chore: 统一本地服务器与远程仓库源码

- 合并 main 与 master 历史并以服务器结构为基线 - 保留迁移、数据保留、AWS 账单与部署安全能力 - 建立 SDD 规格和 CI 验证闭环
2026-08-05 20:03:25 +08:00
commit fd60361d93
@@ -11,11 +11,11 @@ AIOps 平台在 Kubernetes 上的部署清单（Go/Gin 后端 + go:embed 前端
 | 文件 | 说明 |
 |------|------|
 | `namespace.yaml` | `devops` 命名空间 |
-| `secret.yaml` | MySQL/JWT 密码（Secret） |
+| `secret.yaml` | MySQL/JWT Secret 模板（部署前必须注入随机值） |
 | `configmap.yaml` | 后端 `config.yaml`（ConfigMap） |
-| `mysql.yaml` | MySQL 8.0 StatefulSet + Headless Service + 10Gi 持久卷 |
-| `redis.yaml` | Redis 7 StatefulSet + Headless Service + 2Gi 持久卷 |
-| `deployment.yaml` | AIOps Deployment（embed 单端口 8080）+ NodePort Service (30080) |
+| `mysql.yaml` | MySQL 8.0 Deployment + Service + 10Gi 持久卷 |
+| `redis.yaml` | Redis 7 Deployment + Service + 2Gi 持久卷 |
+| `deployment.yaml` | AIOps Deployment、NodePort Service (30080) 和 MySQL/Redis NetworkPolicy |
 | `pvc-aiops-data.yaml` | local 模式 PVC：`sqlite3.db` / `redka.db` 与 `/app/aiops` 同级 |
 | `ingress.yaml` | Ingress：所有流量 → aiops:8080（含 WebSocket 支持） |

@@ -35,7 +35,7 @@ AIOps 平台在 Kubernetes 上的部署清单（Go/Gin 后端 + go:embed 前端
                 ┌──────────────┼──────────────┐
                 ▼                             ▼
           MySQL 8.0                    Redis 7
-         (StatefulSet)               (StatefulSet)
+         (Deployment)                (Deployment)
         mysql:3306                  redis:6379
         10Gi PV                     2Gi PV
 ```
@@ -72,14 +72,16 @@ AIOps 平台在 Kubernetes 上的部署清单（Go/Gin 后端 + go:embed 前端
 cd deploy/kubernetes

 kubectl apply -f namespace.yaml
+# 先生成随机密钥并替换 secret.yaml 的 REPLACE_WITH_* 占位符，勿提交真实值。 // Logan.Li
+# openssl rand -hex 32
 kubectl apply -f secret.yaml
 kubectl apply -f configmap.yaml
 kubectl apply -f pvc-aiops-data.yaml
 kubectl apply -f mysql.yaml
 kubectl apply -f redis.yaml

-kubectl -n devops rollout status statefulset/mysql
-kubectl -n devops rollout status statefulset/redis
+kubectl -n devops rollout status deployment/mysql
+kubectl -n devops rollout status deployment/redis

 # 构建镜像（Mac/Linux 均可，按 TARGETARCH 自动选架构）
 cd ../..
@@ -114,8 +116,9 @@ kubectl -n devops logs -f deployment/aiops
 # 进入应用容器
 kubectl -n devops exec -it deployment/aiops -- bash

-# 进入 MySQL
-kubectl -n devops exec -it mysql-0 -- mysql -uaiops -paiops_pass_2026 aiops
+# 进入 MySQL（密码从本地 Secret 读取，避免出现在 shell 历史中）
+MYSQL_PASSWORD="$(kubectl -n devops get secret aiops-secret -o jsonpath='{.data.mysql-password}' | base64 -d)"
+kubectl -n devops exec -it deployment/mysql -- mysql -uaiops -p"$MYSQL_PASSWORD" aiops

 # 滚动更新（换镜像 tag 后）
 kubectl -n devops set image deployment/aiops aiops=lghost/aiops:v1.5.0 --record
@@ -140,12 +143,19 @@ kubectl -n devops get pvc

 | 项目 | 来源 | 值 |
 |------|------|----|
-| MySQL 业务账号 | Secret `aiops-secret` | 用户 `aiops` / 密码 `aiops_pass_2026` / 库 `aiops` |
-| MySQL root | Secret `aiops-secret` | `aiops_root_2026` |
-| JWT | Secret `aiops-secret` | `aiops-jwt-secret-key-2026` |
+| MySQL 业务账号 | Secret `aiops-secret` | 用户 `aiops` / `mysql-password` 键 / 库 `aiops` |
+| MySQL root | Secret `aiops-secret` | `mysql-root-password` 键 |
+| JWT | Secret `aiops-secret` | `jwt-secret` 键 |
 | Redis | 无密码 | db `0` |

-> ⚠️ 生产环境请修改 `secret.yaml` 和 `configmap.yaml` 中的默认密码。
+> ⚠️ `secret.yaml` 只包含不可用的占位符。部署前须通过受控 Secret 管理系统或本地安全通道填充随机值；ConfigMap 不得保存密码和 JWT。
+
+## 安全基线
+
+- 应用容器以 UID/GID `10001` 运行，移除了 `hostNetwork` 和 Docker Socket 挂载。
+- SQLite/redka 与 uploads 分别通过 PVC 持久化；不要以 `emptyDir` 替代 uploads PVC。
+- `deployment.yaml` 中的 NetworkPolicy 保护 MySQL/Redis 的集群内入口。应用同时接收集群外 Agent 上报，待明确 Ingress 与 Agent 出口 CIDR 后，再增加应用 Pod 的严格入站策略。
+- 使用 Ingress 时应创建 TLS Secret 并配置 HTTPS；NodePort 仅适合受防火墙保护的内网运维入口。

 ## 资源限额

@@ -1,4 +1,4 @@
-# config.yaml — 由 ConfigMap 挂载到 /app/config.yaml
+# config.yaml — 由 ConfigMap 挂载到 /app/config.yaml；不得放入任何 Secret。 // Logan.Li
 # 注意：环境变量优先级高于此文件 (viper AutomaticEnv)
 # 默认 MODE=local（Deployment env）→ SQLite + redka，无需外部 MySQL/Redis
 # 集群模式：Deployment 设 MODE=release 并配置 DATABASE_/REDIS_ 环境变量
@@ -25,7 +25,3 @@ data:
      port: 6379
      password: ""
      db: 0
-
-    jwt:
-      secret: "aiops-jwt-secret-key-2026"
-      expire_hour: 24
@@ -34,13 +34,27 @@ spec:
        app.kubernetes.io/name: aiops
        app.kubernetes.io/component: app
    spec:
-      hostNetwork: true
-      dnsPolicy: ClusterFirstWithHostNet
+      # 不使用 hostNetwork，避免 Pod 直接共享节点网络命名空间。 // Logan.Li
+      dnsPolicy: ClusterFirst
      enableServiceLinks: false
+      automountServiceAccountToken: false
+      securityContext:
+        fsGroup: 10001
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
      # 首次部署时在 PVC 中预创建库文件，避免 subPath 挂载成目录 // Logan.Li
      initContainers:
        - name: init-local-db
          image: busybox:1.36
+          securityContext:
+            runAsUser: 0
+            runAsGroup: 0
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            seccompProfile:
+              type: RuntimeDefault
          command:
            - sh
            - -c
@@ -51,8 +65,9 @@ spec:
              if [ -f /vol/data/redka/redka.db ] && [ ! -f /vol/redka.db ]; then
                cp /vol/data/redka/redka.db /vol/redka.db
              fi
-              [ -f /vol/sqlite3.db ] || install -m 644 /dev/null /vol/sqlite3.db
-              [ -f /vol/redka.db ] || install -m 644 /dev/null /vol/redka.db
+              [ -f /vol/sqlite3.db ] || install -m 660 /dev/null /vol/sqlite3.db
+              [ -f /vol/redka.db ] || install -m 660 /dev/null /vol/redka.db
+              chown 10001:10001 /vol/sqlite3.db /vol/redka.db
          volumeMounts:
            - name: data
              mountPath: /vol
@@ -72,22 +87,28 @@ spec:
            - name: MODE
              value: local
            - name: JWT_SECRET
-              value: "aiops-jwt-secret-key-2026"
-            # --- 集群模式（mode=release）时启用 ---
+              valueFrom:
+                secretKeyRef:
+                  name: aiops-secret
+                  key: jwt-secret
+            # --- 集群模式（mode=release）时通过 Secret 引用数据库凭据。 // Logan.Li
            # - name: DATABASE_DRIVER
            #   value: "mysql"
            # - name: DATABASE_HOST
-            #   value: "10.10.10.75"
+            #   value: "mysql"
            # - name: DATABASE_USER
-            #   value: "root"
+            #   value: "aiops"
            # - name: DATABASE_PASSWORD
-            #   value: "aiops_root_2026"
+            #   valueFrom:
+            #     secretKeyRef:
+            #       name: aiops-secret
+            #       key: mysql-password
            # - name: DATABASE_DBNAME
            #   value: "aiops"
            # - name: REDIS_DRIVER
            #   value: "redis"
            # - name: REDIS_HOST
-            #   value: "10.10.10.75"
+            #   value: "redis"

          volumeMounts:
            - name: config
@@ -104,6 +125,16 @@ spec:
              mountPath: /app/redka.db
              subPath: redka.db

+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 10001
+            runAsGroup: 10001
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            seccompProfile:
+              type: RuntimeDefault
+
          readinessProbe:
            httpGet:
              path: /version
@@ -130,7 +161,8 @@ spec:
          configMap:
            name: aiops-config
        - name: uploads
-          emptyDir: {}
+          persistentVolumeClaim:
+            claimName: aiops-uploads
        - name: data
          persistentVolumeClaim:
            claimName: aiops-data
@@ -153,3 +185,46 @@ spec:
      targetPort: 8080
      nodePort: 30080
      protocol: TCP
+---
+# 限制集群内 MySQL/Redis 仅接受 AIOps Pod 连接。 // Logan.Li
+# AIOps 需要接收集群外 Agent 的上报；在确定 Ingress 与 Agent 出口 CIDR 前，
+# 不对应用 Pod 启用默认拒绝策略，以免阻断运维采集链路。 // Logan.Li
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: mysql-ingress-from-aiops-only
+  namespace: devops
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: mysql
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: aiops
+      ports:
+        - protocol: TCP
+          port: 3306
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: redis-ingress-from-aiops-only
+  namespace: devops
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: redis
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: aiops
+      ports:
+        - protocol: TCP
+          port: 6379
@@ -15,6 +15,11 @@ spec:
      labels:
        app.kubernetes.io/name: mysql
    spec:
+      securityContext:
+        fsGroup: 999
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
      containers:
        - name: mysql
          image: mysql:8.0
@@ -23,9 +28,19 @@ spec:
            - containerPort: 3306
          env:
            - name: MYSQL_ROOT_PASSWORD
-              value: "aiops_root_2026"
+              valueFrom:
+                secretKeyRef:
+                  name: aiops-secret
+                  key: mysql-root-password
            - name: MYSQL_DATABASE
              value: aiops
+            - name: MYSQL_USER
+              value: aiops
+            - name: MYSQL_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: aiops-secret
+                  key: mysql-password
            - name: TZ
              value: Asia/Shanghai
          args:
@@ -35,15 +50,47 @@ spec:
          volumeMounts:
            - name: mysql-data
              mountPath: /var/lib/mysql
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 999
+            runAsGroup: 999
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            seccompProfile:
+              type: RuntimeDefault
          readinessProbe:
            exec:
-              command: ["sh", "-c", "mysqladmin ping -h 127.0.0.1 -uroot -paiops_root_2026"]
+              command: ["sh", "-c", "mysqladmin ping -h 127.0.0.1 -uroot -p\"$MYSQL_ROOT_PASSWORD\""]
            initialDelaySeconds: 20
            periodSeconds: 10
            timeoutSeconds: 5
+          resources:
+            requests:
+              cpu: 250m
+              memory: 512Mi
+            limits:
+              cpu: "1"
+              memory: 2Gi
      volumes:
        - name: mysql-data
-          emptyDir: {}
+          persistentVolumeClaim:
+            claimName: mysql-data
+---
+# MySQL 数据必须独立持久化，供备份与恢复演练使用。 // Logan.Li
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: mysql-data
+  namespace: devops
+  labels:
+    app.kubernetes.io/name: mysql
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
 ---
 apiVersion: v1
 kind: Service
@@ -13,4 +13,20 @@ spec:
    - ReadWriteOnce
  resources:
    requests:
-      storage: 10Gi
+      storage: 10Gi
+---
+# uploads 不能使用 emptyDir，否则 Pod 重建会丢失上传的制品和附件。 // Logan.Li
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: aiops-uploads
+  namespace: devops
+  labels:
+    app.kubernetes.io/name: aiops
+    app.kubernetes.io/component: uploads
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 20Gi
@@ -1,6 +1,6 @@
 # quick-deploy.yaml — AIOps 单容器快速部署
 # 部署: kubectl apply -f quick-deploy.yaml
-# 此文件自包含 (ConfigMap + Deployment + Service), 不依赖其他 YAML
+# 此文件为开发演示模板；生产请使用 deployment.yaml + Secret + PVC + NetworkPolicy。 // Logan.Li
 #
 # 两种模式:
 #   远程模式 (默认): MODE=release, 连接外部 MySQL + Redis
@@ -24,9 +24,16 @@ data:
    redis:
      driver: redka

-    jwt:
-      secret: "aiops-jwt-secret-key-2026"
-      expire_hour: 24
+---
+# 仅为模板占位符，部署前必须替换为随机值，禁止提交真实生产密钥。 // Logan.Li
+apiVersion: v1
+kind: Secret
+metadata:
+  name: aiops-secret
+  namespace: devops
+type: Opaque
+stringData:
+  jwt-secret: "REPLACE_WITH_RANDOM_JWT_SECRET_AT_LEAST_32_BYTES"
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -53,11 +60,25 @@ spec:
        app.kubernetes.io/name: aiops
        app.kubernetes.io/component: app
    spec:
-      hostNetwork: true
-      dnsPolicy: ClusterFirstWithHostNet
+      dnsPolicy: ClusterFirst
+      enableServiceLinks: false
+      automountServiceAccountToken: false
+      securityContext:
+        fsGroup: 10001
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
      initContainers:
        - name: init-local-db
          image: busybox:1.36
+          securityContext:
+            runAsUser: 0
+            runAsGroup: 0
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            seccompProfile:
+              type: RuntimeDefault
          command:
            - sh
            - -c
@@ -68,8 +89,9 @@ spec:
              if [ -f /vol/data/redka/redka.db ] && [ ! -f /vol/redka.db ]; then
                cp /vol/data/redka/redka.db /vol/redka.db
              fi
-              [ -f /vol/sqlite3.db ] || install -m 644 /dev/null /vol/sqlite3.db
-              [ -f /vol/redka.db ] || install -m 644 /dev/null /vol/redka.db
+              [ -f /vol/sqlite3.db ] || install -m 660 /dev/null /vol/sqlite3.db
+              [ -f /vol/redka.db ] || install -m 660 /dev/null /vol/redka.db
+              chown 10001:10001 /vol/sqlite3.db /vol/redka.db
          volumeMounts:
            - name: data
              mountPath: /vol
@@ -86,7 +108,10 @@ spec:
            - name: TZ
              value: Asia/Shanghai
            - name: JWT_SECRET
-              value: "aiops-jwt-secret-key-2026"
+              valueFrom:
+                secretKeyRef:
+                  name: aiops-secret
+                  key: jwt-secret
            # 集群模式 (MODE=release) 时取消注释:
            # - name: DATABASE_DRIVER
            #   value: mysql
@@ -107,6 +132,17 @@ spec:
            - name: data
              mountPath: /app/redka.db
              subPath: redka.db
+            - name: uploads
+              mountPath: /app/uploads
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 10001
+            runAsGroup: 10001
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            seccompProfile:
+              type: RuntimeDefault
          resources:
            requests:
              cpu: 100m
@@ -121,6 +157,9 @@ spec:
        - name: data
          persistentVolumeClaim:
            claimName: aiops-data
+        - name: uploads
+          persistentVolumeClaim:
+            claimName: aiops-uploads
 ---
 apiVersion: v1
 kind: Service
@@ -15,17 +15,61 @@ spec:
      labels:
        app.kubernetes.io/name: redis
    spec:
+      securityContext:
+        fsGroup: 999
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
      containers:
        - name: redis
          image: redis:7-alpine
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 6379
+          command: ["redis-server", "--appendonly", "yes"]
+          volumeMounts:
+            - name: redis-data
+              mountPath: /data
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 999
+            runAsGroup: 999
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            seccompProfile:
+              type: RuntimeDefault
          readinessProbe:
            exec:
              command: ["redis-cli", "ping"]
            initialDelaySeconds: 5
            periodSeconds: 5
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+            limits:
+              cpu: 250m
+              memory: 256Mi
+      volumes:
+        - name: redis-data
+          persistentVolumeClaim:
+            claimName: redis-data
+---
+# Redis AOF 数据持久化，避免 Pod 重建时丢失分布式锁和缓存状态。 // Logan.Li
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: redis-data
+  namespace: devops
+  labels:
+    app.kubernetes.io/name: redis
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi
 ---
 apiVersion: v1
 kind: Service
@@ -5,6 +5,7 @@ metadata:
  namespace: devops
 type: Opaque
 stringData:
-  mysql-root-password: "aiops_root_2026"
-  mysql-password: "aiops_pass_2026"
-  jwt-secret: "aiops-jwt-secret-key-2026"
+  # 仅为模板占位符，部署前必须替换为随机值，禁止提交真实生产密钥。 // Logan.Li
+  mysql-root-password: "REPLACE_WITH_RANDOM_MYSQL_ROOT_PASSWORD"
+  mysql-password: "REPLACE_WITH_RANDOM_MYSQL_APPLICATION_PASSWORD"
+  jwt-secret: "REPLACE_WITH_RANDOM_JWT_SECRET_AT_LEAST_32_BYTES"