logan
9f7c522157
- kubernetes/: 30Gi PVC、单副本 Recreate、Secret/Service/NodePort/Ingress 清单与部署文档 - 数据安全: kubeconfig/token 统一加密存储，启动迁移历史明文，DB 0600 - Token 接入: 命名空间级最小权限提示、长期 Token、自签证书 TLS 兼容 - 部署: 命名空间级 Token 下跳过 Namespace patch/枚举，节点信息容错 - 日志页: namespace → app → pod 选择顺序与作用域收窄 - 设置页: 拆分为通用/告警/LDAP/镜像源四个 tab - 弹框: 统一 max-h 滚动与长命令换行，修复内容溢出
88 lines
2.5 KiB
YAML
88 lines
2.5 KiB
YAML
# opsx-loki 平台本体
|
||
#
|
||
# 关键约束：
|
||
# 1) replicas 必须为 1：JSON DB 为单写者，多副本会互相覆盖。
|
||
# 2) strategy 必须为 Recreate：RollingUpdate 期间会同时存在两个 Pod 挂同一个
|
||
# RWO PVC，两个进程同时写 opsxloki.json 会导致数据丢失。
|
||
# 3) /app/data 必须挂 PVC，否则重启后 DB / kubeconfig / known_hosts 全丢。
|
||
apiVersion: apps/v1
|
||
kind: Deployment
|
||
metadata:
|
||
name: opsx-loki
|
||
namespace: log
|
||
labels:
|
||
app: opsx-loki
|
||
spec:
|
||
replicas: 1
|
||
strategy:
|
||
type: Recreate
|
||
selector:
|
||
matchLabels:
|
||
app: opsx-loki
|
||
template:
|
||
metadata:
|
||
labels:
|
||
app: opsx-loki
|
||
spec:
|
||
securityContext:
|
||
runAsUser: 1000
|
||
runAsGroup: 1000
|
||
fsGroup: 1000
|
||
containers:
|
||
- name: opsx-loki
|
||
image: lghost/opsxloki:latest
|
||
imagePullPolicy: Always
|
||
ports:
|
||
- name: http
|
||
containerPort: 8080
|
||
env:
|
||
- name: DATA_DIR
|
||
value: /app/data
|
||
- name: JWT_SECRET
|
||
valueFrom:
|
||
secretKeyRef:
|
||
name: opsxloki-secrets
|
||
key: JWT_SECRET
|
||
- name: ENCRYPTION_KEY
|
||
valueFrom:
|
||
secretKeyRef:
|
||
name: opsxloki-secrets
|
||
key: ENCRYPTION_KEY
|
||
# 可选：挂载本地集群 kubeconfig 时启用
|
||
# - name: KUBECONFIG
|
||
# value: /home/opsxloki/.kube/config
|
||
volumeMounts:
|
||
- name: data
|
||
mountPath: /app/data
|
||
# 可选：本地集群 kubeconfig（in-cluster 管理本集群时用）
|
||
# - name: kubeconfig
|
||
# mountPath: /home/opsxloki/.kube
|
||
# readOnly: true
|
||
readinessProbe:
|
||
httpGet:
|
||
path: /api/v1/health
|
||
port: http
|
||
initialDelaySeconds: 5
|
||
periodSeconds: 10
|
||
livenessProbe:
|
||
httpGet:
|
||
path: /api/v1/health
|
||
port: http
|
||
initialDelaySeconds: 30
|
||
periodSeconds: 20
|
||
failureThreshold: 5
|
||
resources:
|
||
requests:
|
||
cpu: 200m
|
||
memory: 256Mi
|
||
limits:
|
||
cpu: "1"
|
||
memory: 1Gi
|
||
volumes:
|
||
- name: data
|
||
persistentVolumeClaim:
|
||
claimName: opsxloki-data
|
||
# - name: kubeconfig
|
||
# secret:
|
||
# secretName: opsxloki-kubeconfig
|