opsx
b65dcc9677
只改镜像引用（8 处），K8s 资源名一律不动 —— 改了会丢数据/断服务：
改：
kubernetes/deployment.yaml image
docker-compose.yml image
docker-compose.prod.yml image ×2
kubernetes/README.md 文档 ×2
docs/deployment/kubernetes.md 文档 ×2
不改（重要）：
opsxloki-secrets K8s Secret —— 改名会导致 JWT_SECRET/ENCRYPTION_KEY 重置，
历史加密的实例密码无法解密
opsxloki-data PVC —— 改名 = 新建空卷，数据全丢
container_name docker 容器名 —— 改名会让 docker exec/logs 命令失效
app: opsx-loki Pod label —— 改名要同步改 Service selector
deployment 名称 opsx-loki —— 改名要重建 Deployment
⚠️ 部署顺序（本提交只改代码，尚未 apply 到 K8s）：
1) 推镜像 lghost/lokistack:latest 到 Docker Hub
2) kubectl apply -f kubernetes/deployment.yaml
3) 等 Pod 1/1 就绪
4) 才能删除 lghost/opsxloki
顺序颠倒会因 imagePullPolicy: Always 拉到不存在的镜像导致服务中断
98 lines
3.0 KiB
YAML
98 lines
3.0 KiB
YAML
# opsx-loki 平台本体
|
||
#
|
||
# 关键约束：
|
||
# 1) replicas 必须为 1：JSON DB 为单写者，多副本会互相覆盖。
|
||
# 2) strategy 必须为 Recreate：RollingUpdate 期间会同时存在两个 Pod 挂同一个
|
||
# RWO PVC，两个进程同时写 opsxloki.json 会导致数据丢失。
|
||
# 3) /app/data 必须挂 PVC，否则重启后 DB / kubeconfig / known_hosts 全丢。
|
||
apiVersion: apps/v1
|
||
kind: Deployment
|
||
metadata:
|
||
name: opsx-loki
|
||
namespace: log
|
||
labels:
|
||
app: opsx-loki
|
||
spec:
|
||
replicas: 1
|
||
strategy:
|
||
type: Recreate
|
||
selector:
|
||
matchLabels:
|
||
app: opsx-loki
|
||
template:
|
||
metadata:
|
||
labels:
|
||
app: opsx-loki
|
||
spec:
|
||
securityContext:
|
||
runAsUser: 1000
|
||
runAsGroup: 1000
|
||
fsGroup: 1000
|
||
containers:
|
||
- name: opsx-loki
|
||
image: lghost/lokistack:latest
|
||
imagePullPolicy: Always
|
||
ports:
|
||
- name: http
|
||
containerPort: 8080
|
||
env:
|
||
# 可选：指定 admin 初始密码。不设置则自动生成 16 位随机密码，
|
||
# 写入 PVC 的 initial-admin-password.txt 并打印到首次启动日志。
|
||
# 获取：kubectl -n log exec deploy/opsx-loki -- cat /app/data/initial-admin-password.txt
|
||
# 自定义：
|
||
# - name: ADMIN_INIT_PASSWORD
|
||
# valueFrom:
|
||
# secretKeyRef:
|
||
# name: opsxloki-secrets
|
||
# key: ADMIN_INIT_PASSWORD
|
||
# optional: true
|
||
- name: DATA_DIR
|
||
value: /app/data
|
||
- name: JWT_SECRET
|
||
valueFrom:
|
||
secretKeyRef:
|
||
name: opsxloki-secrets
|
||
key: JWT_SECRET
|
||
- name: ENCRYPTION_KEY
|
||
valueFrom:
|
||
secretKeyRef:
|
||
name: opsxloki-secrets
|
||
key: ENCRYPTION_KEY
|
||
# 可选：挂载本地集群 kubeconfig 时启用
|
||
# - name: KUBECONFIG
|
||
# value: /home/opsxloki/.kube/config
|
||
volumeMounts:
|
||
- name: data
|
||
mountPath: /app/data
|
||
# 可选：本地集群 kubeconfig（in-cluster 管理本集群时用）
|
||
# - name: kubeconfig
|
||
# mountPath: /home/opsxloki/.kube
|
||
# readOnly: true
|
||
readinessProbe:
|
||
httpGet:
|
||
path: /api/v1/health
|
||
port: http
|
||
initialDelaySeconds: 5
|
||
periodSeconds: 10
|
||
livenessProbe:
|
||
httpGet:
|
||
path: /api/v1/health
|
||
port: http
|
||
initialDelaySeconds: 30
|
||
periodSeconds: 20
|
||
failureThreshold: 5
|
||
resources:
|
||
requests:
|
||
cpu: 200m
|
||
memory: 256Mi
|
||
limits:
|
||
cpu: "1"
|
||
memory: 1Gi
|
||
volumes:
|
||
- name: data
|
||
persistentVolumeClaim:
|
||
claimName: opsxloki-data
|
||
# - name: kubeconfig
|
||
# secret:
|
||
# secretName: opsxloki-kubeconfig
|