update to git

ANALISA.md

@@ -0,0 +1,36 @@
+# Analisa adaptasi log-viewer ke K3s
+
+## Template
+
+Struktur mengikuti `k3s-satusehat`: base Deployment/Service/probes/resources dan overlay Kustomize untuk environment, ingress, certificate, image tag, serta generated environment.
+
+## Koreksi volume log
+
+Source `docker-compose.yml` memakai bind mount host (`/mnt/simrs/logs:/app/logs`). Bind mount tersebut tidak boleh diterjemahkan secara literal menjadi `hostPath` di K3s karena log SIMRS sebenarnya berasal dari storage NFS aplikasi `simrs-v3`.
+
+Deployment SIMRS menggunakan:
+
+```yaml
+- name: vol-logs
+  nfs:
+    server: nas-rx300.rssa
+    path: /export/simrs/logs
+    readOnly: false
+```
+
+Karena itu overlay production `log-viewer` memakai sumber NFS yang sama dan mount ke `/app/logs`. Overlay dev tidak menebak export NFS yang belum diketahui; sementara tetap menggunakan bind path dev yang ditemukan pada source aplikasi.
+
+Konsekuensi:
+
+- pod dapat berpindah worker tanpa kehilangan view log;
+- tidak membutuhkan `nodeSelector` khusus log;
+- tidak membutuhkan directory `/mnt/simrs/logs` pada filesystem worker;
+- semua worker yang dapat menjalankan pod harus mempunyai konektivitas dan dukungan NFS ke `nas-rx300.rssa`.
+
+## Replica
+
+Replica tetap satu. Shared NFS menghilangkan masalah node-local storage, tetapi tidak otomatis menjamin aplikasi aman terhadap concurrent mutation file. Scaling baru layak setelah operasi tulis/retention/unblock diuji untuk multi-process concurrency.
+
+## Environment secret
+
+Template sumber menaruh environment melalui ConfigMap. Pola itu dipertahankan agar konsisten, tetapi nilai credential sebaiknya dipisahkan ke Secret karena ConfigMap tidak dirancang sebagai penyimpanan secret.

README.md

@@ -0,0 +1,73 @@
+# k3s-log-viewer
+
+Manifest K3s/Kustomize untuk `log-viewer`, mengikuti struktur `k3s-satusehat`.
+
+## Struktur
+
+- `base/`: Deployment, Service, resource patch, dan probes.
+- `overlays/dev/`: overlay namespace lama sesuai pola `k3s-satusehat`.
+- `overlays/prod/`: overlay production `rssa-apps-prod-new`.
+- `fleet.yaml`: konfigurasi Fleet.
+- root `kustomization.yaml`: mengarah ke overlay production.
+
+## Source log SIMRS
+
+`log-viewer` membaca log aplikasi SIMRS dari storage yang sama dengan Deployment `simrs-v3`:
+
+- NFS server: `nas-rx300.rssa`
+- NFS export: `/export/simrs/logs`
+- Mount di container: `/app/logs`
+
+Overlay **production** tidak menggunakan `hostPath`. Dengan NFS, pod production tidak terikat ke worker tertentu selama node K3s dapat resolve dan mengakses server NFS.
+
+Overlay `dev` masih mempertahankan `/mnt/simrs-dev/logs` dari source `docker-compose.yml` karena export NFS SIMRS dev belum diberikan. Jangan anggap export dev sama dengan production tanpa mengecek Deployment SIMRS dev.
+
+```yaml
+volumes:
+- name: simrs-logs
+  nfs:
+    server: nas-rx300.rssa
+    path: /export/simrs/logs
+    readOnly: false
+```
+
+## Image
+
+Base image:
+
+`git.rssa.top/meninjar/log-viewer:latest`
+
+Overlay production saat paket ini dibuat menggunakan:
+
+`git.rssa.top/meninjar/log-viewer:20260811055659-main`
+
+## Port
+
+Aplikasi listen pada TCP `5880`. Service dan probes menggunakan port yang sama.
+
+## Replica
+
+Replica tetap `1`. Walaupun NFS bersifat shared, source aplikasi mempunyai operasi terhadap file log sehingga multi-replica/HPA perlu diuji terhadap concurrency sebelum diaktifkan.
+
+## Deploy / validate
+
+Jika `kubectl` memiliki Kustomize builtin:
+
+```bash
+kubectl kustomize overlays/prod
+kubectl apply -k overlays/prod
+```
+
+Cek hasil:
+
+```bash
+kubectl get pod -n rssa-apps-prod-new -l app=log-viewer -o wide
+kubectl describe pod -n rssa-apps-prod-new -l app=log-viewer
+kubectl logs -n rssa-apps-prod-new -l app=log-viewer --tail=100
+```
+
+Untuk memastikan NFS dapat diakses dari node tempat pod dijadwalkan, cek event pod. Error seperti `mount.nfs`, `access denied`, `no route to host`, atau DNS failure menunjukkan masalah konektivitas/client NFS di node, bukan aplikasi `log-viewer`.
+
+## Catatan environment
+
+Pola template `k3s-satusehat` menggunakan `configMapGenerator` untuk file environment dan pola tersebut dipertahankan. Secara security, credential seperti `KEYCLOAK_CLIENT_SECRET` lebih tepat dipindahkan ke Kubernetes Secret/secret manager pada iterasi berikutnya.

base/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- log-viewer-deployment.yaml
+- log-viewer-service.yaml
+
+patches:
+- path: log-viewer-resources.yaml
+- path: log-viewer-probes.yaml
+
+commonLabels:
+  app.kubernetes.io/part-of: log-viewer

base/log-viewer-deployment.yaml

@@ -0,0 +1,48 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: log-viewer
+  labels:
+    app: log-viewer
+    app.kubernetes.io/name: log-viewer
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: log-viewer
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: log-viewer
+  template:
+    metadata:
+      labels:
+        app: log-viewer
+        app.kubernetes.io/name: log-viewer
+        app.kubernetes.io/component: web
+        app.kubernetes.io/part-of: log-viewer
+    spec:
+      containers:
+      - name: log-viewer
+        image: git.rssa.top/meninjar/log-viewer:20260812080525-main
+        imagePullPolicy: Always
+        workingDir: /app
+        ports:
+        - name: http
+          containerPort: 5880
+        envFrom:
+        - configMapRef:
+            name: log-viewer-env
+        volumeMounts:
+        - name: simrs-logs
+          mountPath: /app/logs
+        - name: app-tmp
+          mountPath: /tmp
+        securityContext:
+          allowPrivilegeEscalation: false
+      volumes:
+      - name: simrs-logs
+        nfs:
+          server: nas-rx300.rssa
+          path: /export/simrs/logs
+          readOnly: false
+      - name: app-tmp
+        emptyDir: {}

base/log-viewer-probes.yaml

@@ -0,0 +1,33 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: log-viewer
+spec:
+  template:
+    spec:
+      containers:
+      - name: log-viewer
+        startupProbe:
+          tcpSocket:
+            port: 5880
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          timeoutSeconds: 2
+          failureThreshold: 18
+          successThreshold: 1
+        readinessProbe:
+          tcpSocket:
+            port: 5880
+          initialDelaySeconds: 15
+          periodSeconds: 20
+          timeoutSeconds: 10
+          failureThreshold: 6
+          successThreshold: 1
+        livenessProbe:
+          tcpSocket:
+            port: 5880
+          initialDelaySeconds: 20
+          periodSeconds: 30
+          timeoutSeconds: 10
+          failureThreshold: 6
+          successThreshold: 1

base/log-viewer-resources.yaml

@@ -0,0 +1,16 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: log-viewer
+spec:
+  template:
+    spec:
+      containers:
+      - name: log-viewer
+        resources:
+          requests:
+            cpu: 1000m
+            memory: 2Gi
+          limits:
+            cpu: 4000m
+            memory: 8Gi

base/log-viewer-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: log-viewer
+  labels:
+    app: log-viewer
+    app.kubernetes.io/name: log-viewer
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: log-viewer
+spec:
+  selector:
+    app: log-viewer
+  ports:
+  - name: http
+    port: 80
+    targetPort: 5880

fleet.yaml

@@ -0,0 +1,2 @@
+kustomize:
+  dir: ""

kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- overlays/prod

overlays/dev/.env.log-viewer.prod

@@ -0,0 +1,10 @@
+NODE_ENV=production
+PORT=5880
+NODE_OPTIONS="--max-old-space-size=8192"
+LOGS_DIR=/app/logs
+KEYCLOAK_URL=https://auth.rssa.top/
+KEYCLOAK_REALM=rssa
+KEYCLOAK_CLIENT_ID=satu
+KEYCLOAK_CLIENT_SECRET=ZhkK45MHB0a0eAZX5ecNTnlfnWlZXfBE
+SIMRS_URL=http://meninjar.dev.rssa.id:4003
+KEYCLOAK_REDIRECT_URI=

overlays/dev/certificate.yaml

@@ -0,0 +1,12 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: log-viewer-rssa-id
+spec:
+  secretName: log-viewer-rssa-id-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: "log-viewer.rssa.id"
+  dnsNames:
+  - "log-viewer.rssa.id"

overlays/dev/ingress-route.yaml

@@ -0,0 +1,35 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: log-viewer-local
+  annotations:
+    kubernetes.io/ingress.class: traefik-internal
+spec:
+  entryPoints:
+  - web
+  routes:
+  - kind: Rule
+    match: Host(`log-viewer.rssa.id`)
+    services:
+    - name: log-viewer-prod
+      port: 80
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: log-viewer
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+  - websecure
+  routes:
+  - kind: Rule
+    match: Host(`log-viewer.rssa.id`)
+    middlewares:
+    - name: default-headers
+    services:
+    - name: log-viewer-prod
+      port: 80
+  tls:
+    secretName: log-viewer-rssa-id-tls

overlays/dev/kustomization.yaml

@@ -0,0 +1,42 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- ../../base
+- ingress-route.yaml
+- certificate.yaml
+
+namespace: rssa-apps-prod
+nameSuffix: -prod
+commonLabels:
+  environment: prod
+  app.kubernetes.io/managed-by: kustomize
+  app.kubernetes.io/part-of: log-viewer
+
+images:
+- name: git.rssa.top/meninjar/log-viewer
+  newTag: latest
+
+
+patches:
+- target:
+    group: apps
+    version: v1
+    kind: Deployment
+    name: log-viewer
+  patch: |-
+    - op: replace
+      path: /spec/template/spec/volumes/0
+      value:
+        name: simrs-logs
+        hostPath:
+          path: /mnt/simrs-dev/logs
+          type: Directory
+
+configMapGenerator:
+- name: log-viewer-env
+  envs:
+  - .env.log-viewer.prod
+
+generatorOptions:
+  disableNameSuffixHash: true

overlays/prod/.env.log-viewer.prod

@@ -0,0 +1,10 @@
+NODE_ENV=production
+PORT=5880
+NODE_OPTIONS="--max-old-space-size=8192"
+LOGS_DIR=/app/logs
+KEYCLOAK_URL=https://auth.rssa.top/
+KEYCLOAK_REALM=rssa
+KEYCLOAK_CLIENT_ID=satu
+KEYCLOAK_CLIENT_SECRET=ZhkK45MHB0a0eAZX5ecNTnlfnWlZXfBE
+SIMRS_URL=http://sim.rssa.id
+KEYCLOAK_REDIRECT_URI=

overlays/prod/certificate.yaml

@@ -0,0 +1,12 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: log-viewer-rssa-id
+spec:
+  secretName: log-viewer-rssa-id-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: "log-viewer.rssa.id"
+  dnsNames:
+  - "log-viewer.rssa.id"

overlays/prod/ingress-route.yaml

@@ -0,0 +1,35 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: log-viewer-local
+  annotations:
+    kubernetes.io/ingress.class: traefik-internal
+spec:
+  entryPoints:
+  - web
+  routes:
+  - kind: Rule
+    match: Host(`log-viewer.rssa.id`)
+    services:
+    - name: log-viewer-prod
+      port: 80
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: log-viewer
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+  - websecure
+  routes:
+  - kind: Rule
+    match: Host(`log-viewer.rssa.id`)
+    middlewares:
+    - name: default-headers
+    services:
+    - name: log-viewer-prod
+      port: 80
+  tls:
+    secretName: log-viewer-rssa-id-tls

overlays/prod/kustomization.yaml

@@ -0,0 +1,26 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- ../../base
+- ingress-route.yaml
+- certificate.yaml
+
+namespace: rssa-apps-prod-new
+nameSuffix: -prod
+commonLabels:
+  environment: prod
+  app.kubernetes.io/managed-by: kustomize
+  app.kubernetes.io/part-of: log-viewer
+
+images:
+- name: git.rssa.top/meninjar/log-viewer
+  newTag: 20260812080525-main
+
+configMapGenerator:
+- name: log-viewer-env
+  envs:
+  - .env.log-viewer.prod
+
+generatorOptions:
+  disableNameSuffixHash: true