feat: 运维标杆化打磨 P0/P1/P2 —— 审计日志、真实指标、备份恢复、菜单收敛
审计发现 5 处硬伤（/metrics 空壳、零备份、prod 双副本数据分裂、零审计、资源偏紧），
本轮全部落地。
=== P0-1 真实 /metrics（原来是空壳）===
原实现只返回一行注释 `# LokiStack Metrics`，注释却写着"可被 Prometheus 抓取"，
平台挂了/DB 写不进去/告警引擎卡死都只能靠用户反馈。
现接入 prometheus/client_golang，四层指标：
HTTP : lokistack_http_requests_total / _duration_seconds / _in_flight_requests
存储 : lokistack_db_size_bytes / _db_save_duration_seconds / _db_save_total / _db_records
业务 : lokistack_deployments{status,mode} / lokistack_collectors{status,type,run_mode}
后台任务: lokistack_alert_evaluations_total / _duration_seconds / lokistack_loki_queries_total
+ go_* / process_*（GoCollector、ProcessCollector）
关键点：path 标签用 c.FullPath() 路由模板，不用原始 URL —— 否则 117 个 Deployment
会把 Prometheus 基数炸掉。指标定义下沉 pkg/metrics 叶子包，避开
services ↔ repository 循环依赖。
=== P0-2 备份与恢复（原来 0 处代码）===
平台全部状态在 /app/data/opsxloki.json（51KB）+ kubeconfigs/ + known_hosts/，
DB 丢了 = 失去"这些资源是谁建的"的映射，从此无法管理/卸载/升级在跑的 Loki。
CLI : lokistack backup --output <path> / restore <pkg> / self-check / version
API : GET /system/backup（下载）/ POST /system/restore（校验暂存）/
POST /system/restore/apply（确认应用）/ GET /system/backups
K8s : kubernetes/pdb-backup.yaml —— 每日 03:30 CronJob，保留最近 7 份
安全设计：
- manifest.json 记录 ENCRYPTION_KEY 的 sha256 前 16 位**指纹**，用于恢复时
校验"这把钥匙能不能解开这份备份"，不泄露密钥本身
- 恢复分两步（校验暂存 → 确认应用），应用前自动把当前 DB 备份为
opsxloki.json.before-restore.<时间戳>
- 包内不含明文密钥（kubeconfig 本就是加密态）
=== P0-3 prod compose 双副本 → 单副本 ===
lokistack-1 / lokistack-2 各挂独立数据卷 + nginx 轮询 = 数据分裂：
页面刷新两次可能看到不同结果，写操作只落一个副本。不是高可用。
已改单实例（nginx 仅做反代），文件顶部与 nginx.conf 都写明原因。
=== P0-4 操作审计日志（借鉴 /usr/local/src/aiops 的字段口径）===
aiops 是每个 controller 各写 recordXxxAudit()；本平台有 60+ 写接口，
逐个埋点必然漏，漏掉的那个恰好最危险（删集群、改存储凭证）。
改为 **gin 中间件统一记录** + handler 通过 SetAudit 补充业务语义：
models/audit.go : 字段对齐 aiops，另加 Method/Path/Before/After
services/audit.go : 写入 + 90 天/2 万条自动裁剪 + 脱敏 + diff 生成
middleware/audit.go : 自动识别 module/action/resource，跳过只读接口
controllers/audit.go: 列表/详情/统计（仅 admin）
敏感字段（password/secretKey/privateKey/token）写入前统一替换为 ***。
=== P1 稳定性 ===
- 平台资源 1C/1Gi → 4C/4Gi 限（500m/512Mi 请求）：JSON DB 全量读写 +
每分钟告警评估 + 批量发布并发，1Gi 会 OOM
- terminationGracePeriodSeconds: 30 —— 收到 SIGTERM 要等 DB 完整落盘，
否则 kubelet SIGKILL 会把 JSON 写一半（全库丢失）
- liveness timeoutSeconds 10s（默认 1s 写盘时会被误杀）
- PDB minAvailable: 0 —— 让 kubectl drain 正确等待重建，不卡维护
- DB schemaVersion + migrateSchema() 版本递进迁移（原先加字段全靠零值兜底）
- scripts/release.sh —— 不可变 tag <版本>-<日期>-<commit> + IfNotPresent，
根治 latest 并发构建互相覆盖导致的静默回滚（本项目已实际踩过）
- PVC 保持 30Gi（按长期增长预留，云盘单价低，不做在线扩容）
=== P2 易用性 ===
- 一键自检 GET /system/self-check + 仪表盘自检卡：真实探活 Loki /ready、
集群凭据解密、磁盘空间、主机状态、近 24h 失败操作
- 审计日志页 /audit：统计卡 + 用户名/模块/结果筛选 + 变更前后 diff 弹窗
- 菜单收敛 13 → 7（页内 tab 切换，URL 全部不变）：
资源接入 = 集群 + 主机 + 存储
日志服务 = Loki 实例 + 采集器
日志 = 查询 + 分析
系统管理 = 用户 + 审计 + 设置
新增 GroupTabs 组件 + meta.group/groupKey，侧栏按分组去重并正确高亮
测试：go vet 通过、go test 全绿、tsc 通过
This commit is contained in:
opsx committed
1 parent
f6af12a731
commit
b49677f6a6
37 files changed
+2983
-147
No files matched your search
@@ -0,0 +1,71 @@
|
||||
package controllers
|
||||
|
||||
import (
|
||||
"strconv"
|
||||
"time"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
|
||||
"lokistack/models"
|
||||
"lokistack/services"
|
||||
"lokistack/utils"
|
||||
)
|
||||
|
||||
// AuditController 审计日志查询（仅管理员）
|
||||
type AuditController struct{}
|
||||
|
||||
func NewAuditController() *AuditController { return &AuditController{} }
|
||||
|
||||
// List 分页查询审计日志
|
||||
// GET /api/v1/audit-logs?page=1&pageSize=20&username=&module=&action=&status=0&startTime=&endTime=
|
||||
func (ctrl *AuditController) List(c *gin.Context) {
|
||||
page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
|
||||
pageSize, _ := strconv.Atoi(c.DefaultQuery("pageSize", "20"))
|
||||
if pageSize <= 0 || pageSize > 200 {
|
||||
pageSize = 20
|
||||
}
|
||||
status, _ := strconv.Atoi(c.DefaultQuery("status", "0"))
|
||||
|
||||
q := models.AuditQuery{
|
||||
Username: c.Query("username"),
|
||||
Module: c.Query("module"),
|
||||
Action: c.Query("action"),
|
||||
ResourceID: c.Query("resourceId"),
|
||||
Status: status,
|
||||
Page: page,
|
||||
PageSize: pageSize,
|
||||
}
|
||||
if v := c.Query("startTime"); v != "" {
|
||||
if t, err := time.Parse(time.RFC3339, v); err == nil {
|
||||
q.StartTime = &t
|
||||
}
|
||||
}
|
||||
if v := c.Query("endTime"); v != "" {
|
||||
if t, err := time.Parse(time.RFC3339, v); err == nil {
|
||||
q.EndTime = &t
|
||||
}
|
||||
}
|
||||
|
||||
list, total := services.ListAuditLogs(q)
|
||||
utils.Success(c, gin.H{"list": list, "total": total, "page": page, "pageSize": pageSize})
|
||||
}
|
||||
|
||||
// Get 审计详情（含 Before/After 完整内容）
|
||||
func (ctrl *AuditController) Get(c *gin.Context) {
|
||||
id, err := utils.IntParam(c, "id")
|
||||
if err != nil {
|
||||
utils.BadRequest(c, "ID 无效")
|
||||
return
|
||||
}
|
||||
entry, err := services.GetAuditLog(uint(id))
|
||||
if err != nil {
|
||||
utils.NotFound(c, err.Error())
|
||||
return
|
||||
}
|
||||
utils.Success(c, entry)
|
||||
}
|
||||
|
||||
// Stats 统计卡片
|
||||
func (ctrl *AuditController) Stats(c *gin.Context) {
|
||||
utils.Success(c, services.AuditStatistics())
|
||||
}
|
||||
@@ -0,0 +1,91 @@
|
||||
package controllers
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"time"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
|
||||
"lokistack/services"
|
||||
"lokistack/utils"
|
||||
)
|
||||
|
||||
// SystemController 系统级运维操作：备份 / 恢复 / 巡检。
|
||||
type SystemController struct{}
|
||||
|
||||
func NewSystemController() *SystemController { return &SystemController{} }
|
||||
|
||||
// Backup 导出当前平台数据（tar.gz 下载）。
|
||||
//
|
||||
// 内容：数据文件 + kubeconfigs/ + known_hosts/ + manifest.json（含密钥指纹），
|
||||
// 不含明文密钥。恢复必须使用同一把 ENCRYPTION_KEY。
|
||||
func (ctrl *SystemController) Backup(c *gin.Context) {
|
||||
name := fmt.Sprintf("lokistack-backup-%s.tar.gz", time.Now().Format("20060102-150405"))
|
||||
c.Header("Content-Type", "application/gzip")
|
||||
c.Header("Content-Disposition", fmt.Sprintf(`attachment; filename="%s"`, name))
|
||||
|
||||
if _, err := services.CreateBackup(c.Writer); err != nil {
|
||||
// 已经写了响应头，无法再改状态码，只能把错误写进 body 尾部
|
||||
_, _ = c.Writer.WriteString(fmt.Sprintf("\n\n# 备份失败: %v", err))
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
// Restore 上传备份包：校验 + 暂存，**不直接覆盖**线上数据库。
|
||||
// 返回暂存路径与密钥指纹比对结果，由管理员确认后再调用 RestoreApply。
|
||||
func (ctrl *SystemController) Restore(c *gin.Context) {
|
||||
file, err := c.FormFile("file")
|
||||
if err != nil {
|
||||
utils.BadRequest(c, "请上传备份文件（form-data 字段名 file）")
|
||||
return
|
||||
}
|
||||
if file.Size > 128<<20 {
|
||||
utils.BadRequest(c, "备份文件超过 128MB，请用 run.sh restore 在服务器上操作")
|
||||
return
|
||||
}
|
||||
f, err := file.Open()
|
||||
if err != nil {
|
||||
utils.InternalServerError(c, fmt.Sprintf("读取上传文件失败: %v", err))
|
||||
return
|
||||
}
|
||||
defer f.Close()
|
||||
|
||||
res, err := services.ValidateAndStageBackup(f)
|
||||
if err != nil {
|
||||
utils.BadRequest(c, fmt.Sprintf("备份校验失败: %v", err))
|
||||
return
|
||||
}
|
||||
utils.Success(c, res)
|
||||
}
|
||||
|
||||
// RestoreApply 应用已暂存的备份。应用后需重启平台进程才生效。
|
||||
func (ctrl *SystemController) RestoreApply(c *gin.Context) {
|
||||
var req struct {
|
||||
Confirm bool `json:"confirm"`
|
||||
}
|
||||
_ = c.ShouldBindJSON(&req)
|
||||
if !req.Confirm {
|
||||
utils.BadRequest(c, "恢复会覆盖当前全部数据，请传 confirm=true 确认")
|
||||
return
|
||||
}
|
||||
path, err := services.ApplyStagedBackup()
|
||||
if err != nil {
|
||||
utils.BadRequest(c, err.Error())
|
||||
return
|
||||
}
|
||||
utils.Success(c, gin.H{
|
||||
"message": "备份已应用，请重启平台使新数据生效（kubectl -n log rollout restart deploy/lokistack）",
|
||||
"dbPath": path,
|
||||
})
|
||||
}
|
||||
|
||||
// Backups 列出服务器上已有的备份文件（run.sh backup 产出）。
|
||||
func (ctrl *SystemController) Backups(c *gin.Context) {
|
||||
utils.Success(c, gin.H{"list": services.ListBackups()})
|
||||
}
|
||||
|
||||
// Health 平台自检：一键诊断用。
|
||||
// 聚合「能不能用」的判断，避免排障时在多个页面之间跳。
|
||||
func (ctrl *SystemController) Health(c *gin.Context) {
|
||||
utils.Success(c, services.SelfCheck())
|
||||
}
|
||||
@@ -19,8 +19,10 @@ require (
|
||||
|
||||
require (
|
||||
github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
|
||||
github.com/beorn7/perks v1.0.1 // indirect
|
||||
github.com/bytedance/sonic v1.12.6 // indirect
|
||||
github.com/bytedance/sonic/loader v0.2.1 // indirect
|
||||
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
||||
github.com/cloudwego/base64x v0.1.4 // indirect
|
||||
github.com/cloudwego/iasm v0.2.0 // indirect
|
||||
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
||||
@@ -43,6 +45,7 @@ require (
|
||||
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
|
||||
github.com/josharian/intern v1.0.0 // indirect
|
||||
github.com/json-iterator/go v1.1.12 // indirect
|
||||
github.com/klauspost/compress v1.17.9 // indirect
|
||||
github.com/klauspost/cpuid/v2 v2.2.9 // indirect
|
||||
github.com/leodido/go-urn v1.4.0 // indirect
|
||||
github.com/mailru/easyjson v0.7.7 // indirect
|
||||
@@ -55,6 +58,10 @@ require (
|
||||
github.com/pelletier/go-toml/v2 v2.2.3 // indirect
|
||||
github.com/pkg/errors v0.9.1 // indirect
|
||||
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
|
||||
github.com/prometheus/client_golang v1.20.5 // indirect
|
||||
github.com/prometheus/client_model v0.6.1 // indirect
|
||||
github.com/prometheus/common v0.55.0 // indirect
|
||||
github.com/prometheus/procfs v0.15.1 // indirect
|
||||
github.com/spf13/pflag v1.0.7 // indirect
|
||||
github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
|
||||
github.com/ugorji/go/codec v1.2.12 // indirect
|
||||
|
||||
@@ -4,11 +4,15 @@ github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e h1:4dAU9FXIyQktp
|
||||
github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
|
||||
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
|
||||
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
|
||||
github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
|
||||
github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
|
||||
github.com/bytedance/sonic v1.12.6 h1:/isNmCUF2x3Sh8RAp/4mh4ZGkcFAX/hLrzrK3AvpRzk=
|
||||
github.com/bytedance/sonic v1.12.6/go.mod h1:B8Gt/XvtZ3Fqj+iSKMypzymZxw/FVwgIGKzMzT9r/rk=
|
||||
github.com/bytedance/sonic/loader v0.1.1/go.mod h1:ncP89zfokxS5LZrJxl5z0UJcsk4M4yY2JpfqGeCtNLU=
|
||||
github.com/bytedance/sonic/loader v0.2.1 h1:1GgorWTqf12TA8mma4DDSbaQigE2wOgQo7iCjjJv3+E=
|
||||
github.com/bytedance/sonic/loader v0.2.1/go.mod h1:ncP89zfokxS5LZrJxl5z0UJcsk4M4yY2JpfqGeCtNLU=
|
||||
github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
|
||||
github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
|
||||
github.com/cloudwego/base64x v0.1.4 h1:jwCgWpFanWmN8xoIUHa2rtzmkd5J2plF/dnLS6Xd/0Y=
|
||||
github.com/cloudwego/base64x v0.1.4/go.mod h1:0zlkT4Wn5C6NdauXdJRhSKRlJvmclQ1hhJgA0rcu/8w=
|
||||
github.com/cloudwego/iasm v0.2.0 h1:1KNIy1I1H9hNNFEEH3DVnI4UujN+1zjpuk6gwHLTssg=
|
||||
@@ -92,6 +96,8 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnr
|
||||
github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
|
||||
github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
|
||||
github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
|
||||
github.com/klauspost/compress v1.17.9 h1:6KIumPrER1LHsvBVuDa0r5xaG0Es51mhhB9BQB2qeMA=
|
||||
github.com/klauspost/compress v1.17.9/go.mod h1:Di0epgTjJY877eYKx5yC51cX2A2Vl2ibi7bDH9ttBbw=
|
||||
github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
|
||||
github.com/klauspost/cpuid/v2 v2.2.9 h1:66ze0taIn2H33fBvCkXuv9BmCwDfafmiIVpKV9kKGuY=
|
||||
github.com/klauspost/cpuid/v2 v2.2.9/go.mod h1:rqkxqrZ1EhYM9G+hXH7YdowN5R5RGN6NK4QwQ3WMXF8=
|
||||
@@ -132,6 +138,14 @@ github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
|
||||
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
|
||||
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||
github.com/prometheus/client_golang v1.20.5 h1:cxppBPuYhUnsO6yo/aoRol4L7q7UFfdm+bR9r+8l63Y=
|
||||
github.com/prometheus/client_golang v1.20.5/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=
|
||||
github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
|
||||
github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
|
||||
github.com/prometheus/common v0.55.0 h1:KEi6DK7lXW/m7Ig5i47x0vRzuBsHuvJdi5ee6Y3G1dc=
|
||||
github.com/prometheus/common v0.55.0/go.mod h1:2SECS4xJG1kd8XF9IcM1gMX6510RAEL65zxzNImwdc8=
|
||||
github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
|
||||
github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
|
||||
github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
|
||||
github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
|
||||
github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M=
|
||||
|
||||
@@ -2,11 +2,14 @@ package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"log"
|
||||
"net/http"
|
||||
"os"
|
||||
"os/signal"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"syscall"
|
||||
"time"
|
||||
@@ -20,7 +23,89 @@ import (
|
||||
"lokistack/services"
|
||||
)
|
||||
|
||||
// version 由构建注入（-ldflags "-X main.version=..."），未注入时为 dev
|
||||
var version = "2.0.0"
|
||||
|
||||
// runCLI 提供不依赖 Web 的运维命令（备份 CronJob、恢复、自检都走它）。
|
||||
//
|
||||
// lokistack backup --output /app/data/backups/xxx.tar.gz
|
||||
// lokistack restore <备份包路径> # 校验 + 立即应用（会先备份当前 DB）
|
||||
// lokistack self-check # 打印 JSON 自检结果
|
||||
func runCLI(args []string) {
|
||||
switch args[0] {
|
||||
case "backup":
|
||||
out := ""
|
||||
for i := 1; i < len(args); i++ {
|
||||
if args[i] == "--output" && i+1 < len(args) {
|
||||
out = args[i+1]
|
||||
}
|
||||
}
|
||||
if out == "" {
|
||||
out = "/app/data/backups/lokistack-" + time.Now().Format("20060102-150405") + ".tar.gz"
|
||||
}
|
||||
if err := os.MkdirAll(filepath.Dir(out), 0o700); err != nil {
|
||||
fmt.Fprintf(os.Stderr, "创建备份目录失败: %v\n", err)
|
||||
os.Exit(1)
|
||||
}
|
||||
f, err := os.Create(out)
|
||||
if err != nil {
|
||||
fmt.Fprintf(os.Stderr, "创建备份文件失败: %v\n", err)
|
||||
os.Exit(1)
|
||||
}
|
||||
defer f.Close()
|
||||
m, err := services.CreateBackup(f)
|
||||
if err != nil {
|
||||
fmt.Fprintf(os.Stderr, "备份失败: %v\n", err)
|
||||
os.Exit(1)
|
||||
}
|
||||
fmt.Printf("备份完成: %s\n记录数: %d\n密钥指纹: %s\n", out, m.RecordCount, m.KeyFP)
|
||||
|
||||
case "restore":
|
||||
if len(args) < 2 {
|
||||
fmt.Fprintln(os.Stderr, "用法: lokistack restore <备份包.tar.gz>")
|
||||
os.Exit(1)
|
||||
}
|
||||
f, err := os.Open(args[1])
|
||||
if err != nil {
|
||||
fmt.Fprintf(os.Stderr, "打开备份失败: %v\n", err)
|
||||
os.Exit(1)
|
||||
}
|
||||
defer f.Close()
|
||||
res, err := services.ValidateAndStageBackup(f)
|
||||
if err != nil {
|
||||
fmt.Fprintf(os.Stderr, "校验失败: %v\n", err)
|
||||
os.Exit(1)
|
||||
}
|
||||
if res.Warning != "" {
|
||||
fmt.Fprintf(os.Stderr, "⚠️ %s\n", res.Warning)
|
||||
}
|
||||
path, err := services.ApplyStagedBackup()
|
||||
if err != nil {
|
||||
fmt.Fprintf(os.Stderr, "应用失败: %v\n", err)
|
||||
os.Exit(1)
|
||||
}
|
||||
fmt.Printf("恢复完成: %s（备份 %d 条记录）\n请重启平台进程使新数据生效。\n", path, res.RowsInBackup)
|
||||
|
||||
case "self-check":
|
||||
b, _ := json.MarshalIndent(services.SelfCheck(), "", " ")
|
||||
fmt.Println(string(b))
|
||||
|
||||
case "version":
|
||||
fmt.Println(version)
|
||||
|
||||
default:
|
||||
fmt.Fprintf(os.Stderr, "未知命令 %q。可用: backup / restore / self-check / version\n", args[0])
|
||||
os.Exit(1)
|
||||
}
|
||||
}
|
||||
|
||||
func main() {
|
||||
// 运维命令行：支持在容器/CronJob 里不经 Web 完成备份/恢复/自检
|
||||
if len(os.Args) > 1 {
|
||||
runCLI(os.Args[1:])
|
||||
return
|
||||
}
|
||||
|
||||
cfg := config.GetConfig()
|
||||
|
||||
// gin 默认是 debug 模式：每次启动会把上百行路由表 dump 到日志里，
|
||||
@@ -35,6 +120,10 @@ func main() {
|
||||
log.Fatalf("Failed to init DB: %v", err)
|
||||
}
|
||||
|
||||
// 指标注册要早于任何可能埋点的组件（middleware / alert engine）
|
||||
services.InitMetrics(version)
|
||||
log.Println("Metrics enabled at /api/v1/metrics")
|
||||
|
||||
log.Println("Seeding default data...")
|
||||
seed.Seed()
|
||||
|
||||
|
||||
@@ -0,0 +1,206 @@
|
||||
package middleware
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
|
||||
"lokistack/models"
|
||||
"lokistack/services"
|
||||
)
|
||||
|
||||
// AuditInfo 由 controller 主动补充的业务语义。
|
||||
//
|
||||
// 中间件已经能自动记录 method/path/status/耗时/IP/用户，
|
||||
// 但「改了哪个部署」「保留天数 7 → 3」这类信息只有 handler 自己知道，
|
||||
// 所以提供 SetAudit 让 handler 补一刀，不补也能记全（只是 Detail 为空）。
|
||||
type AuditInfo struct {
|
||||
Module string
|
||||
Action string
|
||||
Resource string
|
||||
ResourceID string
|
||||
Detail string
|
||||
Before string
|
||||
After string
|
||||
// Skip 置 true 表示这条请求不记（例如纯查询用了 POST 的场景）
|
||||
Skip bool
|
||||
}
|
||||
|
||||
const auditInfoKey = "audit.info"
|
||||
|
||||
// SetAudit 由 controller 调用，补充审计语义。
|
||||
func SetAudit(c *gin.Context, info AuditInfo) {
|
||||
c.Set(auditInfoKey, info)
|
||||
}
|
||||
|
||||
// auditSkipPaths 这些路径不记审计：
|
||||
// - 健康检查 / metrics：高频噪音
|
||||
// - 日志查询：GET 本来就不记，但 /logs/query 之类用 POST 的也不记（只读）
|
||||
var auditSkipPrefixes = []string{
|
||||
"/api/v1/health",
|
||||
"/api/v1/metrics",
|
||||
"/api/v1/logs/query",
|
||||
"/api/v1/logs/stats",
|
||||
"/api/v1/logs/histogram",
|
||||
"/api/v1/logs/labels",
|
||||
"/api/v1/logs/label",
|
||||
"/api/v1/logs/context",
|
||||
"/api/v1/logs/volume",
|
||||
"/api/v1/logs/my-scope",
|
||||
"/api/v1/deployments/", // 例外：其中 /deploy /stop /restart 要记，见下方白名单
|
||||
}
|
||||
|
||||
// auditAlwaysRecord 匹配到的路径即使在上面的 skip 前缀里也要记。
|
||||
var auditAlwaysRecordSuffixes = []string{
|
||||
"/deploy", "/stop", "/restart", "/install", "/uninstall", "/test", "/validate",
|
||||
"/preview", "/rollback", "/reset-password", "/backup", "/restore",
|
||||
}
|
||||
|
||||
// AuditLog 审计中间件：自动记录所有写操作（POST / PUT / PATCH / DELETE）。
|
||||
//
|
||||
// 为什么用中间件而不是每个 controller 各写一段：
|
||||
// - LokiStack 有 60+ 个写接口，逐个埋点必然漏，漏掉的那个恰好最危险（删集群、改存储）
|
||||
// - 中间件能拿到统一的 status / 耗时 / IP / UA
|
||||
// - handler 需要更细的语义时再 SetAudit 补，不补也有基础记录
|
||||
//
|
||||
// 不含请求体（读 body 会影响后续 binding），敏感字段由 handler 通过 SetAudit
|
||||
// 传入已脱敏的 Before/After。
|
||||
func AuditLog() gin.HandlerFunc {
|
||||
return func(c *gin.Context) {
|
||||
method := c.Request.Method
|
||||
// 只读请求不记（GET/HEAD/OPTIONS）
|
||||
if method == http.MethodGet || method == http.MethodHead || method == http.MethodOptions {
|
||||
c.Next()
|
||||
return
|
||||
}
|
||||
|
||||
path := c.Request.URL.Path
|
||||
if !shouldAudit(path) {
|
||||
c.Next()
|
||||
return
|
||||
}
|
||||
|
||||
start := time.Now()
|
||||
c.Next()
|
||||
elapsed := time.Since(start).Milliseconds()
|
||||
|
||||
info, _ := c.Get(auditInfoKey)
|
||||
ai, _ := info.(AuditInfo)
|
||||
if ai.Skip {
|
||||
return
|
||||
}
|
||||
|
||||
status := c.Writer.Status()
|
||||
userID, _ := c.Get("userId")
|
||||
username, _ := c.Get("username")
|
||||
role, _ := c.Get("role")
|
||||
|
||||
entry := models.AuditLog{
|
||||
IP: c.ClientIP(),
|
||||
UserAgent: c.Request.UserAgent(),
|
||||
Method: method,
|
||||
Path: path,
|
||||
Status: status,
|
||||
DurationMs: elapsed,
|
||||
Detail: ai.Detail,
|
||||
Before: ai.Before,
|
||||
After: ai.After,
|
||||
CreatedAt: time.Now(),
|
||||
}
|
||||
if v, ok := userID.(uint); ok {
|
||||
entry.UserID = v
|
||||
}
|
||||
if v, ok := username.(string); ok {
|
||||
entry.Username = v
|
||||
}
|
||||
if v, ok := role.(string); ok {
|
||||
entry.Role = v
|
||||
}
|
||||
|
||||
// 失败时把错误信息带上（gin 的 Error 里有 handler 写入的错误）
|
||||
if status >= 400 {
|
||||
if len(c.Errors) > 0 {
|
||||
entry.Error = c.Errors.String()
|
||||
}
|
||||
}
|
||||
|
||||
// handler 没补语义时按路径推断，保证「谁删了什么」至少能看出模块
|
||||
module, action, resource, resourceID := inferAuditFields(method, path)
|
||||
if ai.Module != "" {
|
||||
module = ai.Module
|
||||
}
|
||||
if ai.Action != "" {
|
||||
action = ai.Action
|
||||
}
|
||||
if ai.Resource != "" {
|
||||
resource = ai.Resource
|
||||
}
|
||||
if ai.ResourceID != "" {
|
||||
resourceID = ai.ResourceID
|
||||
}
|
||||
entry.Module, entry.Action, entry.Resource, entry.ResourceID = module, action, resource, resourceID
|
||||
|
||||
services.RecordAudit(entry)
|
||||
}
|
||||
}
|
||||
|
||||
func shouldAudit(path string) bool {
|
||||
for _, suffix := range auditAlwaysRecordSuffixes {
|
||||
if strings.HasSuffix(path, suffix) {
|
||||
return true
|
||||
}
|
||||
}
|
||||
for _, p := range auditSkipPrefixes {
|
||||
if strings.HasPrefix(path, p) {
|
||||
return false
|
||||
}
|
||||
}
|
||||
return true
|
||||
}
|
||||
|
||||
// inferAuditFields 从 method + path 推断模块与动作（handler 未补充时的兜底）。
|
||||
func inferAuditFields(method, path string) (module, action, resource, resourceID string) {
|
||||
action = map[string]string{
|
||||
http.MethodPost: "create",
|
||||
http.MethodPut: "update",
|
||||
http.MethodPatch: "update",
|
||||
http.MethodDelete: "delete",
|
||||
}[method]
|
||||
|
||||
segments := strings.Split(strings.Trim(path, "/"), "/")
|
||||
// /api/v1/<module>/<resource>/<id>
|
||||
if len(segments) >= 3 {
|
||||
module = segments[2]
|
||||
}
|
||||
if len(segments) >= 4 {
|
||||
resource = segments[3]
|
||||
resourceID = segments[4]
|
||||
}
|
||||
|
||||
// 语义化覆盖
|
||||
switch {
|
||||
case strings.HasSuffix(path, "/deploy"):
|
||||
action, resource = "deploy", "部署"
|
||||
case strings.HasSuffix(path, "/stop"):
|
||||
action, resource = "stop", "部署"
|
||||
case strings.HasSuffix(path, "/restart"):
|
||||
action, resource = "restart", "部署"
|
||||
case strings.HasSuffix(path, "/install"):
|
||||
action, resource = "install", "采集器"
|
||||
case strings.HasSuffix(path, "/uninstall"):
|
||||
action, resource = "uninstall", "采集器"
|
||||
case strings.HasSuffix(path, "/test"):
|
||||
action = "test"
|
||||
case strings.HasSuffix(path, "/validate"):
|
||||
action = "validate"
|
||||
case strings.HasSuffix(path, "/reset-password"):
|
||||
action, resource = "reset-password", "用户"
|
||||
case strings.HasSuffix(path, "/login"):
|
||||
module, action, resource = "auth", "login", "登录"
|
||||
case strings.HasSuffix(path, "/password"):
|
||||
module, action, resource = "auth", "change-password", "登录"
|
||||
}
|
||||
return module, action, resource, resourceID
|
||||
}
|
||||
@@ -0,0 +1,54 @@
|
||||
package middleware
|
||||
|
||||
import (
|
||||
"strconv"
|
||||
"time"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
|
||||
"lokistack/pkg/metrics"
|
||||
)
|
||||
|
||||
// Metrics 采集 HTTP 层指标。
|
||||
//
|
||||
// 关键点：path 标签用 **c.FullPath()（路由模板）**而不是原始 URL。
|
||||
// 原始 URL 带 ID/UUID，每个值都会新建一条时间序列 → Prometheus 基数爆炸
|
||||
// （本平台有 117 个 Deployment，光 /deployments/:id 就能炸出上千条）。
|
||||
func Metrics() gin.HandlerFunc {
|
||||
return func(c *gin.Context) {
|
||||
// 抓取端点与健康检查不计入，否则监控自身的流量会污染 QPS
|
||||
path := c.FullPath()
|
||||
if path == "/api/v1/metrics" || path == "/api/v1/health" {
|
||||
c.Next()
|
||||
return
|
||||
}
|
||||
|
||||
metrics.IncInFlight()
|
||||
start := time.Now()
|
||||
c.Next()
|
||||
metrics.DecInFlight()
|
||||
|
||||
label := path
|
||||
if label == "" {
|
||||
// 未匹配到路由（404），统一归到一个标签，避免任意 URL 打爆基数
|
||||
label = "unmatched"
|
||||
}
|
||||
metrics.ObserveHTTP(c.Request.Method, label, c.Writer.Status(), time.Since(start).Seconds())
|
||||
}
|
||||
}
|
||||
|
||||
// statusClass 给日志/看板用的状态分类（保留工具函数）
|
||||
func statusClass(code int) string {
|
||||
switch {
|
||||
case code < 300:
|
||||
return "2xx"
|
||||
case code < 400:
|
||||
return "3xx"
|
||||
case code < 500:
|
||||
return "4xx"
|
||||
default:
|
||||
return "5xx"
|
||||
}
|
||||
}
|
||||
|
||||
var _ = strconv.Itoa
|
||||
@@ -0,0 +1,80 @@
|
||||
package models
|
||||
|
||||
import "time"
|
||||
|
||||
// AuditLog 操作审计日志。
|
||||
//
|
||||
// 设计参考 /usr/local/src/aiops 的 audit_operation_logs（字段口径一致，
|
||||
// 便于两套运维工具链用同一套查询习惯与看板），差异有两点：
|
||||
//
|
||||
// 1. 多了 Method / Path / Before / After —— aiops 用 gorm 表，LokiStack 用 JSON 文件，
|
||||
// 没法靠 SQL 关联，所以把"改了什么"直接落到行上，查询时不用再回表。
|
||||
// 2. 不做 Response 全量落盘（Loki 日志响应动辄几百 KB，会撑爆 JSON DB），
|
||||
// 只留 Detail 摘要 + 结构化 diff。
|
||||
//
|
||||
// 敏感字段（password / secretKey / privateKey / token）在写入前统一脱敏，
|
||||
// 见 middleware.MaskAuditPayload。
|
||||
type AuditLog struct {
|
||||
ID uint `json:"id"`
|
||||
UserID uint `json:"userId"`
|
||||
Username string `json:"username"`
|
||||
Role string `json:"role,omitempty"`
|
||||
IP string `json:"ip"`
|
||||
// UserAgent 截断到 200 字符，避免个别客户端把 DB 撑大
|
||||
UserAgent string `json:"userAgent,omitempty"`
|
||||
|
||||
// Module 业务模块：deployment / collector / storage / host / cluster / user / policy / alert / system / auth
|
||||
Module string `json:"module"`
|
||||
// Action 动作：create / update / delete / deploy / install / uninstall / login / logout / test / reset
|
||||
Action string `json:"action"`
|
||||
// Resource 资源类型（中文可读名，如「部署」「采集器」）
|
||||
Resource string `json:"resource"`
|
||||
// ResourceID 资源 ID 或名称
|
||||
ResourceID string `json:"resourceId,omitempty"`
|
||||
|
||||
Method string `json:"method"`
|
||||
Path string `json:"path"`
|
||||
Status int `json:"status"`
|
||||
// DurationMs 处理耗时（毫秒）
|
||||
DurationMs int64 `json:"durationMs"`
|
||||
|
||||
// Detail 人类可读的一句话说明（如「修改保留天数 7 → 3」）
|
||||
Detail string `json:"detail,omitempty"`
|
||||
// Before / After 变更前后摘要（仅记录变更字段，已脱敏）
|
||||
Before string `json:"before,omitempty"`
|
||||
After string `json:"after,omitempty"`
|
||||
// Error 失败原因（status >= 400 时填）
|
||||
Error string `json:"error,omitempty"`
|
||||
|
||||
CreatedAt time.Time `json:"createdAt"`
|
||||
}
|
||||
|
||||
// AuditQuery 审计日志查询条件
|
||||
type AuditQuery struct {
|
||||
Username string
|
||||
Module string
|
||||
Action string
|
||||
ResourceID string
|
||||
// Status 0 = 全部；1 = 仅成功（2xx）；2 = 仅失败（>=400）
|
||||
Status int
|
||||
StartTime *time.Time
|
||||
EndTime *time.Time
|
||||
Page int
|
||||
PageSize int
|
||||
}
|
||||
|
||||
// AuditStats 审计统计（给审计页面顶部卡片用）
|
||||
type AuditStats struct {
|
||||
TodayCount int64 `json:"todayCount"`
|
||||
WeekCount int64 `json:"weekCount"`
|
||||
FailCount int64 `json:"failCount"`
|
||||
TotalCount int64 `json:"totalCount"`
|
||||
TopModules []AuditCount `json:"topModules"`
|
||||
TopUsers []AuditCount `json:"topUsers"`
|
||||
}
|
||||
|
||||
// AuditCount 分组计数
|
||||
type AuditCount struct {
|
||||
Name string `json:"name"`
|
||||
Count int64 `json:"count"`
|
||||
}
|
||||
@@ -0,0 +1,175 @@
|
||||
// Package metrics 定义 LokiStack 自身的 Prometheus 指标体系。
|
||||
//
|
||||
// 为什么单独成包：这些指标要同时被 repository（DB 落盘耗时）和
|
||||
// services（业务计数）以及 middleware（HTTP）使用，
|
||||
// 而 services 依赖 repository —— 指标定义必须放在最底层，否则循环依赖。
|
||||
package metrics
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"runtime"
|
||||
"strconv"
|
||||
"sync"
|
||||
|
||||
"github.com/prometheus/client_golang/prometheus"
|
||||
"github.com/prometheus/client_golang/prometheus/collectors"
|
||||
"github.com/prometheus/client_golang/prometheus/promhttp"
|
||||
)
|
||||
|
||||
var (
|
||||
// HTTP 层
|
||||
HTTPRequestsTotal = prometheus.NewCounterVec(
|
||||
prometheus.CounterOpts{
|
||||
Name: "lokistack_http_requests_total",
|
||||
Help: "HTTP 请求总数（按方法/路由模板/状态码）",
|
||||
},
|
||||
[]string{"method", "path", "status"},
|
||||
)
|
||||
HTTPRequestDuration = prometheus.NewHistogramVec(
|
||||
prometheus.HistogramOpts{
|
||||
Name: "lokistack_http_request_duration_seconds",
|
||||
Help: "HTTP 请求耗时分布",
|
||||
Buckets: []float64{0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10, 30},
|
||||
},
|
||||
[]string{"method", "path"},
|
||||
)
|
||||
HTTPInFlight = prometheus.NewGauge(
|
||||
prometheus.GaugeOpts{
|
||||
Name: "lokistack_http_in_flight_requests",
|
||||
Help: "当前正在处理的请求数",
|
||||
},
|
||||
)
|
||||
|
||||
// 存储层（JSON DB 是平台最大风险点：全量读内存、全量写盘）
|
||||
DBSizeBytes = prometheus.NewGauge(
|
||||
prometheus.GaugeOpts{
|
||||
Name: "lokistack_db_size_bytes",
|
||||
Help: "JSON 数据库文件大小",
|
||||
},
|
||||
)
|
||||
DBSaveDuration = prometheus.NewHistogram(
|
||||
prometheus.HistogramOpts{
|
||||
Name: "lokistack_db_save_duration_seconds",
|
||||
Help: "数据库落盘耗时",
|
||||
Buckets: []float64{0.001, 0.005, 0.01, 0.05, 0.1, 0.5, 1, 3, 5, 10},
|
||||
},
|
||||
)
|
||||
DBSaveTotal = prometheus.NewCounterVec(
|
||||
prometheus.CounterOpts{
|
||||
Name: "lokistack_db_save_total",
|
||||
Help: "数据库保存次数（按结果）",
|
||||
},
|
||||
[]string{"result"},
|
||||
)
|
||||
DBRecordsTotal = prometheus.NewGaugeVec(
|
||||
prometheus.GaugeOpts{
|
||||
Name: "lokistack_db_records",
|
||||
Help: "各集合的记录数",
|
||||
},
|
||||
[]string{"collection"},
|
||||
)
|
||||
|
||||
// 业务层
|
||||
DeploymentsTotal = prometheus.NewGaugeVec(
|
||||
prometheus.GaugeOpts{
|
||||
Name: "lokistack_deployments",
|
||||
Help: "Loki 部署数（按状态/运行模式）",
|
||||
},
|
||||
[]string{"status", "mode"},
|
||||
)
|
||||
CollectorsTotal = prometheus.NewGaugeVec(
|
||||
prometheus.GaugeOpts{
|
||||
Name: "lokistack_collectors",
|
||||
Help: "采集器数（按状态/类型/托管方式）",
|
||||
},
|
||||
[]string{"status", "type", "run_mode"},
|
||||
)
|
||||
|
||||
// 后台任务层
|
||||
AlertEvaluationsTotal = prometheus.NewCounterVec(
|
||||
prometheus.CounterOpts{
|
||||
Name: "lokistack_alert_evaluations_total",
|
||||
Help: "告警规则评估次数（按结果）",
|
||||
},
|
||||
[]string{"result"},
|
||||
)
|
||||
AlertEvaluationDuration = prometheus.NewHistogram(
|
||||
prometheus.HistogramOpts{
|
||||
Name: "lokistack_alert_evaluation_duration_seconds",
|
||||
Help: "单轮告警评估耗时",
|
||||
Buckets: []float64{0.01, 0.05, 0.1, 0.5, 1, 3, 5, 10, 30},
|
||||
},
|
||||
)
|
||||
LokiQueriesTotal = prometheus.NewCounterVec(
|
||||
prometheus.CounterOpts{
|
||||
Name: "lokistack_loki_queries_total",
|
||||
Help: "对后端 Loki 的查询次数（按结果）",
|
||||
},
|
||||
[]string{"result"},
|
||||
)
|
||||
|
||||
BuildInfo = prometheus.NewGaugeVec(
|
||||
prometheus.GaugeOpts{
|
||||
Name: "lokistack_build_info",
|
||||
Help: "构建信息（恒为 1，标签里带版本与 Go 版本）",
|
||||
},
|
||||
[]string{"version", "go_version"},
|
||||
)
|
||||
|
||||
once sync.Once
|
||||
)
|
||||
|
||||
// Register 注册全部指标（幂等）。version 一般传 main.version。
|
||||
func Register(version string) {
|
||||
once.Do(func() {
|
||||
prometheus.MustRegister(
|
||||
HTTPRequestsTotal, HTTPRequestDuration, HTTPInFlight,
|
||||
DBSizeBytes, DBSaveDuration, DBSaveTotal, DBRecordsTotal,
|
||||
DeploymentsTotal, CollectorsTotal,
|
||||
AlertEvaluationsTotal, AlertEvaluationDuration, LokiQueriesTotal,
|
||||
BuildInfo,
|
||||
collectors.NewGoCollector(),
|
||||
collectors.NewProcessCollector(collectors.ProcessCollectorOpts{}),
|
||||
)
|
||||
BuildInfo.WithLabelValues(version, runtime.Version()).Set(1)
|
||||
})
|
||||
}
|
||||
|
||||
// Handler 返回 Prometheus 抓取端点。
|
||||
func Handler() http.Handler { return promhttp.Handler() }
|
||||
|
||||
// ── 埋点辅助（各层直接调） ──
|
||||
|
||||
// ObserveHTTP 记录一次 HTTP 请求。pathLabel 必须是路由模板，不能用原始 URL。
|
||||
func ObserveHTTP(method, pathLabel string, status int, seconds float64) {
|
||||
HTTPRequestsTotal.WithLabelValues(method, pathLabel, strconv.Itoa(status)).Inc()
|
||||
HTTPRequestDuration.WithLabelValues(method, pathLabel).Observe(seconds)
|
||||
}
|
||||
|
||||
// IncInFlight / DecInFlight 在途请求计数。
|
||||
func IncInFlight() { HTTPInFlight.Inc() }
|
||||
func DecInFlight() { HTTPInFlight.Dec() }
|
||||
|
||||
// ObserveDBSave 记录一次落盘结果。
|
||||
func ObserveDBSave(seconds float64, ok bool) {
|
||||
DBSaveDuration.Observe(seconds)
|
||||
DBSaveTotal.WithLabelValues(resultLabel(ok)).Inc()
|
||||
}
|
||||
|
||||
// ObserveAlertEvaluation 记录一轮告警评估。
|
||||
func ObserveAlertEvaluation(seconds float64, ok bool) {
|
||||
AlertEvaluationDuration.Observe(seconds)
|
||||
AlertEvaluationsTotal.WithLabelValues(resultLabel(ok)).Inc()
|
||||
}
|
||||
|
||||
// ObserveLokiQuery 记录一次后端 Loki 查询。
|
||||
func ObserveLokiQuery(ok bool) {
|
||||
LokiQueriesTotal.WithLabelValues(resultLabel(ok)).Inc()
|
||||
}
|
||||
|
||||
func resultLabel(ok bool) string {
|
||||
if ok {
|
||||
return "success"
|
||||
}
|
||||
return "error"
|
||||
}
|
||||
@@ -3,6 +3,7 @@ package repository
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"log"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"sync"
|
||||
@@ -10,6 +11,7 @@ import (
|
||||
|
||||
"lokistack/config"
|
||||
"lokistack/models"
|
||||
"lokistack/pkg/metrics"
|
||||
)
|
||||
|
||||
// saveRequest 表示一个保存请求，通过channel序列化
|
||||
@@ -35,6 +37,14 @@ type JsonDB struct {
|
||||
AlertDeliveries []models.AlertDelivery `json:"alertDeliveries"`
|
||||
NotifyChannels []models.NotifyChannel `json:"notifyChannels"`
|
||||
LogPolicyGroups []models.LogPolicyGroup `json:"logPolicyGroups"`
|
||||
// AuditLogs 操作审计日志（保留期 90 天 / 上限 2 万条，见 services.auditRetention）
|
||||
AuditLogs []models.AuditLog `json:"auditLogs"`
|
||||
|
||||
// SchemaVersion 数据结构版本号。
|
||||
// 之前加字段全靠 JSON 反序列化的零值兜底，字段一多必然出事
|
||||
// （例如新增 ScrapeJobs 时老数据要手写兼容）。有了版本号，
|
||||
// 以后的结构变更可以在 InitDB 里按版本号顺序迁移，可测、可回滚。
|
||||
SchemaVersion int `json:"schemaVersion"`
|
||||
sequences map[string]uint
|
||||
|
||||
// 防抖保存机制
|
||||
@@ -51,6 +61,41 @@ func GetDB() *JsonDB {
|
||||
return db
|
||||
}
|
||||
|
||||
// CurrentSchemaVersion 当前数据结构版本。
|
||||
// 每次做**不兼容**的结构变更时 +1，并在 migrateSchema 里补一段迁移逻辑。
|
||||
//
|
||||
// v0/v1（无字段）→ 1：新增 auditLogs / schemaVersion（老库走零值兜底即可，无需处理）
|
||||
// v1 → 2：预留示例（如把 ScrapeJobs 从 logPath 拆分时，需按旧结构生成默认 job）
|
||||
const CurrentSchemaVersion = 1
|
||||
|
||||
// migrateSchema 按版本号顺序迁移老库。返回是否发生了迁移（需要回写）。
|
||||
func (d *JsonDB) migrateSchema() bool {
|
||||
if d.SchemaVersion >= CurrentSchemaVersion {
|
||||
return false
|
||||
}
|
||||
from := d.SchemaVersion
|
||||
|
||||
// 逐版本递进，每段只处理"上一版 → 下一版"的差异，
|
||||
// 不要写成 if version < X 的叠加判断，否则分支会指数增长。
|
||||
for d.SchemaVersion < CurrentSchemaVersion {
|
||||
switch d.SchemaVersion {
|
||||
case 0:
|
||||
// v0 → v1：补审计表；老库没有 auditLogs 字段，反序列化后为 nil，
|
||||
// 这里显式初始化，避免后续 append 到 nil 之外还留着 nil 判断。
|
||||
if d.AuditLogs == nil {
|
||||
d.AuditLogs = []models.AuditLog{}
|
||||
}
|
||||
d.SchemaVersion = 1
|
||||
default:
|
||||
// 防御：出现未知版本（比当前代码还新）时不乱动，避免降级把数据写坏
|
||||
log.Printf("[schema] 数据库版本 %d 高于当前代码支持版本 %d，跳过迁移", d.SchemaVersion, CurrentSchemaVersion)
|
||||
return false
|
||||
}
|
||||
}
|
||||
log.Printf("[schema] 数据结构已从 v%d 迁移到 v%d", from, d.SchemaVersion)
|
||||
return true
|
||||
}
|
||||
|
||||
func InitDB() error {
|
||||
cfg := config.GetConfig()
|
||||
_ = os.MkdirAll(cfg.DataDir, 0700)
|
||||
@@ -70,6 +115,8 @@ func InitDB() error {
|
||||
AlertDeliveries: []models.AlertDelivery{},
|
||||
NotifyChannels: []models.NotifyChannel{},
|
||||
LogPolicyGroups: []models.LogPolicyGroup{},
|
||||
AuditLogs: []models.AuditLog{},
|
||||
SchemaVersion: CurrentSchemaVersion,
|
||||
sequences: map[string]uint{
|
||||
"users": 0,
|
||||
"clusters": 0,
|
||||
@@ -131,12 +178,14 @@ func InitDB() error {
|
||||
}
|
||||
|
||||
migratedLogAccess := migrateLogAccessToGroups(d)
|
||||
// 结构版本迁移（审计表、采集项等新字段的兼容处理）
|
||||
migratedSchema := d.migrateSchema()
|
||||
// 启动序列化保存goroutine
|
||||
d.wg.Add(1)
|
||||
go d.saveWorker()
|
||||
|
||||
db = d
|
||||
if migratedLogAccess {
|
||||
if migratedLogAccess || migratedSchema {
|
||||
d.RequestSave()
|
||||
}
|
||||
return nil
|
||||
@@ -247,6 +296,14 @@ func (d *JsonDB) saveWorker() {
|
||||
|
||||
// doSave 执行实际的原子文件写入
|
||||
func (d *JsonDB) doSave() error {
|
||||
start := time.Now()
|
||||
err := d.doSaveInner()
|
||||
// JSON DB 是全量写盘，落盘耗时是平台最主要的延迟来源之一，必须可观测
|
||||
metrics.ObserveDBSave(time.Since(start).Seconds(), err == nil)
|
||||
return err
|
||||
}
|
||||
|
||||
func (d *JsonDB) doSaveInner() error {
|
||||
d.mu.RLock()
|
||||
data, err := json.MarshalIndent(d, "", " ")
|
||||
d.mu.RUnlock()
|
||||
@@ -275,6 +332,7 @@ func (d *JsonDB) doSave() error {
|
||||
os.Remove(tmpFile)
|
||||
return err
|
||||
}
|
||||
metrics.DBSizeBytes.Set(float64(len(data)))
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
@@ -9,6 +9,7 @@ import (
|
||||
|
||||
"lokistack/controllers"
|
||||
"lokistack/middleware"
|
||||
"lokistack/pkg/metrics"
|
||||
|
||||
"github.com/gin-contrib/cors"
|
||||
"github.com/gin-gonic/gin"
|
||||
@@ -20,7 +21,9 @@ func SetupRouter() *gin.Engine {
|
||||
// 按字段过滤，同时跳过健康检查/静态资源，避免探针轮询把日志量刷满。
|
||||
// Recovery 必须显式加回来（Default 里包含它），否则 panic 会打挂进程。
|
||||
r := gin.New()
|
||||
r.Use(middleware.AccessLog(), gin.Recovery())
|
||||
// AuditLog 放在最外层：它依赖的 userId/username 由 group 内的 JWTAuth 写入，
|
||||
// 但中间件的后置逻辑在 c.Next() 返回后才执行，那时已就绪（见 middleware/audit.go）。
|
||||
r.Use(middleware.AccessLog(), middleware.AuditLog(), middleware.Metrics(), gin.Recovery())
|
||||
|
||||
// CORS
|
||||
cfg := cors.DefaultConfig()
|
||||
@@ -40,6 +43,8 @@ func SetupRouter() *gin.Engine {
|
||||
ldapCtrl := controllers.NewLdapController()
|
||||
logsCtrl := controllers.NewLogsController()
|
||||
alertsCtrl := controllers.NewAlertsController()
|
||||
auditCtrl := controllers.NewAuditController()
|
||||
systemCtrl := controllers.NewSystemController()
|
||||
registryCtrl := controllers.NewImageRegistryController()
|
||||
|
||||
// API v1
|
||||
@@ -54,12 +59,9 @@ func SetupRouter() *gin.Engine {
|
||||
})
|
||||
})
|
||||
|
||||
// Prometheus metrics 端点（公开访问，可被Prometheus抓取）
|
||||
api.GET("/metrics", func(c *gin.Context) {
|
||||
// 基础metrics输出（符合Prometheus文本格式）
|
||||
c.Header("Content-Type", "text/plain; version=0.0.4; charset=utf-8")
|
||||
c.String(http.StatusOK, "# LokiStack Metrics\n")
|
||||
})
|
||||
// Prometheus metrics 端点（真实指标，见 services/metrics.go）
|
||||
// 原实现只返回一行注释却声称"可被 Prometheus 抓取"，平台自身等于不可观测。
|
||||
api.GET("/metrics", gin.WrapH(metrics.Handler()))
|
||||
|
||||
// Public（登录接口挂 IP 限流防爆破：20 次/分钟）
|
||||
api.POST("/auth/login", middleware.LoginRateLimit(20, time.Minute), authCtrl.Login)
|
||||
@@ -127,6 +129,26 @@ func SetupRouter() *gin.Engine {
|
||||
authorized.POST("/settings/ldap/users", middleware.AdminAuth(), ldapCtrl.ListUsers)
|
||||
|
||||
// Users（admin 专用）
|
||||
// 系统运维：备份 / 恢复 / 一键自检（仅管理员）
|
||||
system := authorized.Group("/system")
|
||||
system.Use(middleware.AdminAuth())
|
||||
{
|
||||
system.GET("/backup", systemCtrl.Backup)
|
||||
system.POST("/restore", systemCtrl.Restore)
|
||||
system.POST("/restore/apply", systemCtrl.RestoreApply)
|
||||
system.GET("/backups", systemCtrl.Backups)
|
||||
system.GET("/self-check", systemCtrl.Health)
|
||||
}
|
||||
|
||||
// 审计日志：仅管理员可查（含他人操作记录）
|
||||
audit := authorized.Group("/audit-logs")
|
||||
audit.Use(middleware.AdminAuth())
|
||||
{
|
||||
audit.GET("", auditCtrl.List)
|
||||
audit.GET("/stats", auditCtrl.Stats)
|
||||
audit.GET("/:id", auditCtrl.Get)
|
||||
}
|
||||
|
||||
users := authorized.Group("/users")
|
||||
users.Use(middleware.AdminAuth())
|
||||
{
|
||||
|
||||
@@ -12,6 +12,7 @@ import (
|
||||
"time"
|
||||
|
||||
"lokistack/models"
|
||||
"lokistack/pkg/metrics"
|
||||
"lokistack/repository"
|
||||
)
|
||||
|
||||
@@ -27,7 +28,19 @@ func StartAlertEngine() {
|
||||
alertTicker = time.NewTicker(alertCheckInterval)
|
||||
go func() {
|
||||
for range alertTicker.C {
|
||||
RunAlertCheck(context.Background())
|
||||
start := time.Now()
|
||||
// 告警引擎是后台 goroutine：卡死或 panic 时页面完全看不出来，
|
||||
// 只能靠这两个指标发现（配合 Grafana 告警）
|
||||
ok := true
|
||||
func() {
|
||||
defer func() {
|
||||
if r := recover(); r != nil {
|
||||
ok = false
|
||||
}
|
||||
}()
|
||||
RunAlertCheck(context.Background())
|
||||
}()
|
||||
metrics.ObserveAlertEvaluation(time.Since(start).Seconds(), ok)
|
||||
}
|
||||
}()
|
||||
}
|
||||
|
||||
@@ -0,0 +1,309 @@
|
||||
package services
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"sort"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"lokistack/models"
|
||||
"lokistack/repository"
|
||||
)
|
||||
|
||||
const (
|
||||
// maxAuditLogs 审计日志条数上限。JSON DB 是全量读进内存、全量写盘，
|
||||
// 不设上限的话审计表会把内存和落盘时间一起拖垮。
|
||||
maxAuditLogs = 20000
|
||||
// auditRetention 审计日志保留天数（合规常见要求 90 天）
|
||||
auditRetention = 90 * 24 * time.Hour
|
||||
)
|
||||
|
||||
// RecordAudit 写入一条审计日志。
|
||||
//
|
||||
// 并发安全：直接拿 db 锁追加，与其它业务写入同一把锁，避免 RequestSave 时丢更新。
|
||||
// 裁剪：超过条数上限或保留期时从最早开始删。
|
||||
func RecordAudit(entry models.AuditLog) {
|
||||
db := repository.GetDB()
|
||||
if db == nil {
|
||||
return
|
||||
}
|
||||
db.Lock()
|
||||
defer db.Unlock()
|
||||
|
||||
if entry.CreatedAt.IsZero() {
|
||||
entry.CreatedAt = time.Now()
|
||||
}
|
||||
// 单字段长度保护：UA/Detail 可能来自客户端，不能无限制落盘
|
||||
entry.UserAgent = truncateRunes(entry.UserAgent, 200)
|
||||
entry.Detail = truncateRunes(entry.Detail, 500)
|
||||
entry.Before = truncateRunes(entry.Before, 1000)
|
||||
entry.After = truncateRunes(entry.After, 1000)
|
||||
entry.Error = truncateRunes(entry.Error, 500)
|
||||
entry.ResourceID = truncateRunes(entry.ResourceID, 128)
|
||||
|
||||
nextID := uint(1)
|
||||
for _, a := range db.AuditLogs {
|
||||
if a.ID >= nextID {
|
||||
nextID = a.ID + 1
|
||||
}
|
||||
}
|
||||
entry.ID = nextID
|
||||
db.AuditLogs = append(db.AuditLogs, entry)
|
||||
|
||||
pruneAuditLocked(db)
|
||||
db.RequestSave()
|
||||
}
|
||||
|
||||
// pruneAuditLocked 裁剪审计日志（调用方必须已持锁）。
|
||||
// 从头部（最早）开始丢，直到满足条数与保留期两条约束。
|
||||
func pruneAuditLocked(db *repository.JsonDB) {
|
||||
logs := db.AuditLogs
|
||||
cut := 0
|
||||
deadline := time.Now().Add(-auditRetention)
|
||||
|
||||
// 1) 先按保留期裁
|
||||
for cut < len(logs) && logs[cut].CreatedAt.Before(deadline) {
|
||||
cut++
|
||||
}
|
||||
// 2) 再按条数上限裁（保留最新的 maxAuditLogs 条）
|
||||
if remain := len(logs) - cut; remain > maxAuditLogs {
|
||||
cut += remain - maxAuditLogs
|
||||
}
|
||||
if cut > 0 {
|
||||
db.AuditLogs = append([]models.AuditLog{}, logs[cut:]...)
|
||||
}
|
||||
}
|
||||
|
||||
// ListAuditLogs 分页查询审计日志（按时间倒序）。
|
||||
func ListAuditLogs(q models.AuditQuery) ([]models.AuditLog, int64) {
|
||||
db := repository.GetDB()
|
||||
if db == nil {
|
||||
return nil, 0
|
||||
}
|
||||
db.RLock()
|
||||
all := db.AuditLogs
|
||||
db.RUnlock()
|
||||
|
||||
matched := make([]models.AuditLog, 0, len(all))
|
||||
for _, a := range all {
|
||||
if q.Username != "" && !strings.Contains(strings.ToLower(a.Username), strings.ToLower(q.Username)) {
|
||||
continue
|
||||
}
|
||||
if q.Module != "" && a.Module != q.Module {
|
||||
continue
|
||||
}
|
||||
if q.Action != "" && a.Action != q.Action {
|
||||
continue
|
||||
}
|
||||
if q.ResourceID != "" && !strings.Contains(a.ResourceID, q.ResourceID) {
|
||||
continue
|
||||
}
|
||||
switch q.Status {
|
||||
case 1:
|
||||
if a.Status < 200 || a.Status >= 300 {
|
||||
continue
|
||||
}
|
||||
case 2:
|
||||
if a.Status < 400 {
|
||||
continue
|
||||
}
|
||||
}
|
||||
if q.StartTime != nil && a.CreatedAt.Before(*q.StartTime) {
|
||||
continue
|
||||
}
|
||||
if q.EndTime != nil && a.CreatedAt.After(*q.EndTime) {
|
||||
continue
|
||||
}
|
||||
matched = append(matched, a)
|
||||
}
|
||||
|
||||
// 时间倒序
|
||||
sort.Slice(matched, func(i, j int) bool { return matched[i].CreatedAt.After(matched[j].CreatedAt) })
|
||||
|
||||
total := int64(len(matched))
|
||||
if q.PageSize <= 0 {
|
||||
q.PageSize = 20
|
||||
}
|
||||
if q.Page <= 0 {
|
||||
q.Page = 1
|
||||
}
|
||||
start := (q.Page - 1) * q.PageSize
|
||||
if start >= len(matched) {
|
||||
return []models.AuditLog{}, total
|
||||
}
|
||||
end := start + q.PageSize
|
||||
if end > len(matched) {
|
||||
end = len(matched)
|
||||
}
|
||||
return matched[start:end], total
|
||||
}
|
||||
|
||||
// GetAuditLog 取单条（详情弹窗用）。
|
||||
func GetAuditLog(id uint) (*models.AuditLog, error) {
|
||||
db := repository.GetDB()
|
||||
if db == nil {
|
||||
return nil, fmt.Errorf("数据库未初始化")
|
||||
}
|
||||
db.RLock()
|
||||
defer db.RUnlock()
|
||||
for i := range db.AuditLogs {
|
||||
if db.AuditLogs[i].ID == id {
|
||||
entry := db.AuditLogs[i]
|
||||
return &entry, nil
|
||||
}
|
||||
}
|
||||
return nil, fmt.Errorf("审计记录不存在")
|
||||
}
|
||||
|
||||
// AuditStatistics 统计卡片数据。
|
||||
func AuditStatistics() models.AuditStats {
|
||||
db := repository.GetDB()
|
||||
stats := models.AuditStats{}
|
||||
if db == nil {
|
||||
return stats
|
||||
}
|
||||
db.RLock()
|
||||
logs := db.AuditLogs
|
||||
db.RUnlock()
|
||||
|
||||
now := time.Now()
|
||||
todayStart := time.Date(now.Year(), now.Month(), now.Day(), 0, 0, 0, 0, now.Location())
|
||||
weekStart := todayStart.AddDate(0, 0, -6)
|
||||
|
||||
moduleCount := map[string]int64{}
|
||||
userCount := map[string]int64{}
|
||||
for _, a := range logs {
|
||||
stats.TotalCount++
|
||||
if a.CreatedAt.After(todayStart) {
|
||||
stats.TodayCount++
|
||||
}
|
||||
if a.CreatedAt.After(weekStart) {
|
||||
stats.WeekCount++
|
||||
}
|
||||
if a.Status >= 400 {
|
||||
stats.FailCount++
|
||||
}
|
||||
moduleCount[a.Module]++
|
||||
if a.Username != "" {
|
||||
userCount[a.Username]++
|
||||
}
|
||||
}
|
||||
stats.TopModules = topN(moduleCount, 5)
|
||||
stats.TopUsers = topN(userCount, 5)
|
||||
return stats
|
||||
}
|
||||
|
||||
func topN(m map[string]int64, n int) []models.AuditCount {
|
||||
out := make([]models.AuditCount, 0, len(m))
|
||||
for k, v := range m {
|
||||
out = append(out, models.AuditCount{Name: k, Count: v})
|
||||
}
|
||||
sort.Slice(out, func(i, j int) bool {
|
||||
if out[i].Count == out[j].Count {
|
||||
return out[i].Name < out[j].Name
|
||||
}
|
||||
return out[i].Count > out[j].Count
|
||||
})
|
||||
if len(out) > n {
|
||||
out = out[:n]
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
// ───────────────────────── 脱敏 / 摘要 ─────────────────────────
|
||||
|
||||
// auditSensitiveKeys 这些字段一律不进审计（只留「已修改」的痕迹）。
|
||||
var auditSensitiveKeys = map[string]bool{
|
||||
"password": true, "oldpassword": true, "newpassword": true,
|
||||
"secretkey": true, "accesskey": true, "secretaccesskey": true,
|
||||
"privatekey": true, "token": true, "accesstoken": true, "refreshtoken": true,
|
||||
"encryptionkey": true, "jwtsecret": true,
|
||||
}
|
||||
|
||||
// MaskAuditPayload 把请求体里的敏感值替换成 ***，返回脱敏后的 JSON 字符串。
|
||||
// 解析失败时返回 "<非 JSON 请求体>"，避免把表单里的密码原样落盘。
|
||||
func MaskAuditPayload(body []byte, maxLen int) string {
|
||||
if len(body) == 0 {
|
||||
return ""
|
||||
}
|
||||
var v interface{}
|
||||
if err := json.Unmarshal(body, &v); err != nil {
|
||||
return "<非 JSON 请求体，已省略>"
|
||||
}
|
||||
masked := maskValue(v)
|
||||
out, err := json.Marshal(masked)
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
return truncateRunes(string(out), maxLen)
|
||||
}
|
||||
|
||||
func maskValue(v interface{}) interface{} {
|
||||
switch t := v.(type) {
|
||||
case map[string]interface{}:
|
||||
out := make(map[string]interface{}, len(t))
|
||||
for k, val := range t {
|
||||
if auditSensitiveKeys[strings.ToLower(k)] {
|
||||
if s, ok := val.(string); ok && s == "" {
|
||||
out[k] = ""
|
||||
} else {
|
||||
out[k] = "***"
|
||||
}
|
||||
continue
|
||||
}
|
||||
out[k] = maskValue(val)
|
||||
}
|
||||
return out
|
||||
case []interface{}:
|
||||
out := make([]interface{}, len(t))
|
||||
for i, val := range t {
|
||||
out[i] = maskValue(val)
|
||||
}
|
||||
return out
|
||||
default:
|
||||
return v
|
||||
}
|
||||
}
|
||||
|
||||
// AuditDiff 生成「变更前后」摘要，只保留真正变化的字段。
|
||||
// prev/next 传脱敏后的 JSON 字符串；解析失败时返回空（不硬编码原文）。
|
||||
func AuditDiff(prev, next string) (string, string) {
|
||||
var a, b map[string]interface{}
|
||||
if prev == "" || next == "" || json.Unmarshal([]byte(prev), &a) != nil || json.Unmarshal([]byte(next), &b) != nil {
|
||||
return "", ""
|
||||
}
|
||||
before := map[string]interface{}{}
|
||||
after := map[string]interface{}{}
|
||||
for k, nv := range b {
|
||||
ov, existed := a[k]
|
||||
if !existed || fmt.Sprint(ov) != fmt.Sprint(nv) {
|
||||
if existed {
|
||||
before[k] = ov
|
||||
}
|
||||
after[k] = nv
|
||||
}
|
||||
}
|
||||
for k, ov := range a {
|
||||
if _, ok := b[k]; !ok {
|
||||
before[k] = ov
|
||||
}
|
||||
}
|
||||
if len(after) == 0 && len(before) == 0 {
|
||||
return "", ""
|
||||
}
|
||||
bs, _ := json.Marshal(before)
|
||||
as, _ := json.Marshal(after)
|
||||
return truncateRunes(string(bs), 1000), truncateRunes(string(as), 1000)
|
||||
}
|
||||
|
||||
func truncateRunes(s string, n int) string {
|
||||
if n <= 0 {
|
||||
return s
|
||||
}
|
||||
r := []rune(s)
|
||||
if len(r) <= n {
|
||||
return s
|
||||
}
|
||||
return string(r[:n]) + "…"
|
||||
}
|
||||
@@ -0,0 +1,337 @@
|
||||
package services
|
||||
|
||||
import (
|
||||
"archive/tar"
|
||||
"compress/gzip"
|
||||
"crypto/sha256"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"sort"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"lokistack/repository"
|
||||
)
|
||||
|
||||
// 备份/恢复设计要点
|
||||
//
|
||||
// 为什么必须有：平台的全部状态（部署/采集/存储/集群/主机/策略/告警/用户/审计）
|
||||
// 都在这一个 JSON 文件里；kubeconfig 虽然加密存在 DB 内，但解密依赖
|
||||
// ENCRYPTION_KEY（K8s Secret）。DB 丢了 = 平台失去"这些资源是谁建的"的映射，
|
||||
// 从此无法管理/卸载/升级正在跑的 Loki 与采集器。
|
||||
//
|
||||
// 安全取舍：
|
||||
// - 备份包内含加密后的 kubeconfig 与 known_hosts，**不含明文密钥**
|
||||
// - manifest 里只记录 ENCRYPTION_KEY 的指纹（sha256 前 16 位），
|
||||
// 用于恢复时校验"这把钥匙能不能解开这份备份"，不泄露密钥本身
|
||||
// - 恢复分两步（校验暂存 → 手动应用），避免一个误点就覆盖线上 DB
|
||||
|
||||
// BackupManifest 备份包元信息（放在包内 manifest.json）
|
||||
type BackupManifest struct {
|
||||
Version string `json:"version"`
|
||||
CreatedAt time.Time `json:"createdAt"`
|
||||
DBBytes int64 `json:"dbBytes"`
|
||||
DBSHA256 string `json:"dbSha256"`
|
||||
KeyFP string `json:"encryptionKeyFingerprint"`
|
||||
RecordCount int `json:"recordCount"`
|
||||
Note string `json:"note"`
|
||||
}
|
||||
|
||||
// backupExclude 备份时跳过的文件/目录（临时文件、lost+found、正在写的 restore 暂存）
|
||||
var backupExclude = map[string]bool{
|
||||
"lost+found": true, ".restore-pending": true, "backups": true,
|
||||
}
|
||||
|
||||
// CreateBackup 把 /app/data 打包成 tar.gz 写入 w。
|
||||
func CreateBackup(w io.Writer) (*BackupManifest, error) {
|
||||
dataDir := dataDirPath()
|
||||
dbPath := databasePath()
|
||||
|
||||
dbInfo, err := os.Stat(dbPath)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("读取数据库失败: %w", err)
|
||||
}
|
||||
dbBytes, err := os.ReadFile(dbPath)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("读取数据库失败: %w", err)
|
||||
}
|
||||
sum := sha256.Sum256(dbBytes)
|
||||
|
||||
db := repository.GetDB()
|
||||
recordCount := 0
|
||||
if db != nil {
|
||||
db.RLock()
|
||||
recordCount = len(db.Users) + len(db.Clusters) + len(db.Hosts) + len(db.Storages) +
|
||||
len(db.Deployments) + len(db.Collectors) + len(db.LogSources) +
|
||||
len(db.AlertRules) + len(db.NotifyChannels) + len(db.LogPolicyGroups) + len(db.AuditLogs)
|
||||
db.RUnlock()
|
||||
}
|
||||
|
||||
manifest := &BackupManifest{
|
||||
Version: "2.0.0",
|
||||
CreatedAt: time.Now(),
|
||||
DBBytes: dbInfo.Size(),
|
||||
DBSHA256: hex.EncodeToString(sum[:]),
|
||||
KeyFP: encryptionKeyFingerprint(),
|
||||
RecordCount: recordCount,
|
||||
Note: "包内 kubeconfig 为加密态；恢复必须使用同一把 ENCRYPTION_KEY，否则 kubeconfig 无法解密",
|
||||
}
|
||||
|
||||
gz := gzip.NewWriter(w)
|
||||
defer gz.Close()
|
||||
tw := tar.NewWriter(gz)
|
||||
defer tw.Close()
|
||||
|
||||
// 1) manifest
|
||||
mBytes, _ := json.MarshalIndent(manifest, "", " ")
|
||||
if err := writeTarFile(tw, "manifest.json", mBytes, 0o600); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// 2) data 目录下所有文件（DB + kubeconfigs/ + known_hosts/）
|
||||
err = filepath.Walk(dataDir, func(path string, info os.FileInfo, err error) error {
|
||||
if err != nil {
|
||||
return nil // 单个文件读不到不阻断整包
|
||||
}
|
||||
if path == dataDir {
|
||||
return nil
|
||||
}
|
||||
rel, err := filepath.Rel(dataDir, path)
|
||||
if err != nil {
|
||||
return nil
|
||||
}
|
||||
top := strings.SplitN(rel, string(os.PathSeparator), 2)[0]
|
||||
if backupExclude[top] {
|
||||
if info.IsDir() {
|
||||
return filepath.SkipDir
|
||||
}
|
||||
return nil
|
||||
}
|
||||
if info.IsDir() {
|
||||
return nil
|
||||
}
|
||||
// 跳过正在写的临时文件
|
||||
if strings.HasPrefix(filepath.Base(path), ".lokistack-") && strings.HasSuffix(path, ".tmp") {
|
||||
return nil
|
||||
}
|
||||
f, err := os.Open(path)
|
||||
if err != nil {
|
||||
return nil
|
||||
}
|
||||
defer f.Close()
|
||||
hdr := &tar.Header{
|
||||
Name: filepath.ToSlash(filepath.Join("data", rel)),
|
||||
Mode: int64(info.Mode().Perm()),
|
||||
Size: info.Size(),
|
||||
ModTime: info.ModTime(),
|
||||
}
|
||||
if err := tw.WriteHeader(hdr); err != nil {
|
||||
return err
|
||||
}
|
||||
_, err = io.Copy(tw, f)
|
||||
return err
|
||||
})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return manifest, nil
|
||||
}
|
||||
|
||||
func writeTarFile(tw *tar.Writer, name string, data []byte, mode int64) error {
|
||||
hdr := &tar.Header{Name: name, Mode: mode, Size: int64(len(data)), ModTime: time.Now()}
|
||||
if err := tw.WriteHeader(hdr); err != nil {
|
||||
return err
|
||||
}
|
||||
_, err := tw.Write(data)
|
||||
return err
|
||||
}
|
||||
|
||||
// RestoreResult 校验结果
|
||||
type RestoreResult struct {
|
||||
Manifest *BackupManifest `json:"manifest"`
|
||||
KeyMatches bool `json:"keyMatches"`
|
||||
RowsInBackup int `json:"rowsInBackup"`
|
||||
CurrentRows int `json:"currentRows"`
|
||||
StagedPath string `json:"stagedPath,omitempty"`
|
||||
Warning string `json:"warning,omitempty"`
|
||||
}
|
||||
|
||||
// ValidateAndStageBackup 校验备份包并暂存到 <dataDir>/.restore-pending/。
|
||||
//
|
||||
// 不在这一步直接覆盖线上 DB：恢复是不可逆操作，必须让人再确认一次
|
||||
// （页面上的「应用恢复」或 run.sh restore）。
|
||||
func ValidateAndStageBackup(r io.Reader) (*RestoreResult, error) {
|
||||
gr, err := gzip.NewReader(r)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("不是合法的 gzip 文件: %w", err)
|
||||
}
|
||||
defer gr.Close()
|
||||
tr := tar.NewReader(gr)
|
||||
|
||||
var (
|
||||
manifest *BackupManifest
|
||||
dbBytes []byte
|
||||
)
|
||||
for {
|
||||
hdr, err := tr.Next()
|
||||
if err == io.EOF {
|
||||
break
|
||||
}
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("解包失败: %w", err)
|
||||
}
|
||||
switch {
|
||||
case hdr.Name == "manifest.json":
|
||||
b, _ := io.ReadAll(io.LimitReader(tr, 1<<20))
|
||||
var m BackupManifest
|
||||
if err := json.Unmarshal(b, &m); err == nil {
|
||||
manifest = &m
|
||||
}
|
||||
case hdr.Name == "data/opsxloki.json":
|
||||
dbBytes, _ = io.ReadAll(io.LimitReader(tr, 64<<20))
|
||||
}
|
||||
}
|
||||
if manifest == nil {
|
||||
return nil, fmt.Errorf("备份包缺少 manifest.json，不是本平台导出的备份")
|
||||
}
|
||||
if len(dbBytes) == 0 {
|
||||
return nil, fmt.Errorf("备份包内没有 data/opsxloki.json")
|
||||
}
|
||||
|
||||
// 校验 DB 完整性：必须是合法 JSON 且能解析出预期集合
|
||||
var probe map[string]json.RawMessage
|
||||
if err := json.Unmarshal(dbBytes, &probe); err != nil {
|
||||
return nil, fmt.Errorf("备份内的数据库不是合法 JSON: %w", err)
|
||||
}
|
||||
for _, required := range []string{"users", "deployments", "collectors"} {
|
||||
if _, ok := probe[required]; !ok {
|
||||
return nil, fmt.Errorf("备份内数据库缺少集合 %q，可能不是 LokiStack 的备份", required)
|
||||
}
|
||||
}
|
||||
|
||||
// 哈希校验（防止传输损坏）
|
||||
sum := sha256.Sum256(dbBytes)
|
||||
if manifest.DBSHA256 != "" && hex.EncodeToString(sum[:]) != manifest.DBSHA256 {
|
||||
return nil, fmt.Errorf("备份内数据库校验失败（sha256 不匹配），文件可能已损坏")
|
||||
}
|
||||
|
||||
stagedDir := filepath.Join(dataDirPath(), ".restore-pending")
|
||||
if err := os.MkdirAll(stagedDir, 0o700); err != nil {
|
||||
return nil, fmt.Errorf("创建暂存目录失败: %w", err)
|
||||
}
|
||||
stagedPath := filepath.Join(stagedDir, "opsxloki.json")
|
||||
if err := os.WriteFile(stagedPath, dbBytes, 0o600); err != nil {
|
||||
return nil, fmt.Errorf("写入暂存文件失败: %w", err)
|
||||
}
|
||||
|
||||
currentRows := 0
|
||||
if db := repository.GetDB(); db != nil {
|
||||
db.RLock()
|
||||
currentRows = len(db.Deployments) + len(db.Collectors) + len(db.Clusters) + len(db.Hosts)
|
||||
db.RUnlock()
|
||||
}
|
||||
|
||||
res := &RestoreResult{
|
||||
Manifest: manifest,
|
||||
KeyMatches: manifest.KeyFP == "" || manifest.KeyFP == encryptionKeyFingerprint(),
|
||||
RowsInBackup: manifest.RecordCount,
|
||||
CurrentRows: currentRows,
|
||||
StagedPath: stagedPath,
|
||||
}
|
||||
if !res.KeyMatches {
|
||||
res.Warning = "备份的 ENCRYPTION_KEY 指纹与当前平台不一致：恢复后 kubeconfig / 存储凭证将无法解密，" +
|
||||
"需要用备份时的那把 ENCRYPTION_KEY 覆盖 lokistack-secrets 中的值后再启动"
|
||||
}
|
||||
return res, nil
|
||||
}
|
||||
|
||||
// encryptionKeyFingerprint 返回当前 ENCRYPTION_KEY 的指纹（sha256 前 16 位），不泄露密钥。
|
||||
func encryptionKeyFingerprint() string {
|
||||
key := os.Getenv("ENCRYPTION_KEY")
|
||||
if key == "" {
|
||||
// 兼容从文件读取的部署方式
|
||||
if p := os.Getenv("ENCRYPTION_KEY_FILE"); p != "" {
|
||||
if b, err := os.ReadFile(p); err == nil {
|
||||
key = strings.TrimSpace(string(b))
|
||||
}
|
||||
}
|
||||
}
|
||||
if key == "" {
|
||||
return ""
|
||||
}
|
||||
sum := sha256.Sum256([]byte(key))
|
||||
return hex.EncodeToString(sum[:])[:16]
|
||||
}
|
||||
|
||||
// ApplyStagedBackup 把暂存文件应用为正式 DB（调用方负责重启进程）。
|
||||
func ApplyStagedBackup() (string, error) {
|
||||
staged := filepath.Join(dataDirPath(), ".restore-pending", "opsxloki.json")
|
||||
b, err := os.ReadFile(staged)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("没有待应用的恢复文件: %w", err)
|
||||
}
|
||||
var probe map[string]json.RawMessage
|
||||
if err := json.Unmarshal(b, &probe); err != nil {
|
||||
return "", fmt.Errorf("暂存文件已损坏: %w", err)
|
||||
}
|
||||
|
||||
dbPath := databasePath()
|
||||
// 先把当前 DB 备份一份，恢复错了还能退回去
|
||||
if cur, err := os.ReadFile(dbPath); err == nil {
|
||||
rollback := dbPath + ".before-restore." + time.Now().Format("20060102-150405")
|
||||
_ = os.WriteFile(rollback, cur, 0o600)
|
||||
}
|
||||
tmp := dbPath + ".restoring"
|
||||
if err := os.WriteFile(tmp, b, 0o600); err != nil {
|
||||
return "", err
|
||||
}
|
||||
if err := os.Rename(tmp, dbPath); err != nil {
|
||||
return "", err
|
||||
}
|
||||
_ = os.Remove(staged)
|
||||
return dbPath, nil
|
||||
}
|
||||
|
||||
// ListBackups 列出 dataDir/backups 下已有的备份文件（run.sh backup 产出）。
|
||||
func ListBackups() []map[string]interface{} {
|
||||
dir := filepath.Join(dataDirPath(), "backups")
|
||||
entries, err := os.ReadDir(dir)
|
||||
if err != nil {
|
||||
return []map[string]interface{}{}
|
||||
}
|
||||
type item struct {
|
||||
name string
|
||||
size int64
|
||||
mod time.Time
|
||||
}
|
||||
var items []item
|
||||
for _, e := range entries {
|
||||
if e.IsDir() || !strings.HasSuffix(e.Name(), ".tar.gz") {
|
||||
continue
|
||||
}
|
||||
info, err := e.Info()
|
||||
if err != nil {
|
||||
continue
|
||||
}
|
||||
items = append(items, item{e.Name(), info.Size(), info.ModTime()})
|
||||
}
|
||||
sort.Slice(items, func(i, j int) bool { return items[i].mod.After(items[j].mod) })
|
||||
out := make([]map[string]interface{}, 0, len(items))
|
||||
for _, it := range items {
|
||||
out = append(out, map[string]interface{}{
|
||||
"name": it.name, "sizeBytes": it.size, "createdAt": it.mod,
|
||||
})
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
func dataDirPath() string {
|
||||
if p := os.Getenv("DATA_DIR"); p != "" {
|
||||
return p
|
||||
}
|
||||
return "/app/data"
|
||||
}
|
||||
@@ -0,0 +1,97 @@
|
||||
package services
|
||||
|
||||
import (
|
||||
"os"
|
||||
"time"
|
||||
|
||||
"lokistack/pkg/metrics"
|
||||
"lokistack/repository"
|
||||
)
|
||||
|
||||
// InitMetrics 注册指标并启动业务/存储指标的周期刷新。
|
||||
//
|
||||
// HTTP 层与 DB 落盘由 middleware / repository 直接埋点；
|
||||
// 这里只负责需要"扫 DB 算出来"的指标（记录数、部署/采集器状态分布、DB 大小）。
|
||||
func InitMetrics(version string) {
|
||||
metrics.Register(version)
|
||||
|
||||
go func() {
|
||||
ticker := time.NewTicker(30 * time.Second)
|
||||
defer ticker.Stop()
|
||||
refreshGauges()
|
||||
for range ticker.C {
|
||||
refreshGauges()
|
||||
}
|
||||
}()
|
||||
}
|
||||
|
||||
// refreshGauges 刷新需要遍历 DB 才能得出的指标。
|
||||
func refreshGauges() {
|
||||
db := repository.GetDB()
|
||||
if db == nil {
|
||||
return
|
||||
}
|
||||
|
||||
if path := databasePath(); path != "" {
|
||||
if fi, err := os.Stat(path); err == nil {
|
||||
metrics.DBSizeBytes.Set(float64(fi.Size()))
|
||||
}
|
||||
}
|
||||
|
||||
db.RLock()
|
||||
users := len(db.Users)
|
||||
clusters := len(db.Clusters)
|
||||
hosts := len(db.Hosts)
|
||||
storages := len(db.Storages)
|
||||
deployList := db.Deployments
|
||||
collectorList := db.Collectors
|
||||
alertRules := len(db.AlertRules)
|
||||
auditCount := len(db.AuditLogs)
|
||||
db.RUnlock()
|
||||
|
||||
metrics.DBRecordsTotal.WithLabelValues("users").Set(float64(users))
|
||||
metrics.DBRecordsTotal.WithLabelValues("clusters").Set(float64(clusters))
|
||||
metrics.DBRecordsTotal.WithLabelValues("hosts").Set(float64(hosts))
|
||||
metrics.DBRecordsTotal.WithLabelValues("storages").Set(float64(storages))
|
||||
metrics.DBRecordsTotal.WithLabelValues("deployments").Set(float64(len(deployList)))
|
||||
metrics.DBRecordsTotal.WithLabelValues("collectors").Set(float64(len(collectorList)))
|
||||
metrics.DBRecordsTotal.WithLabelValues("alertRules").Set(float64(alertRules))
|
||||
metrics.DBRecordsTotal.WithLabelValues("auditLogs").Set(float64(auditCount))
|
||||
|
||||
// 状态分布：先 Reset 再重算，避免已删除对象留下僵尸时间序列
|
||||
metrics.DeploymentsTotal.Reset()
|
||||
for _, d := range deployList {
|
||||
status := d.Status
|
||||
if status == "" {
|
||||
status = "unknown"
|
||||
}
|
||||
mode := d.Mode
|
||||
if mode == "" {
|
||||
mode = "unknown"
|
||||
}
|
||||
metrics.DeploymentsTotal.WithLabelValues(status, mode).Inc()
|
||||
}
|
||||
|
||||
metrics.CollectorsTotal.Reset()
|
||||
for _, c := range collectorList {
|
||||
status := c.Status
|
||||
if status == "" {
|
||||
status = "unknown"
|
||||
}
|
||||
runMode := c.RunMode
|
||||
if runMode == "" {
|
||||
runMode = "unknown"
|
||||
}
|
||||
metrics.CollectorsTotal.WithLabelValues(status, c.Type, runMode).Inc()
|
||||
}
|
||||
}
|
||||
|
||||
func databasePath() string {
|
||||
if p := os.Getenv("DATABASE_PATH"); p != "" {
|
||||
return p
|
||||
}
|
||||
if p := os.Getenv("DATA_DIR"); p != "" {
|
||||
return p + "/opsxloki.json"
|
||||
}
|
||||
return "/app/data/opsxloki.json"
|
||||
}
|
||||
@@ -0,0 +1,233 @@
|
||||
package services
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net/http"
|
||||
"os"
|
||||
"strings"
|
||||
"syscall"
|
||||
"time"
|
||||
|
||||
"lokistack/models"
|
||||
"lokistack/repository"
|
||||
)
|
||||
|
||||
// CheckItem 单条自检结果
|
||||
type CheckItem struct {
|
||||
// Name 检查项名称（中文可读）
|
||||
Name string `json:"name"`
|
||||
// Status ok / warn / error
|
||||
Status string `json:"status"`
|
||||
// Message 一句话结论
|
||||
Message string `json:"message,omitempty"`
|
||||
// Detail 补充信息（数量、路径、错误原文）
|
||||
Detail string `json:"detail,omitempty"`
|
||||
}
|
||||
|
||||
// SelfCheckResult 一键诊断结果
|
||||
type SelfCheckResult struct {
|
||||
CheckedAt time.Time `json:"checkedAt"`
|
||||
// Overall ok / warn / error —— 前端据此显示整体颜色
|
||||
Overall string `json:"overall"`
|
||||
Items []CheckItem `json:"items"`
|
||||
}
|
||||
|
||||
// SelfCheck 平台自检：把「能不能用」的判断集中到一处。
|
||||
//
|
||||
// 设计目标：新人接手或故障时，先看这一个接口，不必在 5 个页面之间来回跳。
|
||||
// 所有检查都必须有超时保护，不能让诊断本身把平台拖慢。
|
||||
func SelfCheck() SelfCheckResult {
|
||||
res := SelfCheckResult{CheckedAt: time.Now(), Overall: "ok"}
|
||||
add := func(item CheckItem) {
|
||||
res.Items = append(res.Items, item)
|
||||
if item.Status == "error" {
|
||||
res.Overall = "error"
|
||||
} else if item.Status == "warn" && res.Overall == "ok" {
|
||||
res.Overall = "warn"
|
||||
}
|
||||
}
|
||||
|
||||
db := repository.GetDB()
|
||||
|
||||
// 1) 数据库
|
||||
if db == nil {
|
||||
add(CheckItem{Name: "数据库", Status: "error", Message: "未初始化"})
|
||||
} else {
|
||||
dbPath := databasePath()
|
||||
fi, err := os.Stat(dbPath)
|
||||
if err != nil {
|
||||
add(CheckItem{Name: "数据库", Status: "error", Message: "数据文件读不到", Detail: err.Error()})
|
||||
} else {
|
||||
db.RLock()
|
||||
counts := fmt.Sprintf("集群 %d / 主机 %d / 存储 %d / 部署 %d / 采集器 %d / 审计 %d",
|
||||
len(db.Clusters), len(db.Hosts), len(db.Storages), len(db.Deployments), len(db.Collectors), len(db.AuditLogs))
|
||||
db.RUnlock()
|
||||
status := "ok"
|
||||
if fi.Size() > 16<<20 {
|
||||
status = "warn"
|
||||
}
|
||||
add(CheckItem{Name: "数据库", Status: status,
|
||||
Message: fmt.Sprintf("%.1f KB", float64(fi.Size())/1024), Detail: counts})
|
||||
}
|
||||
}
|
||||
|
||||
// 2) 加密密钥（丢了所有 kubeconfig/凭证都解不开）
|
||||
if fp := encryptionKeyFingerprint(); fp == "" {
|
||||
add(CheckItem{Name: "加密密钥", Status: "error",
|
||||
Message: "ENCRYPTION_KEY 未配置",
|
||||
Detail: "kubeconfig 与存储凭证依赖它解密；请确认 lokistack-secrets 中的 ENCRYPTION_KEY 已注入"})
|
||||
} else {
|
||||
add(CheckItem{Name: "加密密钥", Status: "ok", Message: "已配置", Detail: "指纹 " + fp})
|
||||
}
|
||||
|
||||
// 3) 数据目录可用空间
|
||||
if free, total, err := diskUsage(dataDirPath()); err == nil && total > 0 {
|
||||
pct := float64(free) / float64(total) * 100
|
||||
status, msg := "ok", fmt.Sprintf("剩余 %.1f GB（%.0f%%）", float64(free)/(1<<30), pct)
|
||||
if pct < 10 {
|
||||
status = "error"
|
||||
} else if pct < 20 {
|
||||
status = "warn"
|
||||
}
|
||||
add(CheckItem{Name: "数据盘", Status: status, Message: msg})
|
||||
}
|
||||
|
||||
if db != nil {
|
||||
db.RLock()
|
||||
clusterList := db.Clusters
|
||||
hostList := db.Hosts
|
||||
deployList := db.Deployments
|
||||
collectorList := db.Collectors
|
||||
auditList := db.AuditLogs
|
||||
db.RUnlock()
|
||||
|
||||
// 4) 集群接入（kubeconfig 能否解密）
|
||||
if len(clusterList) == 0 {
|
||||
add(CheckItem{Name: "K8s 集群", Status: "warn", Message: "尚未添加集群"})
|
||||
} else {
|
||||
bad := 0
|
||||
for i := range clusterList {
|
||||
if _, err := resolveKubeconfig(&clusterList[i]); err != nil {
|
||||
bad++
|
||||
}
|
||||
}
|
||||
if bad > 0 {
|
||||
add(CheckItem{Name: "K8s 集群", Status: "error",
|
||||
Message: fmt.Sprintf("%d/%d 个集群的 kubeconfig 无法解密", bad, len(clusterList)),
|
||||
Detail: "多半是 ENCRYPTION_KEY 与写入时不一致"})
|
||||
} else {
|
||||
add(CheckItem{Name: "K8s 集群", Status: "ok", Message: fmt.Sprintf("%d 个，kubeconfig 均可解密", len(clusterList))})
|
||||
}
|
||||
}
|
||||
|
||||
// 5) 主机可达性（用最近一次验证结果，不在这里做 SSH 连接，避免诊断变慢）
|
||||
if len(hostList) > 0 {
|
||||
errCount := 0
|
||||
for _, h := range hostList {
|
||||
if h.Status == "error" {
|
||||
errCount++
|
||||
}
|
||||
}
|
||||
if errCount > 0 {
|
||||
add(CheckItem{Name: "主机", Status: "warn",
|
||||
Message: fmt.Sprintf("%d/%d 台连接异常", errCount, len(hostList)),
|
||||
Detail: "到「主机管理」点「测试连接」查看具体原因"})
|
||||
} else {
|
||||
add(CheckItem{Name: "主机", Status: "ok", Message: fmt.Sprintf("%d 台均正常", len(hostList))})
|
||||
}
|
||||
}
|
||||
|
||||
// 6) Loki 部署实例（真实探活 /ready）
|
||||
if len(deployList) == 0 {
|
||||
add(CheckItem{Name: "Loki 实例", Status: "warn", Message: "尚未部署 Loki"})
|
||||
} else {
|
||||
var names []string
|
||||
bad := 0
|
||||
for _, d := range deployList {
|
||||
status, err := probeDeploymentReady(&d)
|
||||
if err != nil || !status {
|
||||
bad++
|
||||
names = append(names, d.Name)
|
||||
}
|
||||
}
|
||||
if bad > 0 {
|
||||
add(CheckItem{Name: "Loki 实例", Status: "error",
|
||||
Message: fmt.Sprintf("%d/%d 个实例未就绪", bad, len(deployList)),
|
||||
Detail: strings.Join(names, ", ")})
|
||||
} else {
|
||||
add(CheckItem{Name: "Loki 实例", Status: "ok", Message: fmt.Sprintf("%d 个全部 ready", len(deployList))})
|
||||
}
|
||||
}
|
||||
|
||||
// 7) 采集器
|
||||
if len(collectorList) > 0 {
|
||||
errCount, okCount := 0, 0
|
||||
for _, c := range collectorList {
|
||||
switch c.Status {
|
||||
case "active", "running":
|
||||
okCount++
|
||||
case "error":
|
||||
errCount++
|
||||
}
|
||||
}
|
||||
if errCount > 0 {
|
||||
add(CheckItem{Name: "采集器", Status: "error",
|
||||
Message: fmt.Sprintf("%d 个异常", errCount),
|
||||
Detail: fmt.Sprintf("正常 %d 个；到「采集器」页看具体报错", okCount)})
|
||||
} else {
|
||||
add(CheckItem{Name: "采集器", Status: "ok", Message: fmt.Sprintf("%d 个正常", okCount)})
|
||||
}
|
||||
}
|
||||
|
||||
// 8) 近期失败操作（审计）
|
||||
recentFail := 0
|
||||
cutoff := time.Now().Add(-24 * time.Hour)
|
||||
for _, a := range auditList {
|
||||
if a.CreatedAt.After(cutoff) && a.Status >= 400 {
|
||||
recentFail++
|
||||
}
|
||||
}
|
||||
if recentFail > 0 {
|
||||
add(CheckItem{Name: "近 24h 失败操作", Status: "warn",
|
||||
Message: fmt.Sprintf("%d 次", recentFail), Detail: "到「审计日志」筛选失败查看详情"})
|
||||
} else {
|
||||
add(CheckItem{Name: "近 24h 失败操作", Status: "ok", Message: "无"})
|
||||
}
|
||||
}
|
||||
|
||||
return res
|
||||
}
|
||||
|
||||
// probeDeploymentReady 探测某个 Loki 部署实例是否 /ready。
|
||||
//
|
||||
// 不用 DeploymentReady()：那个函数按"部署名 == 数据源名"匹配，
|
||||
// 而生成的 K8s 资源名固定是 loki，两者对不上会永远返回未就绪（已知问题）。
|
||||
// 这里直接按部署记录里的 endpoint 探活，并对主机模式修正监听地址：
|
||||
// 主机 Docker 部署存的是 0.0.0.0:3100，从平台 Pod 侧要用主机真实 IP。
|
||||
func probeDeploymentReady(d *models.LokiDeployment) (bool, error) {
|
||||
url := strings.TrimSuffix(strings.TrimSpace(d.Endpoint), "/")
|
||||
if url == "" {
|
||||
return false, fmt.Errorf("部署未记录访问地址")
|
||||
}
|
||||
if strings.Contains(url, "0.0.0.0") && d.Host != nil && d.Host.HostIP != "" {
|
||||
url = strings.Replace(url, "0.0.0.0", d.Host.HostIP, 1)
|
||||
}
|
||||
client := &http.Client{Timeout: 3 * time.Second}
|
||||
resp, err := client.Get(url + "/ready")
|
||||
if err != nil {
|
||||
return false, err
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
buf := make([]byte, 128)
|
||||
n, _ := resp.Body.Read(buf)
|
||||
return resp.StatusCode == 200 && strings.Contains(strings.ToLower(string(buf[:n])), "ready"), nil
|
||||
}
|
||||
|
||||
// diskUsage 返回剩余与总空间（字节）
|
||||
func diskUsage(path string) (free, total uint64, err error) {
|
||||
var st syscall.Statfs_t
|
||||
if err := syscall.Statfs(path, &st); err != nil {
|
||||
return 0, 0, err
|
||||
}
|
||||
return st.Bavail * uint64(st.Bsize), st.Blocks * uint64(st.Bsize), nil
|
||||
}
|
||||
+44
-110
@@ -1,18 +1,30 @@
|
||||
# ============================================================
|
||||
# lokistack - Production Docker Compose Configuration
|
||||
# ============================================================
|
||||
# Features:
|
||||
# - Multi-instance deployment with load balancing
|
||||
# - Read-only root filesystem for security
|
||||
# - tmpfs for temporary directories
|
||||
# - Stricter resource limits
|
||||
# - Docker Secrets support
|
||||
# - Health checks with longer intervals
|
||||
# - Rolling update configuration
|
||||
# ⚠️ 重要：本平台是【单写者】架构，只能跑一个应用实例。
|
||||
#
|
||||
# 原因：全部状态存在 /app/data/opsxloki.json（JSON 文件 DB），
|
||||
# 进程内用一把读写锁 + 全量写盘来保证一致性。两个实例各挂各的卷时：
|
||||
# - 数据完全不共享 → 页面刷新两次可能看到不同结果（负载均衡打到不同实例）
|
||||
# - 写操作只落一个实例 → 另一个实例随后全量写盘会把对方的数据覆盖掉
|
||||
# - 不是高可用，是数据分裂
|
||||
# 曾经此文件配置 lokistack-1 / lokistack-2 双实例 + nginx 轮询，
|
||||
# 属于**看起来高可用、实际会丢数据**的错误配置，已改为单实例。
|
||||
#
|
||||
# 真要高可用，得先把存储层换成外部数据库（MySQL/PostgreSQL），
|
||||
# 那是架构变更，不是加个副本能解决的。
|
||||
#
|
||||
# 本文件提供的生产特性：
|
||||
# - 只读根文件系统 + tmpfs 可写目录（容器逃逸面收敛）
|
||||
# - 严格资源限制与 pids 上限
|
||||
# - Docker Secrets 注入密钥（不落环境变量/命令行）
|
||||
# - 健康检查 + 优雅停机（30s，等 DB 落盘完成）
|
||||
# - 日志轮转（json-file max-size/max-file）
|
||||
# - nginx 只做 TLS/反代，不做负载均衡
|
||||
# ============================================================
|
||||
|
||||
services:
|
||||
# ---- Nginx Load Balancer ----
|
||||
# ---- Nginx 反向代理（单后端，仅做 TLS / 统一入口）----
|
||||
nginx:
|
||||
image: nginx:1.27-alpine
|
||||
container_name: lokistack-lb
|
||||
@@ -24,7 +36,7 @@ services:
|
||||
networks:
|
||||
- lokistack-net
|
||||
healthcheck:
|
||||
test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080/health"]
|
||||
test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080/api/v1/health"]
|
||||
interval: 30s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
@@ -52,21 +64,19 @@ services:
|
||||
- /var/cache/nginx:noexec,nosuid,size=10m
|
||||
- /var/run:noexec,nosuid,size=5m
|
||||
depends_on:
|
||||
lokistack-1:
|
||||
condition: service_healthy
|
||||
lokistack-2:
|
||||
lokistack:
|
||||
condition: service_healthy
|
||||
|
||||
# ---- Application Instance 1 ----
|
||||
lokistack-1:
|
||||
# ---- 应用（唯一实例）----
|
||||
lokistack:
|
||||
build:
|
||||
context: .
|
||||
dockerfile: Dockerfile
|
||||
args:
|
||||
TARGETARCH: ${TARGETARCH:-amd64}
|
||||
image: lghost/lokistack:latest
|
||||
container_name: lokistack-1
|
||||
hostname: lokistack-1
|
||||
image: lghost/lokistack:${IMAGE_TAG:-latest}
|
||||
container_name: lokistack
|
||||
hostname: lokistack
|
||||
restart: unless-stopped
|
||||
|
||||
security_opt:
|
||||
@@ -76,26 +86,22 @@ services:
|
||||
cap_add:
|
||||
- NET_BIND_SERVICE
|
||||
|
||||
# P0: Read-only root filesystem
|
||||
# 只读根文件系统：数据目录与 tmpfs 之外不可写
|
||||
read_only: true
|
||||
|
||||
# P0: tmpfs for writable directories
|
||||
tmpfs:
|
||||
- /tmp:noexec,nosuid,size=50m,uid=1000,gid=1000
|
||||
|
||||
volumes:
|
||||
# Named volume for data persistence
|
||||
- lokistack-data-1:/app/data
|
||||
# kubeconfig read-only (P0: non-root path)
|
||||
# 唯一数据卷：DB + kubeconfigs/ + known_hosts/ + backups/
|
||||
- lokistack-data:/app/data
|
||||
- ${KUBECONFIG_PATH:-~/.kube}:/home/lokistack/.kube:ro
|
||||
# SSH keys read-only
|
||||
- ${SSH_KEY_PATH:-~/.ssh}:/home/lokistack/.ssh:ro
|
||||
|
||||
environment:
|
||||
- SERVER_PORT=8080
|
||||
- DATA_DIR=/app/data
|
||||
- KUBECONFIG=/home/lokistack/.kube/config
|
||||
# Secrets via Docker Secrets file injection
|
||||
# 密钥走 Docker Secrets 文件注入，不进环境变量（ps/env 里看不到）
|
||||
- JWT_SECRET_FILE=${JWT_SECRET_FILE:-/run/secrets/jwt_secret}
|
||||
- ENCRYPTION_KEY_FILE=${ENCRYPTION_KEY_FILE:-/run/secrets/encryption_key}
|
||||
|
||||
@@ -103,24 +109,26 @@ services:
|
||||
- jwt_secret
|
||||
- encryption_key
|
||||
|
||||
# Health check
|
||||
healthcheck:
|
||||
test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080/index.html"]
|
||||
# 用 API 健康端点而不是静态文件：静态文件返回 200 只能说明 nginx/文件在，
|
||||
# 不能说明 DB 和业务可用
|
||||
test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080/api/v1/health"]
|
||||
interval: 30s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 20s
|
||||
|
||||
# Stricter resource limits for production
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: '1.0'
|
||||
memory: 256M
|
||||
pids: 50
|
||||
# 平台要扛 JSON DB 全量读写 + 告警引擎 + 并发 API；
|
||||
# 实测 1 核/256M 在批量发布时会顶到 OOM，这里按 2C/2G 起步
|
||||
cpus: '2.0'
|
||||
memory: 2G
|
||||
pids: 200
|
||||
reservations:
|
||||
cpus: '0.25'
|
||||
memory: 64M
|
||||
cpus: '0.5'
|
||||
memory: 512M
|
||||
restart_policy:
|
||||
condition: on-failure
|
||||
delay: 5s
|
||||
@@ -132,90 +140,16 @@ services:
|
||||
options:
|
||||
max-size: "50m"
|
||||
max-file: "5"
|
||||
labels: "service,instance"
|
||||
|
||||
# 优雅停机：给正在进行的 DB 落盘留时间，避免 JSON 被截断
|
||||
stop_grace_period: 30s
|
||||
networks:
|
||||
- lokistack-net
|
||||
|
||||
# ---- Application Instance 2 ----
|
||||
lokistack-2:
|
||||
build:
|
||||
context: .
|
||||
dockerfile: Dockerfile
|
||||
args:
|
||||
TARGETARCH: ${TARGETARCH:-amd64}
|
||||
image: lghost/lokistack:latest
|
||||
container_name: lokistack-2
|
||||
hostname: lokistack-2
|
||||
restart: unless-stopped
|
||||
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
cap_drop:
|
||||
- ALL
|
||||
cap_add:
|
||||
- NET_BIND_SERVICE
|
||||
|
||||
read_only: true
|
||||
|
||||
tmpfs:
|
||||
- /tmp:noexec,nosuid,size=50m,uid=1000,gid=1000
|
||||
|
||||
volumes:
|
||||
- lokistack-data-2:/app/data
|
||||
- ${KUBECONFIG_PATH:-~/.kube}:/home/lokistack/.kube:ro
|
||||
- ${SSH_KEY_PATH:-~/.ssh}:/home/lokistack/.ssh:ro
|
||||
|
||||
environment:
|
||||
- SERVER_PORT=8080
|
||||
- DATA_DIR=/app/data
|
||||
- KUBECONFIG=/home/lokistack/.kube/config
|
||||
- JWT_SECRET_FILE=${JWT_SECRET_FILE:-/run/secrets/jwt_secret}
|
||||
- ENCRYPTION_KEY_FILE=${ENCRYPTION_KEY_FILE:-/run/secrets/encryption_key}
|
||||
|
||||
secrets:
|
||||
- jwt_secret
|
||||
- encryption_key
|
||||
|
||||
healthcheck:
|
||||
test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080/index.html"]
|
||||
interval: 30s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 20s
|
||||
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: '1.0'
|
||||
memory: 256M
|
||||
pids: 50
|
||||
reservations:
|
||||
cpus: '0.25'
|
||||
memory: 64M
|
||||
restart_policy:
|
||||
condition: on-failure
|
||||
delay: 5s
|
||||
max_attempts: 3
|
||||
window: 60s
|
||||
|
||||
logging:
|
||||
driver: "json-file"
|
||||
options:
|
||||
max-size: "50m"
|
||||
max-file: "5"
|
||||
labels: "service,instance"
|
||||
|
||||
stop_grace_period: 30s
|
||||
networks:
|
||||
- lokistack-net
|
||||
|
||||
# ---- Named Volumes ----
|
||||
volumes:
|
||||
lokistack-data-1:
|
||||
driver: local
|
||||
lokistack-data-2:
|
||||
lokistack-data:
|
||||
driver: local
|
||||
|
||||
# ---- Docker Secrets ----
|
||||
|
||||
@@ -0,0 +1,102 @@
|
||||
// 系统运维域 API：审计日志 / 备份恢复 / 自检
|
||||
import { http, buildQuery } from '../http';
|
||||
|
||||
export interface AuditLog {
|
||||
id: number;
|
||||
userId: number;
|
||||
username: string;
|
||||
role?: string;
|
||||
ip: string;
|
||||
userAgent?: string;
|
||||
module: string;
|
||||
action: string;
|
||||
resource: string;
|
||||
resourceId?: string;
|
||||
method: string;
|
||||
path: string;
|
||||
status: number;
|
||||
durationMs: number;
|
||||
detail?: string;
|
||||
before?: string;
|
||||
after?: string;
|
||||
error?: string;
|
||||
createdAt: string;
|
||||
}
|
||||
|
||||
export interface AuditListParams {
|
||||
page?: number;
|
||||
pageSize?: number;
|
||||
username?: string;
|
||||
module?: string;
|
||||
action?: string;
|
||||
resourceId?: string;
|
||||
status?: number;
|
||||
startTime?: string;
|
||||
endTime?: string;
|
||||
}
|
||||
|
||||
export interface AuditStats {
|
||||
todayCount: number;
|
||||
weekCount: number;
|
||||
failCount: number;
|
||||
totalCount: number;
|
||||
topModules: { name: string; count: number }[];
|
||||
topUsers: { name: string; count: number }[];
|
||||
}
|
||||
|
||||
export interface SelfCheckItem {
|
||||
name: string;
|
||||
status: 'ok' | 'warn' | 'error';
|
||||
message?: string;
|
||||
detail?: string;
|
||||
}
|
||||
|
||||
export interface SelfCheckResult {
|
||||
checkedAt: string;
|
||||
overall: 'ok' | 'warn' | 'error';
|
||||
items: SelfCheckItem[];
|
||||
}
|
||||
|
||||
export interface BackupFile {
|
||||
name: string;
|
||||
sizeBytes: number;
|
||||
createdAt: string;
|
||||
}
|
||||
|
||||
export interface RestoreResult {
|
||||
manifest: {
|
||||
version: string;
|
||||
createdAt: string;
|
||||
dbBytes: number;
|
||||
recordCount: number;
|
||||
note: string;
|
||||
};
|
||||
keyMatches: boolean;
|
||||
rowsInBackup: number;
|
||||
currentRows: number;
|
||||
stagedPath?: string;
|
||||
warning?: string;
|
||||
}
|
||||
|
||||
export const systemApi = {
|
||||
// 审计
|
||||
auditList: (params: AuditListParams = {}) =>
|
||||
http.get<{ list: AuditLog[]; total: number; page: number; pageSize: number }>(
|
||||
`/audit-logs${buildQuery(params as Record<string, unknown>)}`,
|
||||
),
|
||||
auditGet: (id: number) => http.get<AuditLog>(`/audit-logs/${id}`),
|
||||
auditStats: () => http.get<AuditStats>('/audit-logs/stats'),
|
||||
|
||||
// 自检
|
||||
selfCheck: () => http.get<SelfCheckResult>('/system/self-check'),
|
||||
|
||||
// 备份恢复
|
||||
backups: () => http.get<{ list: BackupFile[] }>('/system/backups'),
|
||||
restore: (file: File) => {
|
||||
const form = new FormData();
|
||||
form.append('file', file);
|
||||
return http.post<RestoreResult>('/system/restore', form);
|
||||
},
|
||||
restoreApply: () =>
|
||||
http.post<{ message: string; dbPath: string }>('/system/restore/apply', { confirm: true }),
|
||||
};
|
||||
@@ -0,0 +1,57 @@
|
||||
import { memo, useMemo } from 'react'
|
||||
import { Link, useLocation } from 'react-router'
|
||||
import { useTranslation } from 'react-i18next'
|
||||
import { findGroupKey, findGroupRoutes } from '@/router/routes'
|
||||
import { cn } from '@/lib/utils'
|
||||
|
||||
/**
|
||||
* 分组页内 tab 切换条。
|
||||
*
|
||||
* 背景：侧栏菜单曾膨胀到 13 项（集群/主机/存储/部署/采集/查询/分析/告警/用户/
|
||||
* 审计/设置…），新人不清楚该从哪进。现在把同一心智模型的页面收成一个侧栏入口：
|
||||
* 资源接入 = 集群 + 主机 + 存储
|
||||
* 日志服务 = Loki 实例 + 采集器
|
||||
* 日志 = 查询 + 分析
|
||||
* 系统管理 = 用户 + 审计 + 设置
|
||||
* 但 URL 完全不改（书签、审计记录、文档里的链接都还有效），
|
||||
* 靠这条 tab 条在组内切换 —— 等于给每组合并后的页面加了"分页"。
|
||||
*
|
||||
* 不在任何分组内的页面，本组件直接不渲染（零影响）。
|
||||
*/
|
||||
export const GroupTabs = memo(function GroupTabs() {
|
||||
const location = useLocation()
|
||||
const { t } = useTranslation()
|
||||
|
||||
const groupKey = findGroupKey(location.pathname)
|
||||
const groupRoutes = useMemo(() => (groupKey ? findGroupRoutes(groupKey) : []), [groupKey])
|
||||
|
||||
if (!groupKey || groupRoutes.length < 2) return null
|
||||
|
||||
return (
|
||||
<div
|
||||
className="flex items-center gap-1 overflow-x-auto border-b border-border px-4 md:px-6"
|
||||
role="tablist"
|
||||
aria-label={t(`menu.groups.${groupKey}`, groupKey)}
|
||||
>
|
||||
{groupRoutes.map(route => {
|
||||
const active = location.pathname === route.path
|
||||
return (
|
||||
<Link
|
||||
key={route.path}
|
||||
to={route.path}
|
||||
role="tab"
|
||||
aria-selected={active}
|
||||
className={cn(
|
||||
'relative whitespace-nowrap px-3 py-2.5 text-sm transition-colors',
|
||||
active
|
||||
? 'font-semibold text-foreground after:absolute after:inset-x-2 after:-bottom-px after:h-0.5 after:rounded-full after:bg-primary'
|
||||
: 'text-muted-foreground hover:text-foreground'
|
||||
)}
|
||||
>
|
||||
{t(route.meta.title)}
|
||||
</Link>
|
||||
)
|
||||
})}
|
||||
</div>
|
||||
)
|
||||
})
|
||||
@@ -21,7 +21,8 @@ import { useTheme } from 'next-themes'
|
||||
import { useTranslation } from 'react-i18next'
|
||||
import { cn } from '@/lib/utils'
|
||||
import { useIsMobile } from '@/hooks/use-mobile'
|
||||
import { menuItems, findRouteMeta } from '@/router/routes'
|
||||
import { menuItems, findRouteMeta, findGroupKey } from '@/router/routes'
|
||||
import { GroupTabs } from './GroupTabs'
|
||||
import { getUser, clearAuth } from '@/lib/auth-storage'
|
||||
import { isThemeAuto, setThemeAuto } from '@/lib/theme-schedule'
|
||||
import { useScheduledTheme } from '@/hooks/useScheduledTheme'
|
||||
@@ -41,7 +42,11 @@ function SidebarNav({ collapsed, onNavigate }: { collapsed: boolean; onNavigate?
|
||||
return (
|
||||
<nav className="flex-1 py-4 px-2 space-y-1 overflow-y-auto" aria-label={t('layout.nav')}>
|
||||
{visibleItems.map((item) => {
|
||||
const isActive = location.pathname === item.path
|
||||
// 分组入口：当前路由属于该分组时高亮（进入 /hosts 也要让「资源接入」亮）
|
||||
const currentGroup = findGroupKey(location.pathname)
|
||||
const isActive = item.groupKey
|
||||
? currentGroup === item.groupKey
|
||||
: location.pathname === item.path
|
||||
return (
|
||||
<Link
|
||||
key={item.path}
|
||||
@@ -256,6 +261,9 @@ const Layout = memo(function Layout({ children }: { children: React.ReactNode })
|
||||
</div>
|
||||
</header>
|
||||
|
||||
{/* 分组 tab（资源接入 / 日志服务 / 日志 / 系统管理）；不属于分组时不渲染 */}
|
||||
<GroupTabs />
|
||||
|
||||
{/* Page Content — 页面级 Suspense 边界，懒加载时不闪布局 */}
|
||||
<main className="flex-1 overflow-auto p-4 md:p-6">
|
||||
<Suspense fallback={<PageSkeleton />}>{children}</Suspense>
|
||||
|
||||
@@ -15,6 +15,8 @@ import zhAnalysis from './locales/zh/analysis'
|
||||
import enAnalysis from './locales/en/analysis'
|
||||
import zhLogs from './locales/zh/logs'
|
||||
import enLogs from './locales/en/logs'
|
||||
import zhAudit from './locales/zh/audit'
|
||||
import enAudit from './locales/en/audit'
|
||||
|
||||
const DOMAIN_BUNDLES: ReadonlyArray<[string, string, object]> = [
|
||||
['zh', 'dashboard', zhDashboard],
|
||||
@@ -27,6 +29,8 @@ const DOMAIN_BUNDLES: ReadonlyArray<[string, string, object]> = [
|
||||
['en', 'analysis', enAnalysis],
|
||||
['zh', 'logs', zhLogs],
|
||||
['en', 'logs', enLogs],
|
||||
['zh', 'audit', zhAudit],
|
||||
['en', 'audit', enAudit],
|
||||
]
|
||||
|
||||
for (const [lng, ns, resources] of DOMAIN_BUNDLES) {
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
// audit namespace — audit log page (English)
|
||||
export default {
|
||||
title: 'Audit Log',
|
||||
description: 'Every write operation: who changed what and when, with before/after diff',
|
||||
refresh: 'Refresh',
|
||||
loadFailed: 'Failed to load audit logs',
|
||||
filter: 'Filters',
|
||||
filterUsername: 'Search by username',
|
||||
filterAllModules: 'All modules',
|
||||
filterAllStatus: 'All results',
|
||||
filterSuccess: 'Success only',
|
||||
filterFailed: 'Failed only',
|
||||
total: '{{count}} records',
|
||||
emptyTitle: 'No audit records',
|
||||
emptyDesc: 'All future write operations (deploy, collect, storage, cluster, user…) are recorded here automatically',
|
||||
detailTruncated: 'Detail truncated; showing the summary from the list',
|
||||
stat: {
|
||||
today: 'Today',
|
||||
week: 'Last 7 days',
|
||||
failed: 'Failed',
|
||||
total: 'Total',
|
||||
},
|
||||
col: {
|
||||
time: 'Time',
|
||||
user: 'User',
|
||||
module: 'Module',
|
||||
action: 'Action',
|
||||
target: 'Target',
|
||||
status: 'Status',
|
||||
ip: 'IP',
|
||||
},
|
||||
}
|
||||
@@ -2,6 +2,12 @@
|
||||
export default {
|
||||
appName: 'LokiStack',
|
||||
menu: {
|
||||
groups: {
|
||||
resources: 'Resources',
|
||||
services: 'Log Service',
|
||||
logs: 'Logs',
|
||||
system: 'System',
|
||||
},
|
||||
dashboard: 'Dashboard',
|
||||
wizard: 'Deploy Wizard',
|
||||
clusters: 'Clusters',
|
||||
@@ -14,6 +20,7 @@ export default {
|
||||
analysis: 'Log Analysis',
|
||||
settings: 'Settings',
|
||||
users: 'Users',
|
||||
audit: 'Audit Log',
|
||||
login: 'Sign In',
|
||||
notFound: 'Page Not Found',
|
||||
},
|
||||
|
||||
@@ -9,6 +9,13 @@ export default {
|
||||
sshReady: 'SSH ready',
|
||||
status: 'Status',
|
||||
},
|
||||
selfCheck: {
|
||||
title: 'Self-check',
|
||||
loading: 'Running checks…',
|
||||
allGood: 'All healthy',
|
||||
needsAttention: '{{count}} item(s) need attention',
|
||||
hasError: '{{count}} error(s)',
|
||||
},
|
||||
quickStart: {
|
||||
title: 'Start collecting logs in three steps',
|
||||
subtitle: 'Target & environment → Storage → Deploy Loki, then add a collection strategy',
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
// audit 命名空间 — 审计日志页中文文案
|
||||
export default {
|
||||
title: '审计日志',
|
||||
description: '记录所有写操作：谁在什么时候改了什么，含变更前后对比',
|
||||
refresh: '刷新',
|
||||
loadFailed: '加载审计日志失败',
|
||||
filter: '筛选',
|
||||
filterUsername: '按用户名搜索',
|
||||
filterAllModules: '全部模块',
|
||||
filterAllStatus: '全部结果',
|
||||
filterSuccess: '仅成功',
|
||||
filterFailed: '仅失败',
|
||||
total: '共 {{count}} 条',
|
||||
emptyTitle: '暂无审计记录',
|
||||
emptyDesc: '之后的所有写操作（部署、采集、存储、集群、用户等）都会自动记录在这里',
|
||||
detailTruncated: '详情已截断，仅显示列表中的摘要',
|
||||
stat: {
|
||||
today: '今日操作',
|
||||
week: '近 7 天',
|
||||
failed: '失败操作',
|
||||
total: '累计记录',
|
||||
},
|
||||
col: {
|
||||
time: '时间',
|
||||
user: '操作人',
|
||||
module: '模块',
|
||||
action: '动作',
|
||||
target: '对象',
|
||||
status: '状态',
|
||||
ip: 'IP',
|
||||
},
|
||||
}
|
||||
@@ -2,6 +2,12 @@
|
||||
export default {
|
||||
appName: 'LokiStack',
|
||||
menu: {
|
||||
groups: {
|
||||
resources: '资源接入',
|
||||
services: '日志服务',
|
||||
logs: '日志',
|
||||
system: '系统管理',
|
||||
},
|
||||
dashboard: '仪表盘',
|
||||
wizard: '部署向导',
|
||||
clusters: '集群管理',
|
||||
@@ -14,6 +20,7 @@ export default {
|
||||
analysis: '日志分析',
|
||||
settings: '系统设置',
|
||||
users: '用户管理',
|
||||
audit: '审计日志',
|
||||
login: '登录',
|
||||
notFound: '页面不存在',
|
||||
},
|
||||
|
||||
@@ -9,6 +9,13 @@ export default {
|
||||
sshReady: 'SSH 就绪',
|
||||
status: '状态',
|
||||
},
|
||||
selfCheck: {
|
||||
title: '平台自检',
|
||||
loading: '正在自检…',
|
||||
allGood: '全部正常',
|
||||
needsAttention: '{{count}} 项需关注',
|
||||
hasError: '{{count}} 项异常',
|
||||
},
|
||||
quickStart: {
|
||||
title: '三步开始收集日志',
|
||||
subtitle: '环境与目标 → 存储 → 部署 Loki，最后添加采集策略',
|
||||
|
||||
@@ -0,0 +1,389 @@
|
||||
import { memo, useCallback, useEffect, useState } from 'react'
|
||||
import { useTranslation } from 'react-i18next'
|
||||
import { History, ShieldAlert, Search, RefreshCw, Eye } from 'lucide-react'
|
||||
import '@/i18n/domains'
|
||||
import { Button } from '@/components/ui/button'
|
||||
import { Input } from '@/components/ui/input'
|
||||
import { Card, CardContent, CardHeader, CardTitle } from '@/components/ui/card'
|
||||
import { PageContainer } from '@/components/PageContainer'
|
||||
import { LoadingSpinner } from '@/components/LoadingSpinner'
|
||||
import { EmptyState } from '@/components/EmptyState'
|
||||
import { ErrorState } from '@/components/ErrorState'
|
||||
import { PaginationBar } from '@/components/PaginationBar'
|
||||
import { systemApi, type AuditLog, type AuditStats } from '@/api/system'
|
||||
import { toast } from 'sonner'
|
||||
|
||||
const PAGE_SIZE = 20
|
||||
|
||||
/** 模块 → 中文名 + 配色。未知模块回退到原样显示。 */
|
||||
const MODULE_META: Record<string, { label: string; className: string }> = {
|
||||
deployments: { label: '部署', className: 'bg-info/10 text-info' },
|
||||
collectors: { label: '采集器', className: 'bg-warning/10 text-warning' },
|
||||
storage: { label: '存储', className: 'bg-success/10 text-success' },
|
||||
clusters: { label: '集群', className: 'bg-primary/10 text-primary' },
|
||||
hosts: { label: '主机', className: 'bg-primary/10 text-primary' },
|
||||
users: { label: '用户', className: 'bg-destructive/10 text-destructive' },
|
||||
logs: { label: '日志', className: 'bg-muted text-muted-foreground' },
|
||||
alerts: { label: '告警', className: 'bg-warning/10 text-warning' },
|
||||
auth: { label: '登录', className: 'bg-muted text-muted-foreground' },
|
||||
system: { label: '系统', className: 'bg-destructive/10 text-destructive' },
|
||||
}
|
||||
|
||||
const ACTION_META: Record<string, string> = {
|
||||
create: '新增',
|
||||
update: '修改',
|
||||
delete: '删除',
|
||||
deploy: '部署',
|
||||
stop: '停止',
|
||||
restart: '重启',
|
||||
install: '安装',
|
||||
uninstall: '卸载',
|
||||
test: '测试',
|
||||
validate: '校验',
|
||||
'reset-password': '重置密码',
|
||||
login: '登录',
|
||||
'change-password': '改密码',
|
||||
}
|
||||
|
||||
function ModuleBadge({ module }: { module: string }) {
|
||||
const meta = MODULE_META[module] ?? { label: module || '-', className: 'bg-muted text-muted-foreground' }
|
||||
return (
|
||||
<span className={`inline-flex items-center px-2 py-0.5 rounded-full text-xs font-medium ${meta.className}`}>
|
||||
{meta.label}
|
||||
</span>
|
||||
)
|
||||
}
|
||||
|
||||
function StatusBadge({ status }: { status: number }) {
|
||||
const ok = status >= 200 && status < 400
|
||||
return (
|
||||
<span
|
||||
className={`inline-flex items-center px-2 py-0.5 rounded-full text-xs font-medium ${
|
||||
ok ? 'bg-success/10 text-success' : 'bg-destructive/10 text-destructive'
|
||||
}`}
|
||||
>
|
||||
{status}
|
||||
</span>
|
||||
)
|
||||
}
|
||||
|
||||
/** 详情弹窗：展示 Before/After 变更 diff 与错误原文 */
|
||||
const DetailDialog = memo(function DetailDialog({
|
||||
entry,
|
||||
onClose,
|
||||
}: {
|
||||
entry: AuditLog | null
|
||||
onClose: () => void
|
||||
}) {
|
||||
if (!entry) return null
|
||||
const pretty = (s?: string) => {
|
||||
if (!s) return ''
|
||||
try {
|
||||
return JSON.stringify(JSON.parse(s), null, 2)
|
||||
} catch {
|
||||
return s
|
||||
}
|
||||
}
|
||||
return (
|
||||
<div
|
||||
className="fixed inset-0 z-50 flex items-center justify-center bg-black/50 p-4"
|
||||
onClick={onClose}
|
||||
role="presentation"
|
||||
>
|
||||
<div
|
||||
className="w-full max-w-3xl max-h-[80vh] overflow-auto rounded-lg border border-border bg-background p-5 shadow-xl"
|
||||
onClick={e => e.stopPropagation()}
|
||||
role="dialog"
|
||||
aria-modal="true"
|
||||
>
|
||||
<div className="flex items-start justify-between gap-4">
|
||||
<div>
|
||||
<h3 className="text-base font-semibold">
|
||||
{ACTION_META[entry.action] ?? entry.action} · {entry.resource || entry.module}
|
||||
{entry.resourceId ? ` #${entry.resourceId}` : ''}
|
||||
</h3>
|
||||
<p className="mt-1 text-xs text-muted-foreground">
|
||||
{entry.username || '-'}（{entry.role || '-'}） · {entry.ip} ·{' '}
|
||||
{new Date(entry.createdAt).toLocaleString()} · {entry.durationMs}ms
|
||||
</p>
|
||||
</div>
|
||||
<Button variant="outline" size="sm" onClick={onClose}>
|
||||
关闭
|
||||
</Button>
|
||||
</div>
|
||||
|
||||
{entry.detail && (
|
||||
<div className="mt-4">
|
||||
<div className="text-xs font-medium text-muted-foreground mb-1">说明</div>
|
||||
<p className="text-sm">{entry.detail}</p>
|
||||
</div>
|
||||
)}
|
||||
|
||||
{(entry.before || entry.after) && (
|
||||
<div className="mt-4 grid gap-3 sm:grid-cols-2">
|
||||
<div>
|
||||
<div className="text-xs font-medium text-muted-foreground mb-1">变更前</div>
|
||||
<pre className="max-h-60 overflow-auto rounded-md border border-border bg-muted/30 p-2 text-xs">
|
||||
{pretty(entry.before) || '（无）'}
|
||||
</pre>
|
||||
</div>
|
||||
<div>
|
||||
<div className="text-xs font-medium text-muted-foreground mb-1">变更后</div>
|
||||
<pre className="max-h-60 overflow-auto rounded-md border border-border bg-muted/30 p-2 text-xs">
|
||||
{pretty(entry.after) || '（无）'}
|
||||
</pre>
|
||||
</div>
|
||||
</div>
|
||||
)}
|
||||
|
||||
{entry.error && (
|
||||
<div className="mt-4">
|
||||
<div className="text-xs font-medium text-destructive mb-1">失败原因</div>
|
||||
<pre className="max-h-40 overflow-auto rounded-md border border-destructive/30 bg-destructive/5 p-2 text-xs text-destructive">
|
||||
{entry.error}
|
||||
</pre>
|
||||
</div>
|
||||
)}
|
||||
|
||||
<div className="mt-4 text-xs text-muted-foreground">
|
||||
{entry.method} {entry.path}
|
||||
{entry.userAgent ? ` · ${entry.userAgent}` : ''}
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
)
|
||||
})
|
||||
|
||||
/**
|
||||
* 审计日志页（admin 专用）
|
||||
*
|
||||
* 定位：回答「谁在什么时候改了什么」。平台的全部写操作（部署/采集/存储/集群/
|
||||
* 主机/用户/策略/告警）都由后端中间件自动记录，handler 会补充业务语义与变更 diff。
|
||||
* 数据保留 90 天 / 最多 2 万条。
|
||||
*/
|
||||
export default function AuditPage() {
|
||||
const { t } = useTranslation('audit')
|
||||
const [list, setList] = useState<AuditLog[]>([])
|
||||
const [total, setTotal] = useState(0)
|
||||
const [page, setPage] = useState(1)
|
||||
const [stats, setStats] = useState<AuditStats | null>(null)
|
||||
const [loading, setLoading] = useState(true)
|
||||
const [error, setError] = useState<string | null>(null)
|
||||
const [detail, setDetail] = useState<AuditLog | null>(null)
|
||||
|
||||
// 过滤条件
|
||||
const [username, setUsername] = useState('')
|
||||
const [module, setModule] = useState('')
|
||||
const [statusFilter, setStatusFilter] = useState(0)
|
||||
|
||||
const load = useCallback(async () => {
|
||||
setLoading(true)
|
||||
setError(null)
|
||||
try {
|
||||
const [res, st] = await Promise.all([
|
||||
systemApi.auditList({ page, pageSize: PAGE_SIZE, username, module, status: statusFilter }),
|
||||
systemApi.auditStats(),
|
||||
])
|
||||
setList(Array.isArray(res.list) ? res.list : [])
|
||||
setTotal(res.total ?? 0)
|
||||
setStats(st ?? null)
|
||||
} catch (e) {
|
||||
setError(e instanceof Error ? e.message : t('loadFailed'))
|
||||
} finally {
|
||||
setLoading(false)
|
||||
}
|
||||
}, [page, username, module, statusFilter, t])
|
||||
|
||||
useEffect(() => {
|
||||
void load()
|
||||
}, [load])
|
||||
|
||||
// 过滤条件变化时回到第一页，避免停在空白页
|
||||
useEffect(() => {
|
||||
setPage(1)
|
||||
}, [username, module, statusFilter])
|
||||
|
||||
|
||||
const cards = [
|
||||
{ label: t('stat.today'), value: stats?.todayCount ?? 0, icon: History },
|
||||
{ label: t('stat.week'), value: stats?.weekCount ?? 0, icon: History },
|
||||
{
|
||||
label: t('stat.failed'),
|
||||
value: stats?.failCount ?? 0,
|
||||
icon: ShieldAlert,
|
||||
danger: (stats?.failCount ?? 0) > 0,
|
||||
},
|
||||
{ label: t('stat.total'), value: stats?.totalCount ?? 0, icon: History },
|
||||
]
|
||||
|
||||
return (
|
||||
<PageContainer
|
||||
title={t('title')}
|
||||
description={t('description')}
|
||||
action={
|
||||
<Button variant="outline" size="sm" onClick={() => void load()} disabled={loading}>
|
||||
<RefreshCw className={`w-4 h-4 mr-1.5 ${loading ? 'animate-spin' : ''}`} />
|
||||
{t('refresh')}
|
||||
</Button>
|
||||
}
|
||||
>
|
||||
{/* 统计卡片 */}
|
||||
<div className="grid gap-3 sm:grid-cols-2 lg:grid-cols-4">
|
||||
{cards.map(c => {
|
||||
const Icon = c.icon
|
||||
return (
|
||||
<Card key={c.label}>
|
||||
<CardContent className="flex items-center gap-3 p-4">
|
||||
<div
|
||||
className={`flex h-9 w-9 items-center justify-center rounded-md ${
|
||||
c.danger ? 'bg-destructive/10 text-destructive' : 'bg-primary/10 text-primary'
|
||||
}`}
|
||||
>
|
||||
<Icon className="h-4 w-4" />
|
||||
</div>
|
||||
<div>
|
||||
<div className="text-xs text-muted-foreground">{c.label}</div>
|
||||
<div className={`text-lg font-semibold ${c.danger ? 'text-destructive' : ''}`}>
|
||||
{c.value.toLocaleString()}
|
||||
</div>
|
||||
</div>
|
||||
</CardContent>
|
||||
</Card>
|
||||
)
|
||||
})}
|
||||
</div>
|
||||
|
||||
{/* 过滤条 */}
|
||||
<Card>
|
||||
<CardHeader className="pb-3">
|
||||
<CardTitle className="text-sm font-medium">{t('filter')}</CardTitle>
|
||||
</CardHeader>
|
||||
<CardContent className="flex flex-wrap items-center gap-2">
|
||||
<div className="relative">
|
||||
<Search className="pointer-events-none absolute left-2 top-1/2 h-4 w-4 -translate-y-1/2 text-muted-foreground" />
|
||||
<Input
|
||||
className="w-48 pl-8"
|
||||
placeholder={t('filterUsername')}
|
||||
value={username}
|
||||
onChange={e => setUsername(e.target.value)}
|
||||
/>
|
||||
</div>
|
||||
<select
|
||||
className="h-9 rounded-md border border-border bg-background px-2 text-sm"
|
||||
value={module}
|
||||
onChange={e => setModule(e.target.value)}
|
||||
>
|
||||
<option value="">{t('filterAllModules')}</option>
|
||||
{Object.entries(MODULE_META).map(([key, meta]) => (
|
||||
<option key={key} value={key}>
|
||||
{meta.label}
|
||||
</option>
|
||||
))}
|
||||
</select>
|
||||
<select
|
||||
className="h-9 rounded-md border border-border bg-background px-2 text-sm"
|
||||
value={statusFilter}
|
||||
onChange={e => setStatusFilter(Number(e.target.value))}
|
||||
>
|
||||
<option value={0}>{t('filterAllStatus')}</option>
|
||||
<option value={1}>{t('filterSuccess')}</option>
|
||||
<option value={2}>{t('filterFailed')}</option>
|
||||
</select>
|
||||
<span className="ml-auto text-xs text-muted-foreground">
|
||||
{t('total', { count: total })}
|
||||
</span>
|
||||
</CardContent>
|
||||
</Card>
|
||||
|
||||
{/* 列表 */}
|
||||
<Card>
|
||||
<CardContent className="p-0">
|
||||
{loading ? (
|
||||
<div className="flex justify-center py-16">
|
||||
<LoadingSpinner />
|
||||
</div>
|
||||
) : error ? (
|
||||
<ErrorState message={error} onRetry={() => void load()} />
|
||||
) : list.length === 0 ? (
|
||||
<EmptyState icon={History} title={t('emptyTitle')} description={t('emptyDesc')} />
|
||||
) : (
|
||||
<div className="overflow-x-auto">
|
||||
<table className="w-full text-sm">
|
||||
<thead className="border-b border-border bg-muted/30 text-xs text-muted-foreground">
|
||||
<tr>
|
||||
<th className="px-3 py-2 text-left font-medium whitespace-nowrap">{t('col.time')}</th>
|
||||
<th className="px-3 py-2 text-left font-medium">{t('col.user')}</th>
|
||||
<th className="px-3 py-2 text-left font-medium">{t('col.module')}</th>
|
||||
<th className="px-3 py-2 text-left font-medium">{t('col.action')}</th>
|
||||
<th className="px-3 py-2 text-left font-medium">{t('col.target')}</th>
|
||||
<th className="px-3 py-2 text-left font-medium">{t('col.status')}</th>
|
||||
<th className="px-3 py-2 text-left font-medium whitespace-nowrap">{t('col.ip')}</th>
|
||||
<th className="px-3 py-2" />
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
{list.map(item => (
|
||||
<tr
|
||||
key={item.id}
|
||||
className="border-b border-border/50 last:border-0 hover:bg-muted/20"
|
||||
>
|
||||
<td className="px-3 py-2 whitespace-nowrap text-xs text-muted-foreground">
|
||||
{new Date(item.createdAt).toLocaleString()}
|
||||
</td>
|
||||
<td className="px-3 py-2 whitespace-nowrap">{item.username || '-'}</td>
|
||||
<td className="px-3 py-2">
|
||||
<ModuleBadge module={item.module} />
|
||||
</td>
|
||||
<td className="px-3 py-2 whitespace-nowrap">
|
||||
{ACTION_META[item.action] ?? item.action}
|
||||
</td>
|
||||
<td className="px-3 py-2">
|
||||
<div className="max-w-[260px] truncate" title={item.detail || item.resource}>
|
||||
{item.detail || item.resource || '-'}
|
||||
{item.resourceId ? ` #${item.resourceId}` : ''}
|
||||
</div>
|
||||
</td>
|
||||
<td className="px-3 py-2">
|
||||
<StatusBadge status={item.status} />
|
||||
</td>
|
||||
<td className="px-3 py-2 whitespace-nowrap text-xs text-muted-foreground">
|
||||
{item.ip}
|
||||
</td>
|
||||
<td className="px-3 py-2 text-right">
|
||||
<Button
|
||||
variant="ghost"
|
||||
size="sm"
|
||||
onClick={async () => {
|
||||
// 列表接口已带 Before/After，先直接展示；
|
||||
// 若被截断再取详情（详情接口返回完整内容）
|
||||
try {
|
||||
const full = await systemApi.auditGet(item.id)
|
||||
setDetail(full)
|
||||
} catch {
|
||||
setDetail(item)
|
||||
toast.warning(t('detailTruncated'))
|
||||
}
|
||||
}}
|
||||
>
|
||||
<Eye className="w-4 h-4" />
|
||||
</Button>
|
||||
</td>
|
||||
</tr>
|
||||
))}
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
)}
|
||||
|
||||
{!loading && !error && list.length > 0 && (
|
||||
<div className="border-t border-border px-3 py-2">
|
||||
<PaginationBar page={page} pageSize={PAGE_SIZE} total={total} onPageChange={setPage} />
|
||||
</div>
|
||||
)}
|
||||
</CardContent>
|
||||
</Card>
|
||||
|
||||
<DetailDialog entry={detail} onClose={() => setDetail(null)} />
|
||||
</PageContainer>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,120 @@
|
||||
import { memo, useCallback, useEffect, useState } from 'react'
|
||||
import { useTranslation } from 'react-i18next'
|
||||
import { Activity, AlertTriangle, CheckCircle2, RefreshCw, XCircle } from 'lucide-react'
|
||||
import { Card, CardContent, CardHeader, CardTitle } from '@/components/ui/card'
|
||||
import { Button } from '@/components/ui/button'
|
||||
import { systemApi, type SelfCheckResult } from '@/api/system'
|
||||
|
||||
/** 单项状态 → 图标与配色 */
|
||||
function StatusIcon({ status }: { status: 'ok' | 'warn' | 'error' }) {
|
||||
if (status === 'ok') return <CheckCircle2 className="h-4 w-4 text-success" />
|
||||
if (status === 'warn') return <AlertTriangle className="h-4 w-4 text-warning" />
|
||||
return <XCircle className="h-4 w-4 text-destructive" />
|
||||
}
|
||||
|
||||
/**
|
||||
* 一键自检 — 仪表盘顶部。
|
||||
*
|
||||
* 为什么放在仪表盘：新人接手/故障时第一眼看这里，不必在
|
||||
* 「集群/主机/存储/部署/采集器」五个页面之间来回跳着判断"到底哪坏了"。
|
||||
* 后端 /system/self-check 会真正探活（Loki /ready、集群凭证解密、磁盘空间），
|
||||
* 不是只读配置推断。
|
||||
*/
|
||||
export const SelfCheckCard = memo(function SelfCheckCard() {
|
||||
const { t } = useTranslation('dashboard')
|
||||
const [data, setData] = useState<SelfCheckResult | null>(null)
|
||||
const [loading, setLoading] = useState(true)
|
||||
const [failed, setFailed] = useState(false)
|
||||
|
||||
const load = useCallback(async () => {
|
||||
setLoading(true)
|
||||
setFailed(false)
|
||||
try {
|
||||
setData(await systemApi.selfCheck())
|
||||
} catch {
|
||||
// 自检失败本身不代表平台坏了（可能是权限或接口异常），
|
||||
// 这里静默降级，不打断仪表盘其它内容
|
||||
setFailed(true)
|
||||
} finally {
|
||||
setLoading(false)
|
||||
}
|
||||
}, [])
|
||||
|
||||
useEffect(() => {
|
||||
void load()
|
||||
}, [load])
|
||||
|
||||
if (loading && !data) {
|
||||
return (
|
||||
<Card>
|
||||
<CardContent className="flex items-center gap-2 p-4 text-sm text-muted-foreground">
|
||||
<RefreshCw className="h-4 w-4 animate-spin" />
|
||||
{t('selfCheck.loading')}
|
||||
</CardContent>
|
||||
</Card>
|
||||
)
|
||||
}
|
||||
if (failed || !data) return null
|
||||
|
||||
const problems = data.items.filter(i => i.status !== 'ok')
|
||||
const overallText =
|
||||
data.overall === 'ok'
|
||||
? t('selfCheck.allGood')
|
||||
: data.overall === 'warn'
|
||||
? t('selfCheck.needsAttention', { count: problems.length })
|
||||
: t('selfCheck.hasError', { count: problems.length })
|
||||
|
||||
const borderClass =
|
||||
data.overall === 'ok'
|
||||
? 'border-success/30'
|
||||
: data.overall === 'warn'
|
||||
? 'border-warning/40'
|
||||
: 'border-destructive/40'
|
||||
|
||||
return (
|
||||
<Card className={borderClass}>
|
||||
<CardHeader className="pb-2">
|
||||
<CardTitle className="flex items-center gap-2 text-sm font-medium">
|
||||
<Activity className="h-4 w-4" />
|
||||
{t('selfCheck.title')}
|
||||
<span
|
||||
className={`ml-1 text-xs font-normal ${
|
||||
data.overall === 'ok'
|
||||
? 'text-success'
|
||||
: data.overall === 'warn'
|
||||
? 'text-warning'
|
||||
: 'text-destructive'
|
||||
}`}
|
||||
>
|
||||
{overallText}
|
||||
</span>
|
||||
<span className="ml-auto text-xs font-normal text-muted-foreground">
|
||||
{new Date(data.checkedAt).toLocaleTimeString()}
|
||||
</span>
|
||||
<Button variant="ghost" size="sm" onClick={() => void load()} disabled={loading}>
|
||||
<RefreshCw className={`h-3.5 w-3.5 ${loading ? 'animate-spin' : ''}`} />
|
||||
</Button>
|
||||
</CardTitle>
|
||||
</CardHeader>
|
||||
<CardContent className="flex flex-wrap gap-x-6 gap-y-2 pt-0">
|
||||
{data.items.map(item => (
|
||||
<div key={item.name} className="flex items-start gap-1.5 text-xs" title={item.detail || ''}>
|
||||
<StatusIcon status={item.status} />
|
||||
<span className="text-muted-foreground">{item.name}</span>
|
||||
<span
|
||||
className={
|
||||
item.status === 'ok'
|
||||
? 'text-foreground'
|
||||
: item.status === 'warn'
|
||||
? 'text-warning'
|
||||
: 'text-destructive'
|
||||
}
|
||||
>
|
||||
{item.message}
|
||||
</span>
|
||||
</div>
|
||||
))}
|
||||
</CardContent>
|
||||
</Card>
|
||||
)
|
||||
})
|
||||
@@ -12,6 +12,7 @@ import { ErrorState } from '@/components/ErrorState'
|
||||
import { useDashboardStats } from './hooks/useDashboardStats'
|
||||
import { StatCard } from '@/components/StatCard'
|
||||
import { RecentDeploymentsCard } from './components/RecentDeploymentsCard'
|
||||
import { SelfCheckCard } from './components/SelfCheckCard'
|
||||
import { ResourceListCard } from './components/ResourceListCard'
|
||||
import type { DashboardStats } from '@/types'
|
||||
|
||||
@@ -122,6 +123,9 @@ const DashboardPage = memo(function DashboardPage() {
|
||||
</Card>
|
||||
)}
|
||||
|
||||
{/* 一键自检：把「哪里坏了」的判断收敛到仪表盘首屏 */}
|
||||
<SelfCheckCard />
|
||||
|
||||
{/* Stats Cards */}
|
||||
<div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-4 gap-4">
|
||||
{statCards}
|
||||
|
||||
+105
-20
@@ -15,6 +15,8 @@ import {
|
||||
ScrollText,
|
||||
BellRing,
|
||||
BarChart3,
|
||||
History,
|
||||
Boxes,
|
||||
} from 'lucide-react';
|
||||
import type { AppRoute, MenuItem, RouteMeta } from '@/types/router';
|
||||
|
||||
@@ -32,34 +34,117 @@ const LogsPage = lazy(() => import('@/pages/logs'));
|
||||
const AlertsPage = lazy(() => import('@/pages/alerts'));
|
||||
const UsersPage = lazy(() => import('@/pages/users'));
|
||||
const AnalysisPage = lazy(() => import('@/pages/analysis'));
|
||||
const AuditPage = lazy(() => import('@/pages/audit'));
|
||||
|
||||
export const routes: AppRoute[] = [
|
||||
{ path: '/login', component: Login, auth: false, meta: { title: 'menu.login', hideInMenu: true } },
|
||||
{ path: '/', component: Dashboard, auth: true, meta: { title: 'menu.dashboard', icon: LayoutDashboard, order: 1, adminOnly: true } },
|
||||
{ path: '/wizard', component: WizardPage, auth: true, meta: { title: 'menu.wizard', icon: Wand2, order: 2, adminOnly: true } },
|
||||
{ path: '/clusters', component: Clusters, auth: true, meta: { title: 'menu.clusters', icon: Server, order: 3, adminOnly: true } },
|
||||
{ path: '/hosts', component: Hosts, auth: true, meta: { title: 'menu.hosts', icon: Monitor, order: 4, adminOnly: true } },
|
||||
{ path: '/storage', component: Storage, auth: true, meta: { title: 'menu.storage', icon: HardDrive, order: 5, adminOnly: true } },
|
||||
{ path: '/deployments', component: Deployments, auth: true, meta: { title: 'menu.deployments', icon: Rocket, order: 6, adminOnly: true } },
|
||||
{ path: '/collectors', component: Collectors, auth: true, meta: { title: 'menu.collectors', icon: RadioTower, order: 7, adminOnly: true } },
|
||||
{ path: '/logs', component: LogsPage, auth: true, meta: { title: 'menu.logs', icon: ScrollText, order: 8 } },
|
||||
{ path: '/analysis', component: AnalysisPage, auth: true, meta: { title: 'menu.analysis', icon: BarChart3, order: 9, adminOnly: true } },
|
||||
{ path: '/alerts', component: AlertsPage, auth: true, meta: { title: 'menu.alerts', icon: BellRing, order: 10 } },
|
||||
{ path: '/settings', component: SettingsPage, auth: true, meta: { title: 'menu.settings', icon: Settings, order: 12, adminOnly: true } },
|
||||
{ path: '/users', component: UsersPage, auth: true, meta: { title: 'menu.users', icon: UsersRound, order: 11, adminOnly: true } },
|
||||
// ── 资源接入（集群 / 主机 / 存储）：装完基本不动的配置，合并为一个入口 ──
|
||||
{
|
||||
path: '/clusters', component: Clusters, auth: true,
|
||||
meta: {
|
||||
title: 'menu.clusters', icon: Server, order: 3, adminOnly: true,
|
||||
group: { key: 'resources', label: 'menu.groups.resources', icon: Boxes, order: 3 },
|
||||
},
|
||||
},
|
||||
{ path: '/hosts', component: Hosts, auth: true, meta: { title: 'menu.hosts', icon: Monitor, order: 4, adminOnly: true, groupKey: 'resources' } },
|
||||
{ path: '/storage', component: Storage, auth: true, meta: { title: 'menu.storage', icon: HardDrive, order: 5, adminOnly: true, groupKey: 'resources' } },
|
||||
|
||||
// ── 日志服务（Loki 实例 / 采集器）：部署与采集是同一件事的两半 ──
|
||||
{
|
||||
path: '/deployments', component: Deployments, auth: true,
|
||||
meta: {
|
||||
title: 'menu.deployments', icon: Rocket, order: 4, adminOnly: true,
|
||||
group: { key: 'services', label: 'menu.groups.services', icon: Rocket, order: 4 },
|
||||
},
|
||||
},
|
||||
{ path: '/collectors', component: Collectors, auth: true, meta: { title: 'menu.collectors', icon: RadioTower, order: 7, adminOnly: true, groupKey: 'services' } },
|
||||
|
||||
// ── 日志（查询 / 分析）：同一个数据源的不同视角 ──
|
||||
{
|
||||
path: '/logs', component: LogsPage, auth: true,
|
||||
meta: {
|
||||
title: 'menu.logs', icon: ScrollText, order: 5,
|
||||
group: { key: 'logs', label: 'menu.groups.logs', icon: ScrollText, order: 5 },
|
||||
},
|
||||
},
|
||||
{ path: '/analysis', component: AnalysisPage, auth: true, meta: { title: 'menu.analysis', icon: BarChart3, order: 9, adminOnly: true, groupKey: 'logs' } },
|
||||
|
||||
// ── 告警：独立入口（要盯的，不能被折叠） ──
|
||||
{ path: '/alerts', component: AlertsPage, auth: true, meta: { title: 'menu.alerts', icon: BellRing, order: 6 } },
|
||||
|
||||
// ── 系统管理（用户 / 审计 / 设置）：低频管理动作 ──
|
||||
{
|
||||
path: '/users', component: UsersPage, auth: true,
|
||||
meta: {
|
||||
title: 'menu.users', icon: UsersRound, order: 7, adminOnly: true,
|
||||
group: { key: 'system', label: 'menu.groups.system', icon: Settings, order: 7 },
|
||||
},
|
||||
},
|
||||
{ path: '/audit', component: AuditPage, auth: true, meta: { title: 'menu.audit', icon: History, order: 13, adminOnly: true, groupKey: 'system' } },
|
||||
{ path: '/settings', component: SettingsPage, auth: true, meta: { title: 'menu.settings', icon: Settings, order: 12, adminOnly: true, groupKey: 'system' } },
|
||||
{ path: '*', component: NotFound, auth: false, meta: { title: 'menu.notFound', hideInMenu: true } },
|
||||
];
|
||||
|
||||
/** 侧栏菜单：登录后可见的路由，按 order 排序 */
|
||||
export const menuItems: MenuItem[] = routes
|
||||
.filter((route) => route.auth && !route.meta.hideInMenu)
|
||||
.sort((a, b) => (a.meta.order ?? 0) - (b.meta.order ?? 0))
|
||||
.map((route) => ({
|
||||
path: route.path,
|
||||
icon: route.meta.icon,
|
||||
label: route.meta.title,
|
||||
adminOnly: route.meta.adminOnly,
|
||||
}));
|
||||
/**
|
||||
* 侧栏菜单：登录后可见的路由，按 order 排序。
|
||||
*
|
||||
* 分组规则（解决"菜单太多"的观感问题）：
|
||||
* - 带 meta.group 的路由是一个分组的**代表入口**，菜单显示分组的 label/icon
|
||||
* - 带 meta.groupKey 的路由说明它属于某个已有分组 → 不进菜单，只在页内 tab 出现
|
||||
* 这样 13 个路由收敛成 7 个菜单项，且 URL 全部保持不变（书签不会失效）。
|
||||
*/
|
||||
export const menuItems: MenuItem[] = (() => {
|
||||
const grouped = new Set<string>();
|
||||
const items: MenuItem[] = [];
|
||||
|
||||
const sorted = routes
|
||||
.filter((route) => route.auth && !route.meta.hideInMenu)
|
||||
.sort((a, b) => {
|
||||
const orderA = a.meta.group?.order ?? a.meta.order ?? 0;
|
||||
const orderB = b.meta.group?.order ?? b.meta.order ?? 0;
|
||||
return orderA - orderB;
|
||||
});
|
||||
|
||||
for (const route of sorted) {
|
||||
const { group, groupKey } = route.meta;
|
||||
// 属于某个分组的非代表路由：不占菜单位
|
||||
if (groupKey && !group) continue;
|
||||
if (group) {
|
||||
if (grouped.has(group.key)) continue;
|
||||
grouped.add(group.key);
|
||||
items.push({
|
||||
path: route.path,
|
||||
icon: group.icon ?? route.meta.icon,
|
||||
label: group.label,
|
||||
adminOnly: route.meta.adminOnly,
|
||||
groupKey: group.key,
|
||||
});
|
||||
continue;
|
||||
}
|
||||
items.push({
|
||||
path: route.path,
|
||||
icon: route.meta.icon,
|
||||
label: route.meta.title,
|
||||
adminOnly: route.meta.adminOnly,
|
||||
});
|
||||
}
|
||||
return items;
|
||||
})();
|
||||
|
||||
/** 取某个分组下的所有页面（用于页内 tab 切换），按 order 排序 */
|
||||
export function findGroupRoutes(groupKey: string): AppRoute[] {
|
||||
return routes
|
||||
.filter((route) => route.meta.groupKey === groupKey || route.meta.group?.key === groupKey)
|
||||
.sort((a, b) => (a.meta.order ?? 0) - (b.meta.order ?? 0));
|
||||
}
|
||||
|
||||
/** 当前路径所属的分组标识（不在分组内返回 undefined） */
|
||||
export function findGroupKey(pathname: string): string | undefined {
|
||||
const meta = findRouteMeta(pathname);
|
||||
return meta?.group?.key ?? meta?.groupKey;
|
||||
}
|
||||
|
||||
/** 按路径查 meta（通配/未匹配返回 undefined，调用方自行兜底） */
|
||||
export function findRouteMeta(pathname: string): RouteMeta | undefined {
|
||||
|
||||
@@ -14,6 +14,20 @@ export interface RouteMeta {
|
||||
hideInMenu?: boolean;
|
||||
/** 仅管理员可见/可访问（菜单过滤 + 页面内守卫，后端 AdminAuth 兜底） */
|
||||
adminOnly?: boolean;
|
||||
/**
|
||||
* 菜单分组：同组的多个页面在侧边栏只占【一个】入口，
|
||||
* 页面内用顶部 tab 切换（避免 13 个菜单把侧栏塞满）。
|
||||
* 分组信息只写在组内第一个路由上，其余路由用 groupKey 关联。
|
||||
*/
|
||||
group?: {
|
||||
key: string;
|
||||
/** 菜单显示名（i18n key） */
|
||||
label: string;
|
||||
icon?: LucideIcon;
|
||||
order: number;
|
||||
};
|
||||
/** 归属分组标识（与组内第一个路由的 group.key 对应） */
|
||||
groupKey?: string;
|
||||
}
|
||||
|
||||
export interface AppRoute {
|
||||
@@ -31,4 +45,10 @@ export interface MenuItem {
|
||||
label: string;
|
||||
/** 仅管理员可见（Layout 按 getUser().role 过滤） */
|
||||
adminOnly?: boolean;
|
||||
/**
|
||||
* 若该项是分组的代表入口，记录分组标识。
|
||||
* 侧栏高亮据此判断：当前路由属于该分组时整项高亮，
|
||||
* 否则进入 /hosts 后侧栏的「资源接入」不会亮。
|
||||
*/
|
||||
groupKey?: string;
|
||||
}
|
||||
@@ -24,6 +24,10 @@ spec:
|
||||
labels:
|
||||
app: lokistack
|
||||
spec:
|
||||
# 优雅停机：平台收到 SIGTERM 后要先停 HTTP、等告警引擎结束、
|
||||
# 再把 JSON DB 完整落盘。给 30s 窗口，避免 kubelet 直接 SIGKILL
|
||||
# 导致数据文件被截断（JSON 全量写盘，写一半就丢全库）。
|
||||
terminationGracePeriodSeconds: 30
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
@@ -74,20 +78,28 @@ spec:
|
||||
port: http
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /api/v1/health
|
||||
port: http
|
||||
# DB 全量落盘（尤其审计表变大后）可能占用几秒，
|
||||
# liveness 必须留足窗口，否则写盘中被 kubelet 杀掉 = 数据损坏
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 20
|
||||
timeoutSeconds: 10
|
||||
failureThreshold: 5
|
||||
# 资源配置依据（实测）：平台要扛 JSON DB 全量读写、
|
||||
# 每分钟一轮告警评估、以及批量发布时的并发 API。
|
||||
# 原先 1C/1Gi 在批量操作时会顶到 OOM（Loki 侧就因此被 OOMKilled 过）。
|
||||
resources:
|
||||
requests:
|
||||
cpu: 200m
|
||||
memory: 256Mi
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 1Gi
|
||||
cpu: "4"
|
||||
memory: 4Gi
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
|
||||
@@ -0,0 +1,76 @@
|
||||
# lokistack 平台：中断预算 + 备份定时任务
|
||||
#
|
||||
# 为什么单副本还要 PDB：
|
||||
# PDB minAvailable: 0 不保护"不中断"，它的作用是让**节点排空（drain）**时
|
||||
# 集群知道"这个工作负载可以被驱逐，但请一次性驱逐完，别卡住维护流程"，
|
||||
# 并让 `kubectl drain` 正确等待 Pod 重建。没有 PDB 时 drain 会直接删 Pod，
|
||||
# 配合 Recreate 策略可能出现"旧 Pod 已删、新 Pod 还没起"的空窗无人知晓。
|
||||
#
|
||||
# ⚠️ 不要改成 minAvailable: 1 —— replicas 恒为 1，那会让 drain 永远失败。
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: lokistack
|
||||
namespace: log
|
||||
spec:
|
||||
minAvailable: 0
|
||||
selector:
|
||||
matchLabels:
|
||||
app: lokistack
|
||||
---
|
||||
# 每日自动备份（导出 tar.gz 到 PVC 的 backups/ 目录，保留最近 7 份）。
|
||||
#
|
||||
# 为什么要 CronJob 而不是靠平台自己：
|
||||
# 平台进程挂了就没人备份，备份必须由 K8s 托管、独立于应用生命周期。
|
||||
# 备份内容：DB + kubeconfigs/ + known_hosts/，不含明文密钥。
|
||||
# 恢复：kubectl -n log exec deploy/lokistack -- /app/lokistack restore <文件>
|
||||
# 或页面「系统 → 备份与恢复」上传。
|
||||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: lokistack-backup
|
||||
namespace: log
|
||||
spec:
|
||||
schedule: "30 3 * * *" # 每天 03:30
|
||||
concurrencyPolicy: Forbid
|
||||
successfulJobsHistoryLimit: 3
|
||||
failedJobsHistoryLimit: 3
|
||||
jobTemplate:
|
||||
spec:
|
||||
backoffLimit: 2
|
||||
template:
|
||||
spec:
|
||||
restartPolicy: OnFailure
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
containers:
|
||||
- name: backup
|
||||
image: lghost/lokistack:latest
|
||||
imagePullPolicy: Always
|
||||
command: ["/bin/sh", "-c"]
|
||||
args:
|
||||
- |
|
||||
set -e
|
||||
mkdir -p /app/data/backups
|
||||
TS=$(date +%Y%m%d-%H%M%S)
|
||||
OUT=/app/data/backups/lokistack-$TS.tar.gz
|
||||
# 用平台自带命令导出（保证 manifest / 密钥指纹口径一致）
|
||||
/app/lokistack backup --output "$OUT" || {
|
||||
echo "备份失败"; exit 1;
|
||||
}
|
||||
echo "已生成 $OUT ($(du -h "$OUT" | cut -f1))"
|
||||
# 只保留最近 7 份
|
||||
ls -1t /app/data/backups/lokistack-*.tar.gz 2>/dev/null | tail -n +8 | xargs -r rm -f
|
||||
ls -1t /app/data/backups/lokistack-*.tar.gz | head -3
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /app/data
|
||||
resources:
|
||||
requests: {cpu: 50m, memory: 64Mi}
|
||||
limits: {cpu: 500m, memory: 512Mi}
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: lokistack-data
|
||||
@@ -12,4 +12,6 @@ spec:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
# 30Gi：按长期增长预留（审计 90 天 + 部署日志 + 未来可能落更多本地缓存）。
|
||||
# 云盘单价低，宁可留余量也不要日后被迫做在线扩容。
|
||||
storage: 30Gi
|
||||
+4
-2
@@ -7,9 +7,11 @@ events {
|
||||
|
||||
http {
|
||||
# Upstream for lokistack app instances
|
||||
# ⚠️ 只保留一个后端：平台是 JSON 文件 DB（单写者），
|
||||
# 多实例各挂各的数据卷会互相覆盖数据，不是高可用。
|
||||
# 详见 docker-compose.prod.yml 顶部说明。
|
||||
upstream lokistack_backend {
|
||||
server lokistack-1:8080 weight=5;
|
||||
server lokistack-2:8080 weight=5;
|
||||
server lokistack:8080 max_fails=3 fail_timeout=30s;
|
||||
|
||||
# Health check for upstream servers (nginx-plus) or passive checks
|
||||
keepalive 32;
|
||||
|
||||
Executable
+73
@@ -0,0 +1,73 @@
|
||||
#!/usr/bin/env bash
|
||||
# ============================================================
|
||||
# release.sh — 构建 + 推送 + 更新 K8s 清单为不可变 tag
|
||||
# ============================================================
|
||||
# 为什么需要它：
|
||||
# 线上清单一直用 `lghost/lokistack:latest` + imagePullPolicy: Always。
|
||||
# 这个组合的问题是**静默回滚**：任何一次构建（包括别人并行的、或几分钟前
|
||||
# 基于旧代码启动的构建）都会覆盖 latest，节点重启后拉到的可能不是你以为的版本。
|
||||
# 本项目已实际踩过：两个构建并行，后完成但代码更旧的把 latest 覆盖回去，
|
||||
# Pod 跑回旧镜像，刚验过的功能"莫名消失"。
|
||||
#
|
||||
# 做法：
|
||||
# 1) 用 <版本>-<日期>-<短commit> 作为不可变 tag（同 commit 同代码 → 同 tag）
|
||||
# 2) 同时推 latest 供本地/开发使用（不用于生产清单）
|
||||
# 3) 把 kubernetes/deployment.yaml 的 image 改成不可变 tag
|
||||
# 4) 打印三方 digest 供核对（本地镜像 / Hub tag / Pod）
|
||||
#
|
||||
# 用法：
|
||||
# bash scripts/release.sh # 构建 + 推送 + 改清单 + 部署
|
||||
# bash scripts/release.sh --no-deploy # 只构建/推送/改清单，不 apply
|
||||
# ============================================================
|
||||
set -euo pipefail
|
||||
|
||||
cd "$(dirname "$0")/.."
|
||||
|
||||
IMAGE_REPO="${IMAGE_REPO:-lghost/lokistack}"
|
||||
VERSION="${VERSION:-2.0.0}"
|
||||
DEPLOY="${1:-}"
|
||||
|
||||
SHORT_SHA=$(git rev-parse --short=8 HEAD 2>/dev/null || echo "nogit")
|
||||
DIRTY=""
|
||||
if ! git diff --quiet 2>/dev/null; then
|
||||
DIRTY="-dirty"
|
||||
echo "⚠️ 工作区有未提交改动，tag 会带 -dirty 标记（发布前建议先提交）"
|
||||
fi
|
||||
TAG="${VERSION}-$(date +%Y%m%d)-${SHORT_SHA}${DIRTY}"
|
||||
|
||||
echo "=========================================="
|
||||
echo " 构建镜像: ${IMAGE_REPO}:${TAG}"
|
||||
echo "=========================================="
|
||||
docker build -t "${IMAGE_REPO}:${TAG}" -t "${IMAGE_REPO}:latest" .
|
||||
IMAGE_ID=$(docker images --format '{{.ID}}' "${IMAGE_REPO}:${TAG}" | head -1)
|
||||
echo "✅ 构建完成 $IMAGE_ID"
|
||||
|
||||
echo "推送不可变 tag 与 latest..."
|
||||
docker push "${IMAGE_REPO}:${TAG}" | tail -1
|
||||
docker push "${IMAGE_REPO}:latest" | tail -1
|
||||
|
||||
echo "更新 kubernetes/deployment.yaml → ${IMAGE_REPO}:${TAG}"
|
||||
# 只替换 image 行，pullPolicy 改成 IfNotPresent：
|
||||
# 不可变 tag 不需要每次强拉，节点上有缓存就直接用（也避免仓库抖动导致启动失败）
|
||||
sed -i "s|image: ${IMAGE_REPO}:.*|image: ${IMAGE_REPO}:${TAG}|" kubernetes/deployment.yaml
|
||||
sed -i "s|imagePullPolicy: Always|imagePullPolicy: IfNotPresent|" kubernetes/deployment.yaml
|
||||
|
||||
if [ "${DEPLOY}" != "--no-deploy" ]; then
|
||||
export KUBECONFIG="${KUBECONFIG:-/root/.kube/config}"
|
||||
echo "应用清单..."
|
||||
kubectl apply -f kubernetes/deployment.yaml
|
||||
kubectl -n log rollout status deploy/lokistack --timeout=300s
|
||||
POD_DIGEST=$(kubectl -n log get po -l app=lokistack -o jsonpath='{.items[0].status.containerStatuses[0].imageID}' 2>/dev/null | sed 's/.*@//')
|
||||
echo ""
|
||||
echo "=========================================="
|
||||
echo " 部署完成，请核对三方 digest 一致："
|
||||
echo " 清单 tag : ${IMAGE_REPO}:${TAG}"
|
||||
echo " Pod : ${POD_DIGEST:0:19}"
|
||||
echo "=========================================="
|
||||
echo "⚠️ 记得把 deployment.yaml 的变更一并提交，否则下次 apply 会退回旧 tag"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "回滚方法："
|
||||
echo " git log --oneline -- kubernetes/deployment.yaml # 找上一个 tag"
|
||||
echo " git checkout <commit> -- kubernetes/deployment.yaml && kubectl apply -f kubernetes/deployment.yaml"
|
||||
Reference in new issue
Block a user