ryan/log-viewer
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update to git

Browse Source
This commit is contained in:
ryan
2026-08-12 15:20:39 +07:00
commit 9709ac7a34
17 changed files with 424 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ANALISA.md
+36
View File
@@ -0,0 +1,36 @@
# Analisa adaptasi log-viewer ke K3s
## Template
Struktur mengikuti `k3s-satusehat`: base Deployment/Service/probes/resources dan overlay Kustomize untuk environment, ingress, certificate, image tag, serta generated environment.
## Koreksi volume log
Source `docker-compose.yml` memakai bind mount host (`/mnt/simrs/logs:/app/logs`). Bind mount tersebut tidak boleh diterjemahkan secara literal menjadi `hostPath` di K3s karena log SIMRS sebenarnya berasal dari storage NFS aplikasi `simrs-v3`.
Deployment SIMRS menggunakan:
```yaml
- name: vol-logs
nfs:
server: nas-rx300.rssa
path: /export/simrs/logs
readOnly: false
```
Karena itu overlay production `log-viewer` memakai sumber NFS yang sama dan mount ke `/app/logs`. Overlay dev tidak menebak export NFS yang belum diketahui; sementara tetap menggunakan bind path dev yang ditemukan pada source aplikasi.
Konsekuensi:
- pod dapat berpindah worker tanpa kehilangan view log;
- tidak membutuhkan `nodeSelector` khusus log;
- tidak membutuhkan directory `/mnt/simrs/logs` pada filesystem worker;
- semua worker yang dapat menjalankan pod harus mempunyai konektivitas dan dukungan NFS ke `nas-rx300.rssa`.
## Replica
Replica tetap satu. Shared NFS menghilangkan masalah node-local storage, tetapi tidak otomatis menjamin aplikasi aman terhadap concurrent mutation file. Scaling baru layak setelah operasi tulis/retention/unblock diuji untuk multi-process concurrency.
## Environment secret
Template sumber menaruh environment melalui ConfigMap. Pola itu dipertahankan agar konsisten, tetapi nilai credential sebaiknya dipisahkan ke Secret karena ConfigMap tidak dirancang sebagai penyimpanan secret.
README.md
+73
View File
@@ -0,0 +1,73 @@
# k3s-log-viewer
Manifest K3s/Kustomize untuk `log-viewer`, mengikuti struktur `k3s-satusehat`.
## Struktur
- `base/`: Deployment, Service, resource patch, dan probes.
- `overlays/dev/`: overlay namespace lama sesuai pola `k3s-satusehat`.
- `overlays/prod/`: overlay production `rssa-apps-prod-new`.
- `fleet.yaml`: konfigurasi Fleet.
- root `kustomization.yaml`: mengarah ke overlay production.
## Source log SIMRS
`log-viewer` membaca log aplikasi SIMRS dari storage yang sama dengan Deployment `simrs-v3`:
- NFS server: `nas-rx300.rssa`
- NFS export: `/export/simrs/logs`
- Mount di container: `/app/logs`
Overlay **production** tidak menggunakan `hostPath`. Dengan NFS, pod production tidak terikat ke worker tertentu selama node K3s dapat resolve dan mengakses server NFS.
Overlay `dev` masih mempertahankan `/mnt/simrs-dev/logs` dari source `docker-compose.yml` karena export NFS SIMRS dev belum diberikan. Jangan anggap export dev sama dengan production tanpa mengecek Deployment SIMRS dev.
```yaml
volumes:
- name: simrs-logs
nfs:
server: nas-rx300.rssa
path: /export/simrs/logs
readOnly: false
```
## Image
Base image:
`git.rssa.top/meninjar/log-viewer:latest`
Overlay production saat paket ini dibuat menggunakan:
`git.rssa.top/meninjar/log-viewer:20260811055659-main`
## Port
Aplikasi listen pada TCP `5880`. Service dan probes menggunakan port yang sama.
## Replica
Replica tetap `1`. Walaupun NFS bersifat shared, source aplikasi mempunyai operasi terhadap file log sehingga multi-replica/HPA perlu diuji terhadap concurrency sebelum diaktifkan.
## Deploy / validate
Jika `kubectl` memiliki Kustomize builtin:
```bash
kubectl kustomize overlays/prod
kubectl apply -k overlays/prod
```
Cek hasil:
```bash
kubectl get pod -n rssa-apps-prod-new -l app=log-viewer -o wide
kubectl describe pod -n rssa-apps-prod-new -l app=log-viewer
kubectl logs -n rssa-apps-prod-new -l app=log-viewer --tail=100
```
Untuk memastikan NFS dapat diakses dari node tempat pod dijadwalkan, cek event pod. Error seperti `mount.nfs`, `access denied`, `no route to host`, atau DNS failure menunjukkan masalah konektivitas/client NFS di node, bukan aplikasi `log-viewer`.
## Catatan environment
Pola template `k3s-satusehat` menggunakan `configMapGenerator` untuk file environment dan pola tersebut dipertahankan. Secara security, credential seperti `KEYCLOAK_CLIENT_SECRET` lebih tepat dipindahkan ke Kubernetes Secret/secret manager pada iterasi berikutnya.
base/kustomization.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- log-viewer-deployment.yaml
- log-viewer-service.yaml
patches:
- path: log-viewer-resources.yaml
- path: log-viewer-probes.yaml
commonLabels:
app.kubernetes.io/part-of: log-viewer
base/log-viewer-deployment.yaml
+48
View File
@@ -0,0 +1,48 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: log-viewer
labels:
app: log-viewer
app.kubernetes.io/name: log-viewer
app.kubernetes.io/component: web
app.kubernetes.io/part-of: log-viewer
spec:
replicas: 1
selector:
matchLabels:
app: log-viewer
template:
metadata:
labels:
app: log-viewer
app.kubernetes.io/name: log-viewer
app.kubernetes.io/component: web
app.kubernetes.io/part-of: log-viewer
spec:
containers:
- name: log-viewer
image: git.rssa.top/meninjar/log-viewer:20260812080525-main
imagePullPolicy: Always
workingDir: /app
ports:
- name: http
containerPort: 5880
envFrom:
- configMapRef:
name: log-viewer-env
volumeMounts:
- name: simrs-logs
mountPath: /app/logs
- name: app-tmp
mountPath: /tmp
securityContext:
allowPrivilegeEscalation: false
volumes:
- name: simrs-logs
nfs:
server: nas-rx300.rssa
path: /export/simrs/logs
readOnly: false
- name: app-tmp
emptyDir: {}
base/log-viewer-probes.yaml
+33
View File
@@ -0,0 +1,33 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: log-viewer
spec:
template:
spec:
containers:
- name: log-viewer
startupProbe:
tcpSocket:
port: 5880
initialDelaySeconds: 5
periodSeconds: 10
timeoutSeconds: 2
failureThreshold: 18
successThreshold: 1
readinessProbe:
tcpSocket:
port: 5880
initialDelaySeconds: 15
periodSeconds: 20
timeoutSeconds: 10
failureThreshold: 6
successThreshold: 1
livenessProbe:
tcpSocket:
port: 5880
initialDelaySeconds: 20
periodSeconds: 30
timeoutSeconds: 10
failureThreshold: 6
successThreshold: 1
base/log-viewer-resources.yaml
+16
View File
@@ -0,0 +1,16 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: log-viewer
spec:
template:
spec:
containers:
- name: log-viewer
resources:
requests:
cpu: 1000m
memory: 2Gi
limits:
cpu: 4000m
memory: 8Gi
base/log-viewer-service.yaml
+16
View File
@@ -0,0 +1,16 @@
apiVersion: v1
kind: Service
metadata:
name: log-viewer
labels:
app: log-viewer
app.kubernetes.io/name: log-viewer
app.kubernetes.io/component: web
app.kubernetes.io/part-of: log-viewer
spec:
selector:
app: log-viewer
ports:
- name: http
port: 80
targetPort: 5880
fleet.yaml
+2
View File
@@ -0,0 +1,2 @@
kustomize:
dir: ""
kustomization.yaml
+5
View File
@@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- overlays/prod
overlays/dev/.env.log-viewer.prod
+10
View File
@@ -0,0 +1,10 @@
NODE_ENV=production
PORT=5880
NODE_OPTIONS="--max-old-space-size=8192"
LOGS_DIR=/app/logs
KEYCLOAK_URL=https://auth.rssa.top/
KEYCLOAK_REALM=rssa
KEYCLOAK_CLIENT_ID=satu
KEYCLOAK_CLIENT_SECRET=ZhkK45MHB0a0eAZX5ecNTnlfnWlZXfBE
SIMRS_URL=http://meninjar.dev.rssa.id:4003
KEYCLOAK_REDIRECT_URI=
overlays/dev/certificate.yaml
+12
View File
@@ -0,0 +1,12 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: log-viewer-rssa-id
spec:
secretName: log-viewer-rssa-id-tls
issuerRef:
name: letsencrypt-production
kind: ClusterIssuer
commonName: "log-viewer.rssa.id"
dnsNames:
- "log-viewer.rssa.id"
overlays/dev/ingress-route.yaml
+35
View File
@@ -0,0 +1,35 @@
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: log-viewer-local
annotations:
kubernetes.io/ingress.class: traefik-internal
spec:
entryPoints:
- web
routes:
- kind: Rule
match: Host(`log-viewer.rssa.id`)
services:
- name: log-viewer-prod
port: 80
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: log-viewer
annotations:
kubernetes.io/ingress.class: traefik-external
spec:
entryPoints:
- websecure
routes:
- kind: Rule
match: Host(`log-viewer.rssa.id`)
middlewares:
- name: default-headers
services:
- name: log-viewer-prod
port: 80
tls:
secretName: log-viewer-rssa-id-tls
overlays/dev/kustomization.yaml
+42
View File
@@ -0,0 +1,42 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../../base
- ingress-route.yaml
- certificate.yaml
namespace: rssa-apps-prod
nameSuffix: -prod
commonLabels:
environment: prod
app.kubernetes.io/managed-by: kustomize
app.kubernetes.io/part-of: log-viewer
images:
- name: git.rssa.top/meninjar/log-viewer
newTag: latest
patches:
- target:
group: apps
version: v1
kind: Deployment
name: log-viewer
patch: |-
- op: replace
path: /spec/template/spec/volumes/0
value:
name: simrs-logs
hostPath:
path: /mnt/simrs-dev/logs
type: Directory
configMapGenerator:
- name: log-viewer-env
envs:
- .env.log-viewer.prod
generatorOptions:
disableNameSuffixHash: true
overlays/prod/.env.log-viewer.prod
+10
View File
@@ -0,0 +1,10 @@
NODE_ENV=production
PORT=5880
NODE_OPTIONS="--max-old-space-size=8192"
LOGS_DIR=/app/logs
KEYCLOAK_URL=https://auth.rssa.top/
KEYCLOAK_REALM=rssa
KEYCLOAK_CLIENT_ID=satu
KEYCLOAK_CLIENT_SECRET=ZhkK45MHB0a0eAZX5ecNTnlfnWlZXfBE
SIMRS_URL=http://sim.rssa.id
KEYCLOAK_REDIRECT_URI=
overlays/prod/certificate.yaml
+12
View File
@@ -0,0 +1,12 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: log-viewer-rssa-id
spec:
secretName: log-viewer-rssa-id-tls
issuerRef:
name: letsencrypt-production
kind: ClusterIssuer
commonName: "log-viewer.rssa.id"
dnsNames:
- "log-viewer.rssa.id"
overlays/prod/ingress-route.yaml
+35
View File
@@ -0,0 +1,35 @@
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: log-viewer-local
annotations:
kubernetes.io/ingress.class: traefik-internal
spec:
entryPoints:
- web
routes:
- kind: Rule
match: Host(`log-viewer.rssa.id`)
services:
- name: log-viewer-prod
port: 80
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: log-viewer
annotations:
kubernetes.io/ingress.class: traefik-external
spec:
entryPoints:
- websecure
routes:
- kind: Rule
match: Host(`log-viewer.rssa.id`)
middlewares:
- name: default-headers
services:
- name: log-viewer-prod
port: 80
tls:
secretName: log-viewer-rssa-id-tls
overlays/prod/kustomization.yaml
+26
View File
@@ -0,0 +1,26 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../../base
- ingress-route.yaml
- certificate.yaml
namespace: rssa-apps-prod-new
nameSuffix: -prod
commonLabels:
environment: prod
app.kubernetes.io/managed-by: kustomize
app.kubernetes.io/part-of: log-viewer
images:
- name: git.rssa.top/meninjar/log-viewer
newTag: 20260812080525-main
configMapGenerator:
- name: log-viewer-env
envs:
- .env.log-viewer.prod
generatorOptions:
disableNameSuffixHash: true