raijin-server 0.2.1__py3-none-any.whl → 0.2.3__py3-none-any.whl

raijin_server/__init__.py

@@ -1,5 +1,5 @@
 """Pacote principal do CLI Raijin Server."""
 
-__version__ = "0.2.1"
+__version__ = "0.2.3"
 
 __all__ = ["__version__"]

raijin_server/modules/bootstrap.py

@@ -87,17 +87,37 @@ def _install_istioctl(ctx: ExecutionContext) -> None:
         return
 
     typer.echo(f"Instalando istioctl v{ISTIOCTL_VERSION}...")
+    
+    # Limpa tentativas anteriores
+    istio_dir = Path(f"/tmp/istio-{ISTIOCTL_VERSION}")
+    if istio_dir.exists() and not ctx.dry_run:
+        run_cmd(["rm", "-rf", str(istio_dir)], ctx, check=False)
+    
+    # Download do Istio
     run_cmd(
         f"curl -L https://istio.io/downloadIstio | ISTIO_VERSION={ISTIOCTL_VERSION} sh -",
         ctx,
         use_shell=True,
         cwd="/tmp",
     )
+    
+    # Verifica se o download foi bem sucedido
+    istioctl_path = Path(f"/tmp/istio-{ISTIOCTL_VERSION}/bin/istioctl")
+    if not ctx.dry_run and not istioctl_path.exists():
+        typer.secho(
+            f"Falha ao baixar istioctl. Arquivo nao encontrado: {istioctl_path}",
+            fg=typer.colors.RED,
+        )
+        typer.secho("Verifique sua conexao de internet e tente novamente.", fg=typer.colors.YELLOW)
+        ctx.warnings.append("istioctl nao instalado - download falhou")
+        return  # Nao falha o modulo inteiro, apenas avisa
+    
     run_cmd(
-        ["mv", f"/tmp/istio-{ISTIOCTL_VERSION}/bin/istioctl", "/usr/local/bin/istioctl"],
+        ["mv", str(istioctl_path), "/usr/local/bin/istioctl"],
         ctx,
     )
     run_cmd(["chmod", "+x", "/usr/local/bin/istioctl"], ctx)
+    typer.secho("✓ istioctl instalado com sucesso.", fg=typer.colors.GREEN)
 
 
 def _install_velero(ctx: ExecutionContext) -> None:

raijin_server/modules/calico.py

@@ -62,11 +62,40 @@ def _split_namespaces(raw_value: str) -> Iterable[str]:
     return [ns.strip() for ns in raw_value.split(",") if ns.strip()]
 
 
+def _check_cluster_available(ctx: ExecutionContext) -> bool:
+    """Verifica se o cluster Kubernetes esta acessivel."""
+    if ctx.dry_run:
+        return True
+    try:
+        result = run_cmd(
+            ["kubectl", "cluster-info"],
+            ctx,
+            check=False,
+            retries=1,
+        )
+        return result.returncode == 0
+    except Exception:
+        return False
+
+
 def run(ctx: ExecutionContext) -> None:
     require_root(ctx)
     ensure_tool("kubectl", ctx, install_hint="Instale kubectl ou habilite dry-run.")
     ensure_tool("curl", ctx, install_hint="Instale curl.")
 
+    # Verifica se cluster esta disponivel antes de aplicar
+    if not _check_cluster_available(ctx):
+        typer.secho(
+            "✗ Cluster Kubernetes nao esta acessivel. Execute o modulo 'kubernetes' primeiro.",
+            fg=typer.colors.RED,
+        )
+        typer.secho(
+            "  Verifique: kubectl cluster-info",
+            fg=typer.colors.YELLOW,
+        )
+        ctx.errors.append("Calico: cluster nao acessivel")
+        raise typer.Exit(code=1)
+
     typer.echo("Aplicando Calico como CNI...")
     pod_cidr = typer.prompt("Pod CIDR (Calico)", default="10.244.0.0/16")
 

raijin_server/modules/cert_manager.py

@@ -79,11 +79,40 @@ stringData:
 """
 
 
+def _check_cluster_available(ctx: ExecutionContext) -> bool:
+    """Verifica se o cluster Kubernetes esta acessivel."""
+    if ctx.dry_run:
+        return True
+    try:
+        import subprocess
+        result = subprocess.run(
+            ["kubectl", "cluster-info"],
+            capture_output=True,
+            timeout=30,
+        )
+        return result.returncode == 0
+    except Exception:
+        return False
+
+
 def run(ctx: ExecutionContext) -> None:
     require_root(ctx)
     ensure_tool("helm", ctx, install_hint="Instale helm ou use --dry-run para simular.")
     ensure_tool("kubectl", ctx, install_hint="Instale kubectl ou use --dry-run para simular.")
 
+    # Verifica se cluster esta disponivel antes de instalar
+    if not _check_cluster_available(ctx):
+        typer.secho(
+            "✗ Cluster Kubernetes nao esta acessivel. Execute o modulo 'kubernetes' primeiro.",
+            fg=typer.colors.RED,
+        )
+        typer.secho(
+            "  Verifique: kubectl cluster-info",
+            fg=typer.colors.YELLOW,
+        )
+        ctx.errors.append("cert-manager: cluster nao acessivel")
+        raise typer.Exit(code=1)
+
     typer.echo("Instalando cert-manager via Helm...")
     email = typer.prompt("Email para ACME (Let's Encrypt)", default="admin@example.com")
     solver = typer.prompt("Tipo de desafio (http01/dns01)", default="http01")

raijin_server/modules/kubernetes.py

@@ -35,6 +35,20 @@ def _cleanup_old_repo(ctx: ExecutionContext) -> None:
             typer.echo("Nao foi possivel ler/remover repo antigo apt.kubernetes.io (ok prosseguir).")
 
 
+def _reset_cluster(ctx: ExecutionContext) -> None:
+    """Executa kubeadm reset para limpar instalacao anterior."""
+    typer.secho("Limpando instalacao anterior do Kubernetes...", fg=typer.colors.YELLOW)
+    run_cmd(["kubeadm", "reset", "-f"], ctx, check=False)
+    # Remove configs residuais
+    run_cmd(["rm", "-rf", "/etc/kubernetes/manifests", "/etc/kubernetes/pki"], ctx, check=False)
+    run_cmd(["rm", "-rf", "/var/lib/etcd"], ctx, check=False)
+    run_cmd(["rm", "-rf", "/root/.kube/config"], ctx, check=False)
+    # Remove CNI configs
+    run_cmd(["rm", "-rf", "/etc/cni/net.d"], ctx, check=False)
+    run_cmd(["rm", "-rf", "/var/lib/cni"], ctx, check=False)
+    typer.secho("✓ Limpeza concluida.", fg=typer.colors.GREEN)
+
+
 def run(ctx: ExecutionContext) -> None:
     require_root(ctx)
     typer.echo("Instalando e preparando Kubernetes (kubeadm/kubelet/kubectl)...")
@@ -43,7 +57,10 @@ def run(ctx: ExecutionContext) -> None:
     kubeconfig_exists = Path("/etc/kubernetes/admin.conf").exists()
     if kubeconfig_exists and not ctx.dry_run:
         typer.secho("⚠ Cluster Kubernetes ja parece estar inicializado.", fg=typer.colors.YELLOW)
-        if not typer.confirm("Deseja continuar mesmo assim? (pode causar problemas)"):
+        reset_choice = typer.confirm("Deseja limpar e reinstalar? (recomendado)")
+        if reset_choice:
+            _reset_cluster(ctx)
+        elif not typer.confirm("Deseja continuar sem limpar? (pode causar problemas)"):
             typer.echo("Operacao cancelada pelo usuario.")
             return
 
@@ -130,8 +147,18 @@ def run(ctx: ExecutionContext) -> None:
     enable_service("kubelet", ctx)
 
     # kubeadm exige ip_forward=1; sobrepoe ajuste de hardening para fase de cluster.
-    write_file(Path("/etc/sysctl.d/99-kubernetes.conf"), "net.ipv4.ip_forward=1\n", ctx)
-    run_cmd(["sysctl", "-w", "net.ipv4.ip_forward=1"], ctx, check=False)
+    # Desabilita IPv6 completamente para evitar erros de preflight e simplificar rede
+    sysctl_k8s = """# Kubernetes network settings
+net.ipv4.ip_forward=1
+net.bridge.bridge-nf-call-iptables=1
+net.bridge.bridge-nf-call-ip6tables=1
+# Disable IPv6 completely
+net.ipv6.conf.all.disable_ipv6=1
+net.ipv6.conf.default.disable_ipv6=1
+net.ipv6.conf.lo.disable_ipv6=1
+"""
+    write_file(Path("/etc/sysctl.d/99-kubernetes.conf"), sysctl_k8s, ctx)
+    run_cmd(["sysctl", "--system"], ctx, check=False)
 
     # Prompts de configuracao
     pod_cidr = typer.prompt("Pod CIDR", default="10.244.0.0/16")
@@ -168,7 +195,16 @@ cgroupDriver: systemd
 
     ensure_tool("kubeadm", ctx, install_hint="Instale kubeadm (apt install kubeadm).")
     run_cmd(["kubeadm", "config", "images", "pull"], ctx, check=False)
-    run_cmd(["kubeadm", "init", "--config", str(cfg_path), "--upload-certs"], ctx)
+    # Ignora erros de preflight relacionados a IPv6 (desabilitado)
+    run_cmd(
+        [
+            "kubeadm", "init",
+            "--config", str(cfg_path),
+            "--upload-certs",
+            "--ignore-preflight-errors=FileContent--proc-sys-net-ipv6-conf-default-forwarding",
+        ],
+        ctx,
+    )
 
     # Configura kubeconfig para root e sudoer.
     run_cmd(["mkdir", "-p", "/root/.kube"], ctx)

raijin_server/utils.py

@@ -51,9 +51,10 @@ class ExecutionContext:
 
     dry_run: bool = False
     assume_yes: bool = True
-    max_retries: int = 3
-    retry_delay: int = 5
-    timeout: int = 300
+    max_retries: int = 5
+    retry_delay: int = 10
+    retry_backoff: float = 1.5  # Multiplier for exponential backoff
+    timeout: int = 600  # 10 min for slow connections
     errors: list = field(default_factory=list)
     warnings: list = field(default_factory=list)
 
@@ -144,14 +145,24 @@ def run_cmd(
             logger.warning(msg)
             ctx.warnings.append(msg)
             if attempt < max_attempts:
-                time.sleep(ctx.retry_delay)
+                backoff_delay = int(ctx.retry_delay * (ctx.retry_backoff ** (attempt - 1)))
+                typer.secho(
+                    f"Timeout! Aguardando {backoff_delay}s antes de tentar novamente...",
+                    fg=typer.colors.YELLOW,
+                )
+                time.sleep(backoff_delay)
         except subprocess.CalledProcessError as e:
             last_error = e
             msg = f"Comando falhou com codigo {e.returncode} (tentativa {attempt}/{max_attempts})"
             logger.error(f"{msg}: {e.stderr if hasattr(e, 'stderr') else ''}")
             if attempt < max_attempts:
-                typer.secho(f"Tentando novamente em {ctx.retry_delay}s...", fg=typer.colors.YELLOW)
-                time.sleep(ctx.retry_delay)
+                # Exponential backoff: delay * backoff^(attempt-1)
+                backoff_delay = int(ctx.retry_delay * (ctx.retry_backoff ** (attempt - 1)))
+                typer.secho(
+                    f"Tentando novamente em {backoff_delay}s... (possivel instabilidade de rede)",
+                    fg=typer.colors.YELLOW,
+                )
+                time.sleep(backoff_delay)
             else:
                 ctx.errors.append(msg)
                 if check:
@@ -192,8 +203,64 @@ def ensure_tool(name: str, ctx: ExecutionContext, install_hint: str = "") -> Non
         raise typer.Exit(code=1)
 
 
+def _fix_broken_apt_sources(ctx: ExecutionContext) -> None:
+    """Corrige repositórios APT quebrados (mirrors brasileiros problemáticos)."""
+    if ctx.dry_run:
+        typer.echo("[dry-run] Verificando/corrigindo repositórios APT...")
+        return
+
+    sources_list = Path("/etc/apt/sources.list")
+
+    # Detecta se está usando mirror brasileiro quebrado
+    needs_fix = False
+    if sources_list.exists():
+        content = sources_list.read_text()
+        if "br.archive.ubuntu.com" in content or "br.ports.ubuntu.com" in content:
+            needs_fix = True
+
+    if not needs_fix:
+        return
+
+    typer.secho(
+        "⚠ Detectado mirror brasileiro possivelmente quebrado. Corrigindo...",
+        fg=typer.colors.YELLOW,
+    )
+    logger.warning("Corrigindo mirror brasileiro quebrado em sources.list")
+
+    # Backup do original
+    backup = sources_list.with_suffix(".list.bak")
+    if not backup.exists():
+        import shutil as sh
+        sh.copy2(sources_list, backup)
+
+    # Substitui mirror brasileiro pelo principal
+    new_content = content.replace("br.archive.ubuntu.com", "archive.ubuntu.com")
+    new_content = new_content.replace("br.ports.ubuntu.com", "ports.ubuntu.com")
+    sources_list.write_text(new_content)
+
+    typer.secho("✓ Repositórios corrigidos (backup em sources.list.bak)", fg=typer.colors.GREEN)
+
+
 def apt_update(ctx: ExecutionContext) -> None:
-    run_cmd(["apt-get", "update"], ctx)
+    """Executa apt-get update, corrigindo repositórios quebrados se necessário."""
+    _fix_broken_apt_sources(ctx)
+
+    # Tenta o update; se falhar com erro de Release, tenta corrigir
+    try:
+        run_cmd(["apt-get", "update"], ctx, retries=2)
+    except Exception as e:
+        error_msg = str(e).lower()
+        if "release" in error_msg or "no longer has" in error_msg:
+            typer.secho(
+                "⚠ Erro de repositório detectado. Tentando fallback...",
+                fg=typer.colors.YELLOW,
+            )
+            # Força correção e tenta novamente
+            ctx_temp = ExecutionContext(dry_run=False)
+            _fix_broken_apt_sources(ctx_temp)
+            run_cmd(["apt-get", "update"], ctx)
+        else:
+            raise
 
 
 def apt_install(packages: Iterable[str], ctx: ExecutionContext) -> None:

{raijin_server-0.2.1.dist-info → raijin_server-0.2.3.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: raijin-server
-Version: 0.2.1
+Version: 0.2.3
 Summary: CLI para automacao de setup e hardening de servidores Ubuntu Server.
 Home-page: https://example.com/raijin-server
 Author: Equipe Raijin
@@ -39,11 +39,14 @@ CLI em Python (Typer) para automatizar setup e hardening de servidores Ubuntu Se
 
 ## Destaques
 
-- ✅ **Validações de Pré-requisitos**: OS, espaço em disco, memória, conectividade
+- ✅ **Validações de Pré-requisitos**: OS, espaço em disco, memória, conectividade, ambiente Python (venv)
 - ✅ **Health Checks Automáticos**: Valida serviços após instalação
-- ✅ **Retry Inteligente**: Resistente a falhas temporárias de rede
-- ✅ **Logging Estruturado**: Logs persistentes para auditoria
+- ✅ **Retry Inteligente com Backoff**: Resistente a falhas temporárias de rede (5 tentativas, backoff exponencial)
+- ✅ **Logging Estruturado**: Logs persistentes com rotação (20MB, 5 backups)
 - ✅ **Gestão de Dependências**: Garante ordem correta de execução
+- ✅ **Verificação de Cluster**: Módulos que dependem de K8s verificam disponibilidade antes de executar
+- ✅ **Clean Automático**: Opção de limpar instalação anterior ao re-executar kubernetes
+- ✅ **IPv4 Only**: IPv6 desabilitado por padrão para simplificar rede
 - ✅ **Configuração via Arquivo**: Automação completa com YAML/JSON
 - ✅ **Idempotência**: Re-execução segura sem quebrar o sistema
 - ✅ **Modo Dry-run**: Simula execução sem aplicar mudanças
@@ -180,7 +183,9 @@ se deseja pular. Se executar manualmente, basta responder "não" quando pergunta
 
 ### Comandos Úteis
 ```bash
-# Versão
+# Versão (flag ou comando)
+raijin-server --version
+raijin-server -V
 raijin-server version
 
 # Monitorar logs
@@ -222,9 +227,9 @@ tail -f /var/log/raijin-server/raijin-server.log
 - `network`: Netplan com IP fixo e DNS. **OPCIONAL** se IP já configurado pelo provedor ISP.
 - `firewall`: UFW com regras para SSH/HTTP/HTTPS/K8s.
 - `vpn`: provisiona WireGuard (servidor + cliente inicial) e libera firewall.
-- `kubernetes`: kubeadm init, containerd SystemdCgroup, kubeconfig.
-- `calico`: CNI Calico com CIDR custom, default-deny e opcao de liberar egress rotulado.
-- `cert_manager`: instala cert-manager e ClusterIssuer ACME (HTTP-01/DNS-01).
+- `kubernetes`: kubeadm init, containerd SystemdCgroup, kubeconfig. **Oferece limpeza automática** se detectar instalação anterior. IPv6 desabilitado por padrão.
+- `calico`: CNI Calico com CIDR custom, default-deny e opcao de liberar egress rotulado. **Verifica cluster ativo** antes de aplicar.
+- `cert_manager`: instala cert-manager e ClusterIssuer ACME (HTTP-01/DNS-01). **Verifica cluster ativo** antes de instalar.
 - `secrets`: instala sealed-secrets e external-secrets via Helm.
 - `istio`: istioctl install (perfil raijin) e injeção automática.
 - `traefik`: IngressController com TLS/ACME.

{raijin_server-0.2.1.dist-info → raijin_server-0.2.3.dist-info}/RECORD

@@ -1,14 +1,14 @@
-raijin_server/__init__.py,sha256=JPePevptTQ8J1tBtg72vlfl2KSqpnUdGTt7dQhMtKmk,94
+raijin_server/__init__.py,sha256=AKDS9uS_9UXF-3BZWSJvcQdgvkhbsxMs1o-P7R5xBE4,94
 raijin_server/cli.py,sha256=ZgaSkXwXaND7HHeySjIn4GEmTVTqUDttUfqXJ9yZV1E,16772
 raijin_server/config.py,sha256=Dta2CS1d6RgNiQ84P6dTXk98boFrjzuvhs_fCdlm0I4,4810
 raijin_server/healthchecks.py,sha256=-mQq-dGZ2id16wvPmiTPjDHw14PBwz_i8AXi307V38k,12411
-raijin_server/utils.py,sha256=-zKDIQyVaPBE7k2rj4uTpdLI-YUG-fZhnkhO_5bsEPc,8782
+raijin_server/utils.py,sha256=oQM-NGL_kmlNZejFvxXk85MI_WkcxNfwaw5LeAsKUFU,11476
 raijin_server/validators.py,sha256=qOZMHgwjHogVf17UPlxfUCpQd9qAGQW7tycd8mUvnEs,9404
 raijin_server/modules/__init__.py,sha256=e_IbkhLGPcF8to9QUmIESP6fpcTOYcIhaXLKIvqRJMY,920
 raijin_server/modules/apokolips_demo.py,sha256=gMUpYNaO0V20KoNa4ljyA1W9HJbY__O9AEO64NuWGhE,12365
-raijin_server/modules/bootstrap.py,sha256=XiIqaNwDIKVA6nXAM2t_35gYW8Z4oWB7vnJAgNxuLYw,8916
-raijin_server/modules/calico.py,sha256=ljSMYlc-U9HoidQHcGgL1VggS_ypnVohyF4DtzXokc8,3273
-raijin_server/modules/cert_manager.py,sha256=f3lLnaJBxYcfjh4AozWsOZw-nZ56Hqxk2p9EkMpkHuE,3984
+raijin_server/modules/bootstrap.py,sha256=oVIGNRW_JbgY8zXNHGAIP0vGbbHNHyQexthxo5zhbcw,9762
+raijin_server/modules/calico.py,sha256=a8N7YYv7NoaspPKdhRtwHy3V2mM4cP5xA1H8BwslB18,4139
+raijin_server/modules/cert_manager.py,sha256=bSv5CRbPlH3DHWHBqUNTKVh0C973E4XC8WzGieOHh3A,4882
 raijin_server/modules/essentials.py,sha256=2xUXCyCQtFGd2DnCKV81N1R6bEJqH8zaet8mLovtQ1I,689
 raijin_server/modules/firewall.py,sha256=h6AISqiZeTinVT7BjmQIS872qRAFZJLg7meqlth3cfw,757
 raijin_server/modules/full_install.py,sha256=Mk_SHBrtL4zgjgd2shUuhp4fyDIPdlBVZtC5t8x-1vU,5908
@@ -18,7 +18,7 @@ raijin_server/modules/harness.py,sha256=dhZ89YIhlkuxiRU1deN6wXVWnXm0xeI03PwYf_qg
 raijin_server/modules/istio.py,sha256=761FOGEzEXWlTLYApQxUWY8l4cnEbnIXbIHK3itk_AQ,522
 raijin_server/modules/kafka.py,sha256=bp8k_IhuAIO6dL0IpK1UxxLZoGih6nJp0ZnzwmiZEj8,950
 raijin_server/modules/kong.py,sha256=2EZKYBmBhm_7Nduw9PWrvrekp0VCxQbc2gElpAJqKfg,491
-raijin_server/modules/kubernetes.py,sha256=B_J2mHLjMNglksnZk08HSK3z55kNytuq5sVBbjAXbLY,6846
+raijin_server/modules/kubernetes.py,sha256=zHbgCYzzdJJwUGsxJoiyT4HCeJz2HmDSeBR88KP-v4Y,8286
 raijin_server/modules/loki.py,sha256=erwFfSiSFOv-Ul3nFdrI2RElPYuqqBPBBa_MJAwyLys,676
 raijin_server/modules/minio.py,sha256=BVvsEaJlJUV92_ep7pKsBhSYPjWZrDOB3J6XAWYAHYg,486
 raijin_server/modules/network.py,sha256=bwVljaVvTc6FbbD-XtDpqqNL-fXMB9-iWVWsXToBvt4,4804
@@ -36,9 +36,9 @@ raijin_server/scripts/checklist.sh,sha256=j6E0Kmk1EfjLvKK1VpCqzXJAXI_7Bm67LK4ndy
 raijin_server/scripts/install.sh,sha256=IZOTujOSGmKpznwgL59picsQNVzYkai6FtfFS3Klf34,3908
 raijin_server/scripts/log_size_metric.sh,sha256=rC2Ck4xnYVJV4Qymu24-indC8bkzfZs4FBqqxGPRl1I,1143
 raijin_server/scripts/pre-deploy-check.sh,sha256=naPUgKjnKgsh-eGDH2623C7zcr9VjDEw1H0lfYaXW8c,4853
-raijin_server-0.2.1.dist-info/licenses/LICENSE,sha256=kJsMCjOiRZE0AQNtxWqBa32z9kMAaF4EUxyHj3hKaJo,1105
-raijin_server-0.2.1.dist-info/METADATA,sha256=EV6FCXxKZWHwsPc9HEgQEV03pUUmS-AGQ8JdOVW7rD0,16327
-raijin_server-0.2.1.dist-info/WHEEL,sha256=wUyA8OaulRlbfwMtmQsvNngGrxQHAvkKcvRmdizlJi0,92
-raijin_server-0.2.1.dist-info/entry_points.txt,sha256=3ZvxDX4pvcjkIRsXAJ69wIfVmKa78LKo-C3QhqN2KVM,56
-raijin_server-0.2.1.dist-info/top_level.txt,sha256=Yz1xneCRtsZOzbPIcTAcrSxd-1p80pohMXYAZ74dpok,14
-raijin_server-0.2.1.dist-info/RECORD,,
+raijin_server-0.2.3.dist-info/licenses/LICENSE,sha256=kJsMCjOiRZE0AQNtxWqBa32z9kMAaF4EUxyHj3hKaJo,1105
+raijin_server-0.2.3.dist-info/METADATA,sha256=Bh7AicqZXP3kLYhHxgf1uB3R4PGI4hcC8AYaDAaUg6A,16941
+raijin_server-0.2.3.dist-info/WHEEL,sha256=wUyA8OaulRlbfwMtmQsvNngGrxQHAvkKcvRmdizlJi0,92
+raijin_server-0.2.3.dist-info/entry_points.txt,sha256=3ZvxDX4pvcjkIRsXAJ69wIfVmKa78LKo-C3QhqN2KVM,56
+raijin_server-0.2.3.dist-info/top_level.txt,sha256=Yz1xneCRtsZOzbPIcTAcrSxd-1p80pohMXYAZ74dpok,14
+raijin_server-0.2.3.dist-info/RECORD,,