From 9709ac7a3410c78504715eae54db88089e17e910 Mon Sep 17 00:00:00 2001 From: ryan Date: Wed, 12 Aug 2026 15:20:39 +0700 Subject: [PATCH] update to git --- ANALISA.md | 36 +++++++++++++++ README.md | 73 ++++++++++++++++++++++++++++++ base/kustomization.yaml | 13 ++++++ base/log-viewer-deployment.yaml | 48 ++++++++++++++++++++ base/log-viewer-probes.yaml | 33 ++++++++++++++ base/log-viewer-resources.yaml | 16 +++++++ base/log-viewer-service.yaml | 16 +++++++ fleet.yaml | 2 + kustomization.yaml | 5 ++ overlays/dev/.env.log-viewer.prod | 10 ++++ overlays/dev/certificate.yaml | 12 +++++ overlays/dev/ingress-route.yaml | 35 ++++++++++++++ overlays/dev/kustomization.yaml | 42 +++++++++++++++++ overlays/prod/.env.log-viewer.prod | 10 ++++ overlays/prod/certificate.yaml | 12 +++++ overlays/prod/ingress-route.yaml | 35 ++++++++++++++ overlays/prod/kustomization.yaml | 26 +++++++++++ 17 files changed, 424 insertions(+) create mode 100644 ANALISA.md create mode 100644 README.md create mode 100644 base/kustomization.yaml create mode 100644 base/log-viewer-deployment.yaml create mode 100644 base/log-viewer-probes.yaml create mode 100644 base/log-viewer-resources.yaml create mode 100644 base/log-viewer-service.yaml create mode 100644 fleet.yaml create mode 100644 kustomization.yaml create mode 100644 overlays/dev/.env.log-viewer.prod create mode 100644 overlays/dev/certificate.yaml create mode 100644 overlays/dev/ingress-route.yaml create mode 100644 overlays/dev/kustomization.yaml create mode 100644 overlays/prod/.env.log-viewer.prod create mode 100644 overlays/prod/certificate.yaml create mode 100644 overlays/prod/ingress-route.yaml create mode 100644 overlays/prod/kustomization.yaml diff --git a/ANALISA.md b/ANALISA.md new file mode 100644 index 0000000..3c9afd9 --- /dev/null +++ b/ANALISA.md @@ -0,0 +1,36 @@ +# Analisa adaptasi log-viewer ke K3s + +## Template + +Struktur mengikuti `k3s-satusehat`: base Deployment/Service/probes/resources dan overlay Kustomize untuk environment, ingress, certificate, image tag, serta generated environment. + +## Koreksi volume log + +Source `docker-compose.yml` memakai bind mount host (`/mnt/simrs/logs:/app/logs`). Bind mount tersebut tidak boleh diterjemahkan secara literal menjadi `hostPath` di K3s karena log SIMRS sebenarnya berasal dari storage NFS aplikasi `simrs-v3`. + +Deployment SIMRS menggunakan: + +```yaml +- name: vol-logs + nfs: + server: nas-rx300.rssa + path: /export/simrs/logs + readOnly: false +``` + +Karena itu overlay production `log-viewer` memakai sumber NFS yang sama dan mount ke `/app/logs`. Overlay dev tidak menebak export NFS yang belum diketahui; sementara tetap menggunakan bind path dev yang ditemukan pada source aplikasi. + +Konsekuensi: + +- pod dapat berpindah worker tanpa kehilangan view log; +- tidak membutuhkan `nodeSelector` khusus log; +- tidak membutuhkan directory `/mnt/simrs/logs` pada filesystem worker; +- semua worker yang dapat menjalankan pod harus mempunyai konektivitas dan dukungan NFS ke `nas-rx300.rssa`. + +## Replica + +Replica tetap satu. Shared NFS menghilangkan masalah node-local storage, tetapi tidak otomatis menjamin aplikasi aman terhadap concurrent mutation file. Scaling baru layak setelah operasi tulis/retention/unblock diuji untuk multi-process concurrency. + +## Environment secret + +Template sumber menaruh environment melalui ConfigMap. Pola itu dipertahankan agar konsisten, tetapi nilai credential sebaiknya dipisahkan ke Secret karena ConfigMap tidak dirancang sebagai penyimpanan secret. diff --git a/README.md b/README.md new file mode 100644 index 0000000..dcfbfb9 --- /dev/null +++ b/README.md @@ -0,0 +1,73 @@ +# k3s-log-viewer + +Manifest K3s/Kustomize untuk `log-viewer`, mengikuti struktur `k3s-satusehat`. + +## Struktur + +- `base/`: Deployment, Service, resource patch, dan probes. +- `overlays/dev/`: overlay namespace lama sesuai pola `k3s-satusehat`. +- `overlays/prod/`: overlay production `rssa-apps-prod-new`. +- `fleet.yaml`: konfigurasi Fleet. +- root `kustomization.yaml`: mengarah ke overlay production. + +## Source log SIMRS + +`log-viewer` membaca log aplikasi SIMRS dari storage yang sama dengan Deployment `simrs-v3`: + +- NFS server: `nas-rx300.rssa` +- NFS export: `/export/simrs/logs` +- Mount di container: `/app/logs` + +Overlay **production** tidak menggunakan `hostPath`. Dengan NFS, pod production tidak terikat ke worker tertentu selama node K3s dapat resolve dan mengakses server NFS. + +Overlay `dev` masih mempertahankan `/mnt/simrs-dev/logs` dari source `docker-compose.yml` karena export NFS SIMRS dev belum diberikan. Jangan anggap export dev sama dengan production tanpa mengecek Deployment SIMRS dev. + +```yaml +volumes: +- name: simrs-logs + nfs: + server: nas-rx300.rssa + path: /export/simrs/logs + readOnly: false +``` + +## Image + +Base image: + +`git.rssa.top/meninjar/log-viewer:latest` + +Overlay production saat paket ini dibuat menggunakan: + +`git.rssa.top/meninjar/log-viewer:20260811055659-main` + +## Port + +Aplikasi listen pada TCP `5880`. Service dan probes menggunakan port yang sama. + +## Replica + +Replica tetap `1`. Walaupun NFS bersifat shared, source aplikasi mempunyai operasi terhadap file log sehingga multi-replica/HPA perlu diuji terhadap concurrency sebelum diaktifkan. + +## Deploy / validate + +Jika `kubectl` memiliki Kustomize builtin: + +```bash +kubectl kustomize overlays/prod +kubectl apply -k overlays/prod +``` + +Cek hasil: + +```bash +kubectl get pod -n rssa-apps-prod-new -l app=log-viewer -o wide +kubectl describe pod -n rssa-apps-prod-new -l app=log-viewer +kubectl logs -n rssa-apps-prod-new -l app=log-viewer --tail=100 +``` + +Untuk memastikan NFS dapat diakses dari node tempat pod dijadwalkan, cek event pod. Error seperti `mount.nfs`, `access denied`, `no route to host`, atau DNS failure menunjukkan masalah konektivitas/client NFS di node, bukan aplikasi `log-viewer`. + +## Catatan environment + +Pola template `k3s-satusehat` menggunakan `configMapGenerator` untuk file environment dan pola tersebut dipertahankan. Secara security, credential seperti `KEYCLOAK_CLIENT_SECRET` lebih tepat dipindahkan ke Kubernetes Secret/secret manager pada iterasi berikutnya. diff --git a/base/kustomization.yaml b/base/kustomization.yaml new file mode 100644 index 0000000..9c489ad --- /dev/null +++ b/base/kustomization.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: +- log-viewer-deployment.yaml +- log-viewer-service.yaml + +patches: +- path: log-viewer-resources.yaml +- path: log-viewer-probes.yaml + +commonLabels: + app.kubernetes.io/part-of: log-viewer diff --git a/base/log-viewer-deployment.yaml b/base/log-viewer-deployment.yaml new file mode 100644 index 0000000..4559d96 --- /dev/null +++ b/base/log-viewer-deployment.yaml @@ -0,0 +1,48 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: log-viewer + labels: + app: log-viewer + app.kubernetes.io/name: log-viewer + app.kubernetes.io/component: web + app.kubernetes.io/part-of: log-viewer +spec: + replicas: 1 + selector: + matchLabels: + app: log-viewer + template: + metadata: + labels: + app: log-viewer + app.kubernetes.io/name: log-viewer + app.kubernetes.io/component: web + app.kubernetes.io/part-of: log-viewer + spec: + containers: + - name: log-viewer + image: git.rssa.top/meninjar/log-viewer:20260812080525-main + imagePullPolicy: Always + workingDir: /app + ports: + - name: http + containerPort: 5880 + envFrom: + - configMapRef: + name: log-viewer-env + volumeMounts: + - name: simrs-logs + mountPath: /app/logs + - name: app-tmp + mountPath: /tmp + securityContext: + allowPrivilegeEscalation: false + volumes: + - name: simrs-logs + nfs: + server: nas-rx300.rssa + path: /export/simrs/logs + readOnly: false + - name: app-tmp + emptyDir: {} diff --git a/base/log-viewer-probes.yaml b/base/log-viewer-probes.yaml new file mode 100644 index 0000000..665eb69 --- /dev/null +++ b/base/log-viewer-probes.yaml @@ -0,0 +1,33 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: log-viewer +spec: + template: + spec: + containers: + - name: log-viewer + startupProbe: + tcpSocket: + port: 5880 + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 2 + failureThreshold: 18 + successThreshold: 1 + readinessProbe: + tcpSocket: + port: 5880 + initialDelaySeconds: 15 + periodSeconds: 20 + timeoutSeconds: 10 + failureThreshold: 6 + successThreshold: 1 + livenessProbe: + tcpSocket: + port: 5880 + initialDelaySeconds: 20 + periodSeconds: 30 + timeoutSeconds: 10 + failureThreshold: 6 + successThreshold: 1 diff --git a/base/log-viewer-resources.yaml b/base/log-viewer-resources.yaml new file mode 100644 index 0000000..6358b94 --- /dev/null +++ b/base/log-viewer-resources.yaml @@ -0,0 +1,16 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: log-viewer +spec: + template: + spec: + containers: + - name: log-viewer + resources: + requests: + cpu: 1000m + memory: 2Gi + limits: + cpu: 4000m + memory: 8Gi diff --git a/base/log-viewer-service.yaml b/base/log-viewer-service.yaml new file mode 100644 index 0000000..5d435fd --- /dev/null +++ b/base/log-viewer-service.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Service +metadata: + name: log-viewer + labels: + app: log-viewer + app.kubernetes.io/name: log-viewer + app.kubernetes.io/component: web + app.kubernetes.io/part-of: log-viewer +spec: + selector: + app: log-viewer + ports: + - name: http + port: 80 + targetPort: 5880 diff --git a/fleet.yaml b/fleet.yaml new file mode 100644 index 0000000..2692400 --- /dev/null +++ b/fleet.yaml @@ -0,0 +1,2 @@ +kustomize: + dir: "" diff --git a/kustomization.yaml b/kustomization.yaml new file mode 100644 index 0000000..c41dc66 --- /dev/null +++ b/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: +- overlays/prod diff --git a/overlays/dev/.env.log-viewer.prod b/overlays/dev/.env.log-viewer.prod new file mode 100644 index 0000000..3f3a895 --- /dev/null +++ b/overlays/dev/.env.log-viewer.prod @@ -0,0 +1,10 @@ +NODE_ENV=production +PORT=5880 +NODE_OPTIONS="--max-old-space-size=8192" +LOGS_DIR=/app/logs +KEYCLOAK_URL=https://auth.rssa.top/ +KEYCLOAK_REALM=rssa +KEYCLOAK_CLIENT_ID=satu +KEYCLOAK_CLIENT_SECRET=ZhkK45MHB0a0eAZX5ecNTnlfnWlZXfBE +SIMRS_URL=http://meninjar.dev.rssa.id:4003 +KEYCLOAK_REDIRECT_URI= diff --git a/overlays/dev/certificate.yaml b/overlays/dev/certificate.yaml new file mode 100644 index 0000000..73d8a5f --- /dev/null +++ b/overlays/dev/certificate.yaml @@ -0,0 +1,12 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: log-viewer-rssa-id +spec: + secretName: log-viewer-rssa-id-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "log-viewer.rssa.id" + dnsNames: + - "log-viewer.rssa.id" diff --git a/overlays/dev/ingress-route.yaml b/overlays/dev/ingress-route.yaml new file mode 100644 index 0000000..78a0ef4 --- /dev/null +++ b/overlays/dev/ingress-route.yaml @@ -0,0 +1,35 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: log-viewer-local + annotations: + kubernetes.io/ingress.class: traefik-internal +spec: + entryPoints: + - web + routes: + - kind: Rule + match: Host(`log-viewer.rssa.id`) + services: + - name: log-viewer-prod + port: 80 +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: log-viewer + annotations: + kubernetes.io/ingress.class: traefik-external +spec: + entryPoints: + - websecure + routes: + - kind: Rule + match: Host(`log-viewer.rssa.id`) + middlewares: + - name: default-headers + services: + - name: log-viewer-prod + port: 80 + tls: + secretName: log-viewer-rssa-id-tls diff --git a/overlays/dev/kustomization.yaml b/overlays/dev/kustomization.yaml new file mode 100644 index 0000000..63417af --- /dev/null +++ b/overlays/dev/kustomization.yaml @@ -0,0 +1,42 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: +- ../../base +- ingress-route.yaml +- certificate.yaml + +namespace: rssa-apps-prod +nameSuffix: -prod +commonLabels: + environment: prod + app.kubernetes.io/managed-by: kustomize + app.kubernetes.io/part-of: log-viewer + +images: +- name: git.rssa.top/meninjar/log-viewer + newTag: latest + + +patches: +- target: + group: apps + version: v1 + kind: Deployment + name: log-viewer + patch: |- + - op: replace + path: /spec/template/spec/volumes/0 + value: + name: simrs-logs + hostPath: + path: /mnt/simrs-dev/logs + type: Directory + +configMapGenerator: +- name: log-viewer-env + envs: + - .env.log-viewer.prod + +generatorOptions: + disableNameSuffixHash: true diff --git a/overlays/prod/.env.log-viewer.prod b/overlays/prod/.env.log-viewer.prod new file mode 100644 index 0000000..fe51d83 --- /dev/null +++ b/overlays/prod/.env.log-viewer.prod @@ -0,0 +1,10 @@ +NODE_ENV=production +PORT=5880 +NODE_OPTIONS="--max-old-space-size=8192" +LOGS_DIR=/app/logs +KEYCLOAK_URL=https://auth.rssa.top/ +KEYCLOAK_REALM=rssa +KEYCLOAK_CLIENT_ID=satu +KEYCLOAK_CLIENT_SECRET=ZhkK45MHB0a0eAZX5ecNTnlfnWlZXfBE +SIMRS_URL=http://sim.rssa.id +KEYCLOAK_REDIRECT_URI= diff --git a/overlays/prod/certificate.yaml b/overlays/prod/certificate.yaml new file mode 100644 index 0000000..73d8a5f --- /dev/null +++ b/overlays/prod/certificate.yaml @@ -0,0 +1,12 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: log-viewer-rssa-id +spec: + secretName: log-viewer-rssa-id-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "log-viewer.rssa.id" + dnsNames: + - "log-viewer.rssa.id" diff --git a/overlays/prod/ingress-route.yaml b/overlays/prod/ingress-route.yaml new file mode 100644 index 0000000..78a0ef4 --- /dev/null +++ b/overlays/prod/ingress-route.yaml @@ -0,0 +1,35 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: log-viewer-local + annotations: + kubernetes.io/ingress.class: traefik-internal +spec: + entryPoints: + - web + routes: + - kind: Rule + match: Host(`log-viewer.rssa.id`) + services: + - name: log-viewer-prod + port: 80 +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: log-viewer + annotations: + kubernetes.io/ingress.class: traefik-external +spec: + entryPoints: + - websecure + routes: + - kind: Rule + match: Host(`log-viewer.rssa.id`) + middlewares: + - name: default-headers + services: + - name: log-viewer-prod + port: 80 + tls: + secretName: log-viewer-rssa-id-tls diff --git a/overlays/prod/kustomization.yaml b/overlays/prod/kustomization.yaml new file mode 100644 index 0000000..1bc8e3d --- /dev/null +++ b/overlays/prod/kustomization.yaml @@ -0,0 +1,26 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: +- ../../base +- ingress-route.yaml +- certificate.yaml + +namespace: rssa-apps-prod-new +nameSuffix: -prod +commonLabels: + environment: prod + app.kubernetes.io/managed-by: kustomize + app.kubernetes.io/part-of: log-viewer + +images: +- name: git.rssa.top/meninjar/log-viewer + newTag: 20260812080525-main + +configMapGenerator: +- name: log-viewer-env + envs: + - .env.log-viewer.prod + +generatorOptions: + disableNameSuffixHash: true