1
hostname: lokistack-1
restart: unless-stopped
security_opt:
@@ -85,16 +85,16 @@ services:
volumes:
# Named volume for data persistence
- opsxloki-data-1:/app/data
- lokistack-data-1:/app/data
# kubeconfig read-only (P0: non-root path)
- ${KUBECONFIG_PATH:-~/.kube}:/home/opsxloki/.kube:ro
- ${KUBECONFIG_PATH:-~/.kube}:/home/lokistack/.kube:ro
# SSH keys read-only
- ${SSH_KEY_PATH:-~/.ssh}:/home/opsxloki/.ssh:ro
- ${SSH_KEY_PATH:-~/.ssh}:/home/lokistack/.ssh:ro
environment:
- SERVER_PORT=8080
- DATA_DIR=/app/data
- KUBECONFIG=/home/opsxloki/.kube/config
- KUBECONFIG=/home/lokistack/.kube/config
# Secrets via Docker Secrets file injection
- JWT_SECRET_FILE=${JWT_SECRET_FILE:-/run/secrets/jwt_secret}
- ENCRYPTION_KEY_FILE=${ENCRYPTION_KEY_FILE:-/run/secrets/encryption_key}
@@ -136,18 +136,18 @@ services:
stop_grace_period: 30s
networks:
- opsxloki-net
- lokistack-net
# ---- Application Instance 2 ----
opsxloki-2:
lokistack-2:
build:
context: .
dockerfile: Dockerfile
args:
TARGETARCH: ${TARGETARCH:-amd64}
image: lghost/lokistack:latest
container_name: opsxloki-2
hostname: opsxloki-2
container_name: lokistack-2
hostname: lokistack-2
restart: unless-stopped
security_opt:
@@ -163,14 +163,14 @@ services:
- /tmp:noexec,nosuid,size=50m,uid=1000,gid=1000
volumes:
- opsxloki-data-2:/app/data
- ${KUBECONFIG_PATH:-~/.kube}:/home/opsxloki/.kube:ro
- ${SSH_KEY_PATH:-~/.ssh}:/home/opsxloki/.ssh:ro
- lokistack-data-2:/app/data
- ${KUBECONFIG_PATH:-~/.kube}:/home/lokistack/.kube:ro
- ${SSH_KEY_PATH:-~/.ssh}:/home/lokistack/.ssh:ro
environment:
- SERVER_PORT=8080
- DATA_DIR=/app/data
- KUBECONFIG=/home/opsxloki/.kube/config
- KUBECONFIG=/home/lokistack/.kube/config
- JWT_SECRET_FILE=${JWT_SECRET_FILE:-/run/secrets/jwt_secret}
- ENCRYPTION_KEY_FILE=${ENCRYPTION_KEY_FILE:-/run/secrets/encryption_key}
@@ -209,13 +209,13 @@ services:
stop_grace_period: 30s
networks:
- opsxloki-net
- lokistack-net
# ---- Named Volumes ----
volumes:
opsxloki-data-1:
lokistack-data-1:
driver: local
opsxloki-data-2:
lokistack-data-2:
driver: local
# ---- Docker Secrets ----
@@ -227,7 +227,7 @@ secrets:
# ---- Network ----
networks:
opsxloki-net:
lokistack-net:
driver: bridge
ipam:
config:
docker-compose.yml
+14 -14
View File
@@ -1,8 +1,8 @@
# ============================================================
# opsx-loki - Development Docker Compose Configuration
# lokistack - Development Docker Compose Configuration
# ============================================================
# P0 Fixes:
# - Non-root kubeconfig mount (/home/opsxloki/.kube)
# - Non-root kubeconfig mount (/home/lokistack/.kube)
# - Healthcheck for orchestration visibility
# - Resource limits to prevent noisy-neighbor
# - security_opt: no-new-privileges
@@ -14,15 +14,15 @@
# ============================================================
services:
opsxloki:
lokistack:
build:
context: .
dockerfile: Dockerfile
args:
TARGETARCH: ${TARGETARCH:-amd64}
image: lghost/lokistack:latest
container_name: opsxloki
hostname: opsxloki
container_name: lokistack
hostname: lokistack
# ---- P0: Security options ----
security_opt:
@@ -43,11 +43,11 @@ services:
# ---- P0: Named volumes for data persistence ----
volumes:
- opsxloki-data:/app/data
- lokistack-data:/app/data
# P0: Mount kubeconfig to non-root user directory
- ${KUBECONFIG_PATH:-${HOME}/.kube}:/home/opsxloki/.kube:ro
- ${KUBECONFIG_PATH:-${HOME}/.kube}:/home/lokistack/.kube:ro
# SSH keys for host-based deployments
- ${SSH_KEY_PATH:-${HOME}/.ssh}:/home/opsxloki/.ssh:ro
- ${SSH_KEY_PATH:-${HOME}/.ssh}:/home/lokistack/.ssh:ro
# ---- P0: Environment variables (no default secrets) ----
environment:
@@ -60,7 +60,7 @@ services:
# P0: ENCRYPTION_KEY must be provided externally (AES-256, >=32 字符)
- "ENCRYPTION_KEY=${ENCRYPTION_KEY:?ENCRYPTION_KEY is required. Generate: openssl rand -hex 32, then: export ENCRYPTION_KEY=<value>}"
# KUBECONFIG points to non-root user's .kube directory
- KUBECONFIG=/home/opsxloki/.kube/config
- KUBECONFIG=/home/lokistack/.kube/config
# ---- P0: Healthcheck ----
healthcheck:
@@ -95,21 +95,21 @@ services:
stop_grace_period: 15s
networks:
- opsxloki-net
- lokistack-net
# ---- Named volumes ----
volumes:
opsxloki-data:
lokistack-data:
driver: local
labels:
- "com.opsxloki.description=opsx-loki data directory"
- "com.lokistack.description=lokistack data directory"
# ---- Network isolation ----
networks:
opsxloki-net:
lokistack-net:
driver: bridge
ipam:
config:
- subnet: 172.28.0.0/16
labels:
- "com.opsxloki.description=opsx-loki internal network"
- "com.lokistack.description=lokistack internal network"
docs/deployment/kubernetes.md
+22 -22
View File
@@ -7,7 +7,7 @@
```bash
kubectl create namespace log # 已存在可跳过
kubectl -n log create secret generic opsxloki-secrets \
kubectl -n log create secret generic lokistack-secrets \
--from-literal=JWT_SECRET="$(openssl rand -hex 32)" \
--from-literal=ENCRYPTION_KEY="$(openssl rand -hex 32)"
```
@@ -23,7 +23,7 @@ kubectl -n log create secret generic opsxloki-secrets \
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: opsxloki-data
name: lokistack-data
namespace: log
spec:
accessModes: [ReadWriteOnce]
@@ -64,12 +64,12 @@ kubectl apply -f kubernetes/namespace.yaml \
apiVersion: v1
kind: Service
metadata:
name: opsx-loki
name: lokistack
namespace: log
spec:
type: ClusterIP
selector:
app: opsx-loki
app: lokistack
ports:
- name: http
port: 8080
@@ -89,7 +89,7 @@ metadata:
name: loki.xxx.io
namespace: log
labels:
app: opsx-loki
app: lokistack
spec:
ingressClassName: alb
rules:
@@ -100,7 +100,7 @@ spec:
pathType: Prefix
backend:
service:
name: opsx-loki
name: lokistack
port:
number: 8080
```
@@ -120,7 +120,7 @@ JSON DB 是单文件，迁移时先停旧实例，再写入 PVC：
```bash
# 1) 缩容到 0，避免应用关机时覆盖
kubectl -n log scale deploy/opsx-loki --replicas=0
kubectl -n log scale deploy/lokistack --replicas=0
# 2) 临时 Pod 挂 PVC 拷数据（与业务 Pod 同节点，RWO 盘才能挂上）
kubectl apply -f - <<'EOF'
@@ -137,14 +137,14 @@ spec:
volumeMounts: [{name: data, mountPath: /data}]
volumes:
- name: data
persistentVolumeClaim: {claimName: opsxloki-data}
persistentVolumeClaim: {claimName: lokistack-data}
EOF
kubectl -n log cp ./opsxloki.json pvc-loader:/data/opsxloki.json
kubectl -n log cp ./known_hosts pvc-loader:/data/known_hosts
kubectl -n log delete pod pvc-loader
kubectl -n log scale deploy/opsx-loki --replicas=1
kubectl -n log scale deploy/lokistack --replicas=1
```
> 不要在业务 Pod 运行时 `kubectl cp` 覆盖 DB：应用退出时会用内存数据回写，覆盖你拷进去的文件。
@@ -153,15 +153,15 @@ kubectl -n log scale deploy/opsx-loki --replicas=1
```bash
kubectl -n log get pods,pvc,svc,ingress
kubectl -n log logs deploy/opsx-loki --tail=20
kubectl -n log exec deploy/opsx-loki -- wget -qO- http://127.0.0.1:8080/api/v1/health
kubectl -n log logs deploy/lokistack --tail=20
kubectl -n log exec deploy/lokistack -- wget -qO- http://127.0.0.1:8080/api/v1/health
```
## 8. 升级
```bash
kubectl -n log set image deploy/opsx-loki opsx-loki=lghost/lokistack:v0.2
kubectl -n log rollout status deploy/opsx-loki
kubectl -n log set image deploy/lokistack lokistack=lghost/lokistack:v0.2
kubectl -n log rollout status deploy/lokistack
```
`Recreate` 会先停旧 Pod 再起新 Pod，期间平台短暂不可用（单写者约束的代价）。
@@ -183,13 +183,13 @@ metadata:
apiVersion: v1
kind: ServiceAccount
metadata:
name: opsx-loki
name: lokistack
namespace: log
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: opsx-loki
name: lokistack
namespace: log
rules:
- apiGroups: [""]
@@ -205,34 +205,34 @@ rules:
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: opsx-loki
name: lokistack
namespace: log
subjects:
- kind: ServiceAccount
name: opsx-loki
name: lokistack
namespace: log
roleRef:
kind: Role
name: opsx-loki
name: lokistack
apiGroup: rbac.authorization.k8s.io
---
apiVersion: v1
kind: Secret
metadata:
name: opsx-loki-token
name: lokistack-token
namespace: log
annotations:
kubernetes.io/service-account.name: opsx-loki
kubernetes.io/service-account.name: lokistack
type: kubernetes.io/service-account-token
EOF
kubectl -n log get secret opsx-loki-token -o jsonpath='{.data.token}' | base64 -d
kubectl -n log get secret lokistack-token -o jsonpath='{.data.token}' | base64 -d
```
- 这个 Token **不会自动过期**，但只绑定 `log` 命名空间的 Role：能操作该命名空间的 Pod、日志、工作负载、Service、ConfigMap、Secret、PVC，**无权访问其他命名空间和集群级资源**。
- 平台展示节点数需要 `nodes` 只读权限；命名空间级 Token 没有该权限时，平台会跳过节点信息，不影响集群接入与部署。
- 平台收到 Token 后会转成 kubeconfig，并用 `ENCRYPTION_KEY` 加密存 DB（`ENC:` 前缀），接口不返回明文。
- 轮换：删除 Secret 后重建，旧 Token 立即失效。
- 如果集群策略要求短期凭证，可改用 `kubectl -n log create token opsx-loki --duration=24h` 定期轮换。
- 如果集群策略要求短期凭证，可改用 `kubectl -n log create token lokistack --duration=24h` 定期轮换。
- 上面的 Namespace 由管理员创建，平台 Token 本身没有集群级权限；只有确实需要平台自建命名空间时，才额外授予 `namespaces: create/get` 的 ClusterRole（create 无法按名称限制，预建 `log` 更安全）。
kubernetes/README.md
+38 -38
View File
@@ -1,4 +1,4 @@
# opsx-loki 部署到 Kubernetes
# lokistack 部署到 Kubernetes
命名空间固定：**`log`**（日志相关资源统一放这里）
@@ -13,11 +13,11 @@ bash kubernetes/install.sh
脚本会依次完成：
1. 创建 `log` 命名空间
2. **生成随机密钥** `JWT_SECRET` / `ENCRYPTION_KEY` 写入 Secret `opsxloki-secrets`
2. **生成随机密钥** `JWT_SECRET` / `ENCRYPTION_KEY` 写入 Secret `lokistack-secrets`
（已存在则跳过，**不会覆盖**）
3. 创建 PVC `opsxloki-data`（30 GiB，使用集群默认 StorageClass）
4. 部署 `opsx-loki`（单副本 + Recreate）
5. 创建 Service `opsx-loki:8080`（ClusterIP）
3. 创建 PVC `lokistack-data`（30 GiB，使用集群默认 StorageClass）
4. 部署 `lokistack`（单副本 + Recreate）
5. 创建 Service `lokistack:8080`（ClusterIP）
6. 等待 Pod 就绪并输出访问方式
**需要 NodePort（配 ingress 时）**：
@@ -40,7 +40,7 @@ WITH_NODEPORT=1 bash kubernetes/install.sh
| 指定 SC（自建用 local-path）| `STORAGE_CLASS=local-path bash kubernetes/install.sh` |
| **自建集群强制用节点本地盘**（hostPath）| `LOCAL_STORAGE=force bash kubernetes/install.sh` |
| 只诊断不动手（无变更）| `LOCAL_STORAGE=off bash kubernetes/install.sh` |
| **指定本地存储的节点/路径/容量** | `NODE_NAME=node1 PV_PATH=/data/opsxloki PV_SIZE=50Gi bash kubernetes/install.sh` |
| **指定本地存储的节点/路径/容量** | `NODE_NAME=node1 PV_PATH=/data/lokistack PV_SIZE=50Gi bash kubernetes/install.sh` |
| 组合：自建 + 指定节点 + NodePort | `LOCAL_STORAGE=force NODE_NAME=node1 WITH_NODEPORT=1 bash kubernetes/install.sh` |
**环境变量一览**：
@@ -51,7 +51,7 @@ WITH_NODEPORT=1 bash kubernetes/install.sh
| `STORAGE_CLASS` | 空（自动探测）| 显式指定 StorageClass 名称 |
| `LOCAL_STORAGE` | `auto` | `auto` 无 SC 时自动建本地 PV / `off` 只诊断 / `force` 强制本地盘 |
| `NODE_NAME` | 空（第一个 Ready 节点）| hostPath PV 绑定的节点 |
| `PV_PATH` | `/var/lib/opsxloki-data` | hostPath 在宿主机上的路径 |
| `PV_PATH` | `/var/lib/lokistack-data` | hostPath 在宿主机上的路径 |
| `PV_SIZE` | `30Gi` | PV 容量声明 |
---
@@ -95,13 +95,13 @@ WITH_NODEPORT=1 bash kubernetes/install.sh
检测到集群完全没有 SC 时，脚本自动创建一个**静态 local PV**：
```yaml
StorageClass: opsxloki-local
StorageClass: lokistack-local
provisioner: kubernetes.io/no-provisioner
volumeBindingMode: WaitForFirstConsumer # 先定 Pod 再绑 PV
reclaimPolicy: Retain # 误删 PVC 不丢数据
PersistentVolume: opsxloki-data-pv
hostPath: { path: /var/lib/opsxloki-data, type: DirectoryOrCreate }
PersistentVolume: lokistack-data-pv
hostPath: { path: /var/lib/lokistack-data, type: DirectoryOrCreate }
nodeAffinity: 锁定一台节点
```
@@ -142,7 +142,7 @@ LOCAL_STORAGE=off bash kubernetes/install.sh
| **Longhorn** | Helm，每节点装 | 需要副本/高可用 | 每节点约 1C2G 开销 |
| **NFS + nfs-subdir-provisioner** | 需现成 NFS 服务器 | 多节点共享 | 依赖外部 NFS |
> 对 opsx-loki 这类**单副本 + JSON DB 单写者**的应用，**local PV 完全够用**，
> 对 lokistack 这类**单副本 + JSON DB 单写者**的应用，**local PV 完全够用**，
> 不需要为了"高可用"上 Longhorn —— 副本存储反而会和"单写者"约束冲突。
---
@@ -155,12 +155,12 @@ LOCAL_STORAGE=off bash kubernetes/install.sh
```bash
# 1) 找到 PV 绑定的节点和路径
kubectl get pv opsxloki-data-pv -o custom-columns=\
kubectl get pv lokistack-data-pv -o custom-columns=\
'NAME:.metadata.name,PATH:.spec.hostPath.path,NODE:.spec.nodeAffinity.required.nodeSelectorTerms[0].matchExpressions[0].values[0]'
# 2) 去那台节点上看
NODE=<上面的 NODE 值>
ssh root@${NODE} 'ls -la /var/lib/opsxloki-data/'
ssh root@${NODE} 'ls -la /var/lib/lokistack-data/'
# 应看到：opsxloki.json kubeconfigs/ known_hosts
```
@@ -169,8 +169,8 @@ ssh root@${NODE} 'ls -la /var/lib/opsxloki-data/'
```bash
NODE=<节点>
TS=$(date +%Y%m%d-%H%M%S)
ssh root@${NODE} "tar czf /tmp/opsxloki-backup-${TS}.tar.gz -C /var/lib opsxloki-data"
scp root@${NODE}:/tmp/opsxloki-backup-${TS}.tar.gz ./
ssh root@${NODE} "tar czf /tmp/lokistack-backup-${TS}.tar.gz -C /var/lib lokistack-data"
scp root@${NODE}:/tmp/lokistack-backup-${TS}.tar.gz ./
```
> `opsxloki.json` 写入是原子的（临时文件 + fsync + rename），**热备份安全**，不用停 Pod。
@@ -181,41 +181,41 @@ scp root@${NODE}:/tmp/opsxloki-backup-${TS}.tar.gz ./
OLD=<旧节点> NEW=<新节点>
# 1) 停止写入
kubectl -n log scale deploy opsx-loki --replicas=0
kubectl -n log scale deploy lokistack --replicas=0
# 2) 从旧节点拉取数据
ssh root@${OLD} 'tar czf - -C /var/lib opsxloki-data' > /tmp/opsxloki-data.tar.gz
ssh root@${OLD} 'tar czf - -C /var/lib lokistack-data' > /tmp/lokistack-data.tar.gz
# 3) 推到新节点并解包
scp /tmp/opsxloki-data.tar.gz root@${NEW}:/tmp/
ssh root@${NEW} 'mkdir -p /var/lib && tar xzf /tmp/opsxloki-data.tar.gz -C /var/lib && ls -la /var/lib/opsxloki-data'
scp /tmp/lokistack-data.tar.gz root@${NEW}:/tmp/
ssh root@${NEW} 'mkdir -p /var/lib && tar xzf /tmp/lokistack-data.tar.gz -C /var/lib && ls -la /var/lib/lokistack-data'
# 4) 改 PV 的 nodeAffinity 指向新节点
kubectl patch pv opsxloki-data-pv --type=json -p \
kubectl patch pv lokistack-data-pv --type=json -p \
"[{\"op\":\"replace\",\"path\":\"/spec/nodeAffinity/required/nodeSelectorTerms/0/matchExpressions/0/values\",\"value\":[\"${NEW}\"]}]"
# 5) 恢复
kubectl -n log scale deploy opsx-loki --replicas=1
kubectl -n log rollout status deploy/opsx-loki
kubectl -n log scale deploy lokistack --replicas=1
kubectl -n log rollout status deploy/lokistack
```
### 卸载但保留数据
```bash
# 删工作负载和服务（数据卷保留）
kubectl -n log delete deploy opsx-loki svc opsx-loki
kubectl -n log delete deploy lokistack svc lokistack
# PVC 保留（Retain 策略，删了也不会丢 PV 里的数据）
# 想彻底清掉的话：
# kubectl delete pvc opsxloki-data
# kubectl delete pv opsxloki-data-pv
# 然后去节点上 rm -rf /var/lib/opsxloki-data
# kubectl delete pvc lokistack-data
# kubectl delete pv lokistack-data-pv
# 然后去节点上 rm -rf /var/lib/lokistack-data
# 如果要连脏数据一起重置重装：
kubectl -n log delete pvc opsxloki-data
kubectl delete pv opsxloki-data-pv
kubectl delete sc opsxloki-local
ssh root@${NODE} 'rm -rf /var/lib/opsxloki-data'
kubectl -n log delete pvc lokistack-data
kubectl delete pv lokistack-data-pv
kubectl delete sc lokistack-local
ssh root@${NODE} 'rm -rf /var/lib/lokistack-data'
# 然后重新 bash install.sh
```
@@ -238,7 +238,7 @@ kubernetes/
├── namespace.yaml # log 命名空间
├── pvc.yaml # 数据卷 30Gi（storageClassName 留空 → 用默认 SC）
├── deployment.yaml # 平台本体（单副本 + Recreate，必须）
├── service.yaml # ClusterIP opsx-loki:8080
├── service.yaml # ClusterIP lokistack:8080
├── service-nodeport.yaml # NodePort 30080（配 ingress 时用）
└── examples/ # 云相关配置，不参与默认部署
├── ingress.yaml # 阿里云 ACK（alb class）
@@ -260,7 +260,7 @@ kubectl apply -f kubernetes/namespace.yaml
# 2) 密钥（⚠️ 必须先做，否则 Pod 起不来）
# 密钥只生成一次，丢失会导致已保存的凭证无法解密
kubectl -n log create secret generic opsxloki-secrets \
kubectl -n log create secret generic lokistack-secrets \
--from-literal=JWT_SECRET="$(openssl rand -hex 32)" \
--from-literal=ENCRYPTION_KEY="$(openssl rand -hex 32)"
@@ -270,7 +270,7 @@ kubectl apply -f kubernetes/deployment.yaml
kubectl apply -f kubernetes/service.yaml
# 4) 等待就绪
kubectl -n log rollout status deployment/opsx-loki --timeout=180s
kubectl -n log rollout status deployment/lokistack --timeout=180s
```
> ❗**不要直接 `kubectl apply -f kubernetes/`**：Secret 不在目录里（密钥不能进 Git），
@@ -283,7 +283,7 @@ kubectl -n log rollout status deployment/opsx-loki --timeout=180s
**临时（本地端口转发）**：
```bash
kubectl -n log port-forward svc/opsx-loki 8080:8080
kubectl -n log port-forward svc/lokistack 8080:8080
# 浏览器打开 http://localhost:8080
```
@@ -304,7 +304,7 @@ vi kubernetes/examples/ingress-tke.yaml # 改 host
kubectl apply -f kubernetes/examples/ingress-tke.yaml
# 3) 查 CLB 分配的公网 IP，把域名解析过去
kubectl -n log get ingress opsx-loki
kubectl -n log get ingress lokistack
```
| 云 | ingressClassName | 备注 |
@@ -332,12 +332,12 @@ kubectl -n log get ingress opsx-loki
apiVersion: snapshot.storage.k8s.io/v1
kind: VolumeSnapshot
metadata:
name: opsxloki-data-20261025
name: lokistack-data-20261025
namespace: log
spec:
volumeSnapshotClassName: <集群的 snapshotClass>
source:
persistentVolumeClaimName: opsxloki-data
persistentVolumeClaimName: lokistack-data
```
---
@@ -383,7 +383,7 @@ spec:
| 现象 | 原因 | 解决 |
|------|------|------|
| Pod `CreateContainerConfigError` | 缺 Secret `opsxloki-secrets` | 跑 `install.sh`，或手动 `kubectl create secret` |
| Pod `CreateContainerConfigError` | 缺 Secret `lokistack-secrets` | 跑 `install.sh`，或手动 `kubectl create secret` |
| Pod `Pending`，PVC `Pending` | 集群没有默认 StorageClass | `pvc.yaml` 里填 `storageClassName` |
| Pod `ImagePullBackOff` | 节点拉不到 `lghost/lokistack:latest` | 换镜像地址（ACR/TCR/SWR/Harbor） |
| `kubectl apply -f kubernetes/` 报 ingress 错误 | 误把 examples 里的 ingress 一起 apply 了 | 只 apply 根目录的 yaml，ingress 单独处理 |
kubernetes/deployment.yaml
+14 -14
View File
@@ -1,4 +1,4 @@
# opsx-loki 平台本体
# lokistack 平台本体
#
# 关键约束：
# 1) replicas 必须为 1：JSON DB 为单写者，多副本会互相覆盖。
@@ -8,28 +8,28 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: opsx-loki
name: lokistack
namespace: log
labels:
app: opsx-loki
app: lokistack
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: opsx-loki
app: lokistack
template:
metadata:
labels:
app: opsx-loki
app: lokistack
spec:
securityContext:
runAsUser: 1000
runAsGroup: 1000
fsGroup: 1000
containers:
- name: opsx-loki
- name: lokistack
image: lghost/lokistack:latest
imagePullPolicy: Always
ports:
@@ -38,12 +38,12 @@ spec:
env:
# 可选：指定 admin 初始密码。不设置则自动生成 16 位随机密码，
# 写入 PVC 的 initial-admin-password.txt 并打印到首次启动日志。
# 获取：kubectl -n log exec deploy/opsx-loki -- cat /app/data/initial-admin-password.txt
# 获取：kubectl -n log exec deploy/lokistack -- cat /app/data/initial-admin-password.txt
# 自定义：
# - name: ADMIN_INIT_PASSWORD
# valueFrom:
# secretKeyRef:
# name: opsxloki-secrets
# name: lokistack-secrets
# key: ADMIN_INIT_PASSWORD
# optional: true
- name: DATA_DIR
@@ -51,22 +51,22 @@ spec:
- name: JWT_SECRET
valueFrom:
secretKeyRef:
name: opsxloki-secrets
name: lokistack-secrets
key: JWT_SECRET
- name: ENCRYPTION_KEY
valueFrom:
secretKeyRef:
name: opsxloki-secrets
name: lokistack-secrets
key: ENCRYPTION_KEY
# 可选：挂载本地集群 kubeconfig 时启用
# - name: KUBECONFIG
# value: /home/opsxloki/.kube/config
# value: /home/lokistack/.kube/config
volumeMounts:
- name: data
mountPath: /app/data
# 可选：本地集群 kubeconfig（in-cluster 管理本集群时用）
# - name: kubeconfig
# mountPath: /home/opsxloki/.kube
# mountPath: /home/lokistack/.kube
# readOnly: true
readinessProbe:
httpGet:
@@ -91,7 +91,7 @@ spec:
volumes:
- name: data
persistentVolumeClaim:
claimName: opsxloki-data
claimName: lokistack-data
# - name: kubeconfig
# secret:
# secretName: opsxloki-kubeconfig
# secretName: lokistack-kubeconfig
kubernetes/examples/ingress-tke.yaml
+2 -2
View File
@@ -12,7 +12,7 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: opsx-loki
name: lokistack
namespace: log
annotations:
# CLB 健康检查（可选，TKE 默认会用 TCP 检查）
@@ -28,6 +28,6 @@ spec:
pathType: Prefix
backend:
service:
name: opsx-loki-nodeport # ← 必须是 NodePort 类型 Service
name: lokistack-nodeport # ← 必须是 NodePort 类型 Service
port:
number: 8080
kubernetes/examples/ingress.yaml
+3 -3
View File
@@ -4,7 +4,7 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: opsx-loki
name: lokistack
namespace: log
annotations:
# 阿里云 ALB 示例；其他云改成对应 ingressClass
@@ -12,13 +12,13 @@ metadata:
spec:
ingressClassName: alb
rules:
- host: opsx-loki.91ai.io
- host: lokistack.91ai.io
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: opsx-loki
name: lokistack
port:
number: 8080
kubernetes/examples/secret.example.yaml
+2 -2
View File
@@ -1,12 +1,12 @@
# 只做模板：不要提交真实密钥。
# 推荐直接用命令创建（避免密钥落盘到 Git）：
# kubectl -n log create secret generic opsxloki-secrets \
# kubectl -n log create secret generic lokistack-secrets \
# --from-literal=JWT_SECRET="$(openssl rand -hex 32)" \
# --from-literal=ENCRYPTION_KEY="$(openssl rand -hex 32)"
apiVersion: v1
kind: Secret
metadata:
name: opsxloki-secrets
name: lokistack-secrets
namespace: log
type: Opaque
stringData:
kubernetes/install.sh
+26 -26
View File
@@ -1,6 +1,6 @@
#!/usr/bin/env bash
# ============================================================================
# opsx-loki 一键部署
# lokistack 一键部署
#
# 自动适配：阿里云 ACK / 腾讯云 TKE / AWS EKS / 华为云 CCE / GCP GKE / 自建 K8s
# 命名空间固定：log
@@ -94,10 +94,10 @@ resolve_storage_class() {
#
# 代价：数据固定在一台节点，节点损毁需从备份恢复（README 有 CSI 备份说明）
# ============================================================================
LOCAL_SC_NAME="opsxloki-local"
LOCAL_PV_NAME="opsxloki-data-pv"
LOCAL_SC_NAME="lokistack-local"
LOCAL_PV_NAME="lokistack-data-pv"
LOCAL_PV_SIZE="${PV_SIZE:-30Gi}"
LOCAL_PV_PATH="${PV_PATH:-/var/lib/opsxloki-data}"
LOCAL_PV_PATH="${PV_PATH:-/var/lib/lokistack-data}"
pick_local_node() {
if [ -n "${NODE_NAME:-}" ]; then echo "${NODE_NAME}"; return 0; fi
@@ -129,7 +129,7 @@ kind: PersistentVolume
metadata:
name: ${LOCAL_PV_NAME}
labels:
app: opsx-loki
app: lokistack
spec:
capacity:
storage: ${LOCAL_PV_SIZE}
@@ -157,7 +157,7 @@ EOF
}
CLOUD="$(detect_cloud)"
info "opsx-loki 部署开始（namespace: ${NS}）"
info "lokistack 部署开始（namespace: ${NS}）"
info "集群: $(kubectl config current-context 2>/dev/null || echo unknown)"
info "平台: ${CLOUD}"
@@ -219,11 +219,11 @@ rand_hex() {
fi
}
if kubectl -n "${NS}" get secret opsxloki-secrets >/dev/null 2>&1; then
info "Secret opsxloki-secrets 已存在，跳过（不覆盖现有密钥）"
if kubectl -n "${NS}" get secret lokistack-secrets >/dev/null 2>&1; then
info "Secret lokistack-secrets 已存在，跳过（不覆盖现有密钥）"
else
info "生成随机密钥 JWT_SECRET / ENCRYPTION_KEY"
kubectl -n "${NS}" create secret generic opsxloki-secrets \
kubectl -n "${NS}" create secret generic lokistack-secrets \
--from-literal=JWT_SECRET="$(rand_hex)" \
--from-literal=ENCRYPTION_KEY="$(rand_hex)" >/dev/null
ok "Secret 已创建"
@@ -256,33 +256,33 @@ fi
# 5) 等待就绪（失败时给出按云定制的诊断）
# ============================================================================
info "等待 Deployment 就绪（最多 180 秒）..."
if ! kubectl -n "${NS}" rollout status deployment/opsx-loki --timeout=180s; then
if ! kubectl -n "${NS}" rollout status deployment/lokistack --timeout=180s; then
echo ""
warn "部署未在 180 秒内就绪，开始诊断："
echo ""
kubectl -n "${NS}" get po -l app=opsx-loki -o wide 2>/dev/null | sed 's/^/ /'
kubectl -n "${NS}" get po -l app=lokistack -o wide 2>/dev/null | sed 's/^/ /'
REASON=$(kubectl -n "${NS}" get po -l app=opsx-loki -o jsonpath='{.items[0].status.containerStatuses[0].state.waiting.reason}' 2>/dev/null || true)
REASON=$(kubectl -n "${NS}" get po -l app=lokistack -o jsonpath='{.items[0].status.containerStatuses[0].state.waiting.reason}' 2>/dev/null || true)
echo ""
case "${REASON}" in
ImagePullBackOff|ErrImagePull)
warn "镜像拉取失败（${REASON}）"
echo " → 当前镜像: $(grep -E '^\s+image:' "${DIR}/deployment.yaml" | head -1 | awk '{print $2}')"
echo " → 该节点拉不到 Docker Hub。请改为目标云可拉的仓库后重跑："
echo " 腾讯云 TCR : ccr.ccs.tencentyun.com/<ns>/opsxloki:latest"
echo " 阿里云 ACR : registry.cn-hangzhou.aliyuncs.com/<ns>/opsxloki:latest"
echo " 华为云 SWR : swr.cn-north-4.myhuaweicloud.com/<ns>/opsxloki:latest"
echo " 自建 Harbor: harbor.your.domain/library/opsxloki:latest"
echo " 腾讯云 TCR : ccr.ccs.tencentyun.com/<ns>/lokistack:latest"
echo " 阿里云 ACR : registry.cn-hangzhou.aliyuncs.com/<ns>/lokistack:latest"
echo " 华为云 SWR : swr.cn-north-4.myhuaweicloud.com/<ns>/lokistack:latest"
echo " 自建 Harbor: harbor.your.domain/library/lokistack:latest"
;;
CreateContainerConfigError)
warn "容器配置缺失（通常是 Secret 不存在）"
echo " → 检查: kubectl -n ${NS} get secret opsxloki-secrets"
echo " → 检查: kubectl -n ${NS} get secret lokistack-secrets"
;;
"")
PVC_PHASE=$(kubectl -n "${NS}" get pvc opsxloki-data -o jsonpath='{.status.phase}' 2>/dev/null || echo unknown)
PVC_PHASE=$(kubectl -n "${NS}" get pvc lokistack-data -o jsonpath='{.status.phase}' 2>/dev/null || echo unknown)
if [ "${PVC_PHASE}" != "Bound" ]; then
warn "PVC 未绑定（phase=${PVC_PHASE}）"
echo " → 检查 StorageClass: kubectl -n ${NS} describe pvc opsxloki-data"
echo " → 检查 StorageClass: kubectl -n ${NS} describe pvc lokistack-data"
echo " → ${CLOUD} 建议的 SC："
case "${CLOUD}" in
腾讯云*) echo " cbs" ;;
@@ -296,7 +296,7 @@ if ! kubectl -n "${NS}" rollout status deployment/opsx-loki --timeout=180s; then
esac
echo ""
kubectl -n "${NS}" describe po -l app=opsx-loki 2>/dev/null | tail -15 | sed 's/^/ /'
kubectl -n "${NS}" describe po -l app=lokistack 2>/dev/null | tail -15 | sed 's/^/ /'
die "部署未完成，请按上面提示处理"
fi
ok "Deployment 已就绪"
@@ -304,24 +304,24 @@ ok "Deployment 已就绪"
# ============================================================================
# 6) 输出访问信息
# ============================================================================
POD=$(kubectl -n "${NS}" get po -l app=opsx-loki -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || echo "-")
POD_IP=$(kubectl -n "${NS}" get po -l app=opsx-loki -o jsonpath='{.items[0].status.podIP}' 2>/dev/null || echo "-")
NODE=$(kubectl -n "${NS}" get po -l app=opsx-loki -o jsonpath='{.items[0].spec.nodeName}' 2>/dev/null || echo "-")
POD=$(kubectl -n "${NS}" get po -l app=lokistack -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || echo "-")
POD_IP=$(kubectl -n "${NS}" get po -l app=lokistack -o jsonpath='{.items[0].status.podIP}' 2>/dev/null || echo "-")
NODE=$(kubectl -n "${NS}" get po -l app=lokistack -o jsonpath='{.items[0].spec.nodeName}' 2>/dev/null || echo "-")
echo ""
echo "════════════════════════════════════════════════════════"
ok "opsx-loki 部署完成"
ok "lokistack 部署完成"
echo "════════════════════════════════════════════════════════"
echo " 平台 : ${CLOUD}"
echo " Namespace : ${NS}"
echo " 存储类 : ${RESOLVED_SC}"
echo " Pod : ${POD} (node=${NODE} ip=${POD_IP})"
echo " Service : opsx-loki.${NS}.svc.cluster.local:8080"
echo " Service : lokistack.${NS}.svc.cluster.local:8080"
[ "${WITH_NODEPORT}" = "1" ] && echo " NodePort : <任意节点IP>:30080"
echo ""
echo " 初始账号 : admin / admin123 ← 首次登录请立即改密"
echo ""
echo " 本地访问 : kubectl -n ${NS} port-forward svc/opsx-loki 8080:8080"
echo " 本地访问 : kubectl -n ${NS} port-forward svc/lokistack 8080:8080"
echo " 浏览器打开 http://localhost:8080"
echo ""
echo " 配 Ingress（可选，先跑 WITH_NODEPORT=1 bash install.sh）："
kubernetes/pvc.yaml
+1 -1
View File
@@ -5,7 +5,7 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: opsxloki-data
name: lokistack-data
namespace: log
spec:
accessModes:
kubernetes/service-nodeport.yaml
+3 -3
View File
@@ -1,14 +1,14 @@
apiVersion: v1
kind: Service
metadata:
name: opsx-loki-nodeport
name: lokistack-nodeport
namespace: log
labels:
app: opsx-loki
app: lokistack
spec:
type: NodePort
selector:
app: opsx-loki
app: lokistack
ports:
- name: http
port: 8080
kubernetes/service.yaml
+3 -3
View File
@@ -1,14 +1,14 @@
apiVersion: v1
kind: Service
metadata:
name: opsx-loki
name: lokistack
namespace: log
labels:
app: opsx-loki
app: lokistack
spec:
type: ClusterIP
selector:
app: opsx-loki
app: lokistack
ports:
- name: http
port: 8080