raijin-server 0.2.5__py3-none-any.whl → 0.2.7__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- raijin_server/__init__.py +1 -1
- raijin_server/cli.py +147 -2
- raijin_server/modules/calico.py +68 -3
- raijin_server/modules/cert_manager.py +363 -29
- raijin_server/modules/full_install.py +228 -1
- raijin_server/modules/prometheus.py +90 -5
- raijin_server/scripts/checklist.sh +0 -0
- raijin_server/scripts/install.sh +3 -2
- raijin_server/scripts/log_size_metric.sh +17 -13
- raijin_server/scripts/pre-deploy-check.sh +2 -1
- raijin_server/utils.py +207 -23
- {raijin_server-0.2.5.dist-info → raijin_server-0.2.7.dist-info}/METADATA +96 -79
- {raijin_server-0.2.5.dist-info → raijin_server-0.2.7.dist-info}/RECORD +16 -16
- {raijin_server-0.2.5.dist-info → raijin_server-0.2.7.dist-info}/WHEEL +0 -0
- {raijin_server-0.2.5.dist-info → raijin_server-0.2.7.dist-info}/entry_points.txt +0 -0
- {raijin_server-0.2.5.dist-info → raijin_server-0.2.7.dist-info}/licenses/LICENSE +0 -0
- {raijin_server-0.2.5.dist-info → raijin_server-0.2.7.dist-info}/top_level.txt +0 -0
raijin_server/utils.py
CHANGED
|
@@ -29,9 +29,38 @@ BACKUP_COUNT = int(os.environ.get("RAIJIN_LOG_BACKUP_COUNT", 5))
|
|
|
29
29
|
logger = logging.getLogger("raijin-server")
|
|
30
30
|
logger.setLevel(logging.INFO)
|
|
31
31
|
|
|
32
|
-
|
|
32
|
+
|
|
33
|
+
def _build_file_handler() -> RotatingFileHandler:
|
|
34
|
+
"""Cria handler com fallback para $HOME quando /var/log exige root."""
|
|
35
|
+
try:
|
|
36
|
+
return RotatingFileHandler(LOG_FILE, maxBytes=MAX_LOG_BYTES, backupCount=BACKUP_COUNT)
|
|
37
|
+
except PermissionError:
|
|
38
|
+
fallback = Path.home() / ".raijin-server.log"
|
|
39
|
+
fallback.parent.mkdir(parents=True, exist_ok=True)
|
|
40
|
+
return RotatingFileHandler(fallback, maxBytes=MAX_LOG_BYTES, backupCount=BACKUP_COUNT)
|
|
41
|
+
|
|
42
|
+
|
|
43
|
+
file_handler = _build_file_handler()
|
|
33
44
|
stream_handler = logging.StreamHandler()
|
|
34
45
|
|
|
46
|
+
|
|
47
|
+
def active_log_file() -> Path:
|
|
48
|
+
return Path(getattr(file_handler, "baseFilename", LOG_FILE))
|
|
49
|
+
|
|
50
|
+
|
|
51
|
+
def available_log_files() -> list[Path]:
|
|
52
|
+
base = active_log_file()
|
|
53
|
+
pattern = base.name + "*"
|
|
54
|
+
return [p for p in sorted(base.parent.glob(pattern)) if p.is_file()]
|
|
55
|
+
|
|
56
|
+
|
|
57
|
+
def page_text(content: str) -> None:
|
|
58
|
+
pager = shutil.which("less")
|
|
59
|
+
if pager:
|
|
60
|
+
subprocess.run([pager, "-R"], input=content, text=True, check=False)
|
|
61
|
+
else:
|
|
62
|
+
typer.echo(content)
|
|
63
|
+
|
|
35
64
|
formatter = logging.Formatter("%(asctime)s - %(name)s - %(levelname)s - %(message)s")
|
|
36
65
|
file_handler.setFormatter(formatter)
|
|
37
66
|
stream_handler.setFormatter(formatter)
|
|
@@ -57,6 +86,13 @@ class ExecutionContext:
|
|
|
57
86
|
timeout: int = 600 # 10 min for slow connections
|
|
58
87
|
errors: list = field(default_factory=list)
|
|
59
88
|
warnings: list = field(default_factory=list)
|
|
89
|
+
# Controle interativo/diagnostico
|
|
90
|
+
selected_steps: list[str] | None = None
|
|
91
|
+
confirm_each_step: bool = False
|
|
92
|
+
debug_snapshots: bool = False
|
|
93
|
+
post_diagnose: bool = False
|
|
94
|
+
color_prompts: bool = True
|
|
95
|
+
interactive_steps: bool = False
|
|
60
96
|
|
|
61
97
|
|
|
62
98
|
def resolve_script_path(script_name: str) -> Path:
|
|
@@ -317,6 +353,125 @@ def _get_helm_release_status(release: str, namespace: str) -> str:
|
|
|
317
353
|
return ""
|
|
318
354
|
|
|
319
355
|
|
|
356
|
+
def _get_helm_release_history(release: str, namespace: str) -> list:
|
|
357
|
+
"""Retorna histórico do release Helm."""
|
|
358
|
+
try:
|
|
359
|
+
import json
|
|
360
|
+
result = subprocess.run(
|
|
361
|
+
["helm", "history", release, "-n", namespace, "-o", "json"],
|
|
362
|
+
capture_output=True,
|
|
363
|
+
text=True,
|
|
364
|
+
timeout=30,
|
|
365
|
+
)
|
|
366
|
+
if result.returncode != 0 or not result.stdout:
|
|
367
|
+
return []
|
|
368
|
+
return json.loads(result.stdout)
|
|
369
|
+
except Exception:
|
|
370
|
+
return []
|
|
371
|
+
|
|
372
|
+
|
|
373
|
+
def _diagnose_helm_release(release: str, namespace: str) -> None:
|
|
374
|
+
"""Mostra diagnóstico detalhado de um release Helm."""
|
|
375
|
+
typer.secho(f"\n🔍 Diagnóstico do release '{release}':", fg=typer.colors.YELLOW)
|
|
376
|
+
|
|
377
|
+
# Status atual
|
|
378
|
+
status = _get_helm_release_status(release, namespace)
|
|
379
|
+
typer.echo(f" Status atual: {status or '(não encontrado)'}")
|
|
380
|
+
|
|
381
|
+
# Histórico
|
|
382
|
+
history = _get_helm_release_history(release, namespace)
|
|
383
|
+
if history:
|
|
384
|
+
typer.echo(f" Histórico ({len(history)} revisões):")
|
|
385
|
+
for rev in history[-5:]: # Últimas 5 revisões
|
|
386
|
+
typer.echo(f" Rev {rev.get('revision')}: {rev.get('status')} - {rev.get('description', '')[:50]}")
|
|
387
|
+
|
|
388
|
+
# Secrets do Helm (onde guarda estado)
|
|
389
|
+
try:
|
|
390
|
+
result = subprocess.run(
|
|
391
|
+
["kubectl", "get", "secrets", "-n", namespace, "-l", f"name={release},owner=helm", "-o", "name"],
|
|
392
|
+
capture_output=True,
|
|
393
|
+
text=True,
|
|
394
|
+
timeout=15,
|
|
395
|
+
)
|
|
396
|
+
if result.stdout.strip():
|
|
397
|
+
secrets = result.stdout.strip().split("\n")
|
|
398
|
+
typer.echo(f" Secrets do Helm: {len(secrets)}")
|
|
399
|
+
for s in secrets[-5:]:
|
|
400
|
+
typer.echo(f" {s}")
|
|
401
|
+
except Exception:
|
|
402
|
+
pass
|
|
403
|
+
|
|
404
|
+
# Pods relacionados
|
|
405
|
+
try:
|
|
406
|
+
result = subprocess.run(
|
|
407
|
+
["kubectl", "get", "pods", "-n", namespace, "-o", "wide", "--no-headers"],
|
|
408
|
+
capture_output=True,
|
|
409
|
+
text=True,
|
|
410
|
+
timeout=15,
|
|
411
|
+
)
|
|
412
|
+
if result.stdout.strip():
|
|
413
|
+
typer.echo(" Pods:")
|
|
414
|
+
for line in result.stdout.strip().split("\n")[:5]:
|
|
415
|
+
typer.echo(f" {line}")
|
|
416
|
+
except Exception:
|
|
417
|
+
pass
|
|
418
|
+
|
|
419
|
+
|
|
420
|
+
def _force_cleanup_helm_release(release: str, namespace: str) -> bool:
|
|
421
|
+
"""Limpeza forçada de release Helm travado - remove secrets diretamente."""
|
|
422
|
+
typer.secho(f" Limpeza forçada do release '{release}'...", fg=typer.colors.YELLOW)
|
|
423
|
+
logger.warning(f"Executando limpeza forçada do release {release} em {namespace}")
|
|
424
|
+
|
|
425
|
+
try:
|
|
426
|
+
# 1. Primeiro tenta uninstall normal com --no-hooks (pula hooks que podem estar travando)
|
|
427
|
+
result = subprocess.run(
|
|
428
|
+
["helm", "uninstall", release, "-n", namespace, "--no-hooks", "--wait", "--timeout", "2m"],
|
|
429
|
+
capture_output=True,
|
|
430
|
+
text=True,
|
|
431
|
+
timeout=150,
|
|
432
|
+
)
|
|
433
|
+
|
|
434
|
+
if result.returncode == 0:
|
|
435
|
+
typer.secho(f" ✓ Release removido via helm uninstall", fg=typer.colors.GREEN)
|
|
436
|
+
time.sleep(3)
|
|
437
|
+
return True
|
|
438
|
+
|
|
439
|
+
# 2. Se falhou, remove os secrets do Helm diretamente
|
|
440
|
+
typer.echo(" Helm uninstall falhou, removendo secrets diretamente...")
|
|
441
|
+
logger.warning("Removendo secrets do Helm diretamente")
|
|
442
|
+
|
|
443
|
+
# Lista secrets do Helm para este release
|
|
444
|
+
result = subprocess.run(
|
|
445
|
+
["kubectl", "get", "secrets", "-n", namespace, "-l", f"name={release},owner=helm", "-o", "name"],
|
|
446
|
+
capture_output=True,
|
|
447
|
+
text=True,
|
|
448
|
+
timeout=15,
|
|
449
|
+
)
|
|
450
|
+
|
|
451
|
+
if result.stdout.strip():
|
|
452
|
+
secrets = result.stdout.strip().split("\n")
|
|
453
|
+
for secret in secrets:
|
|
454
|
+
secret_name = secret.replace("secret/", "")
|
|
455
|
+
subprocess.run(
|
|
456
|
+
["kubectl", "delete", "secret", secret_name, "-n", namespace],
|
|
457
|
+
capture_output=True,
|
|
458
|
+
timeout=30,
|
|
459
|
+
)
|
|
460
|
+
typer.echo(f" Removido: {secret_name}")
|
|
461
|
+
|
|
462
|
+
time.sleep(3)
|
|
463
|
+
typer.secho(f" ✓ Secrets do Helm removidos", fg=typer.colors.GREEN)
|
|
464
|
+
return True
|
|
465
|
+
else:
|
|
466
|
+
typer.echo(" Nenhum secret do Helm encontrado")
|
|
467
|
+
return True
|
|
468
|
+
|
|
469
|
+
except Exception as e:
|
|
470
|
+
logger.error(f"Erro na limpeza forçada: {e}")
|
|
471
|
+
typer.secho(f" ✗ Erro na limpeza: {e}", fg=typer.colors.RED)
|
|
472
|
+
return False
|
|
473
|
+
|
|
474
|
+
|
|
320
475
|
def _cleanup_pending_helm_release(release: str, namespace: str, ctx: ExecutionContext) -> None:
|
|
321
476
|
"""Remove release Helm em estado pendente que bloqueia novas operacoes."""
|
|
322
477
|
if ctx.dry_run:
|
|
@@ -327,32 +482,61 @@ def _cleanup_pending_helm_release(release: str, namespace: str, ctx: ExecutionCo
|
|
|
327
482
|
return
|
|
328
483
|
|
|
329
484
|
# Estados que bloqueiam: pending-install, pending-upgrade, pending-rollback
|
|
330
|
-
if status.startswith("pending"):
|
|
331
|
-
|
|
332
|
-
|
|
333
|
-
|
|
334
|
-
|
|
335
|
-
|
|
336
|
-
|
|
485
|
+
if not status.startswith("pending"):
|
|
486
|
+
return
|
|
487
|
+
|
|
488
|
+
typer.secho(
|
|
489
|
+
f"\n⚠ Release '{release}' em estado '{status}' - bloqueando novas operações",
|
|
490
|
+
fg=typer.colors.YELLOW,
|
|
491
|
+
)
|
|
492
|
+
|
|
493
|
+
# Mostra diagnóstico
|
|
494
|
+
_diagnose_helm_release(release, namespace)
|
|
495
|
+
|
|
496
|
+
typer.echo("\n Tentando recuperar...")
|
|
497
|
+
|
|
498
|
+
# 1. Tenta rollback primeiro (funciona para pending-upgrade)
|
|
499
|
+
if status == "pending-upgrade":
|
|
500
|
+
typer.echo(" Tentando rollback para versão anterior...")
|
|
501
|
+
result = subprocess.run(
|
|
337
502
|
["helm", "rollback", release, "-n", namespace, "--wait", "--timeout", "2m"],
|
|
338
503
|
capture_output=True,
|
|
504
|
+
text=True,
|
|
339
505
|
timeout=150,
|
|
340
506
|
)
|
|
341
|
-
|
|
342
|
-
|
|
343
|
-
|
|
344
|
-
|
|
345
|
-
|
|
346
|
-
|
|
347
|
-
|
|
348
|
-
|
|
349
|
-
|
|
350
|
-
|
|
351
|
-
|
|
352
|
-
|
|
353
|
-
|
|
354
|
-
|
|
355
|
-
|
|
507
|
+
|
|
508
|
+
if result.returncode == 0:
|
|
509
|
+
new_status = _get_helm_release_status(release, namespace)
|
|
510
|
+
if not new_status.startswith("pending"):
|
|
511
|
+
typer.secho(f" ✓ Rollback bem-sucedido (status: {new_status})", fg=typer.colors.GREEN)
|
|
512
|
+
return
|
|
513
|
+
|
|
514
|
+
typer.echo(" Rollback não resolveu...")
|
|
515
|
+
|
|
516
|
+
# 2. Tenta uninstall normal
|
|
517
|
+
typer.echo(" Tentando helm uninstall...")
|
|
518
|
+
result = subprocess.run(
|
|
519
|
+
["helm", "uninstall", release, "-n", namespace, "--wait", "--timeout", "3m"],
|
|
520
|
+
capture_output=True,
|
|
521
|
+
text=True,
|
|
522
|
+
timeout=200,
|
|
523
|
+
)
|
|
524
|
+
|
|
525
|
+
if result.returncode == 0:
|
|
526
|
+
typer.secho(f" ✓ Release removido com sucesso", fg=typer.colors.GREEN)
|
|
527
|
+
time.sleep(3)
|
|
528
|
+
return
|
|
529
|
+
|
|
530
|
+
# 3. Se ainda falhou, força limpeza
|
|
531
|
+
typer.echo(" Uninstall normal falhou, tentando limpeza forçada...")
|
|
532
|
+
_force_cleanup_helm_release(release, namespace)
|
|
533
|
+
|
|
534
|
+
# Verifica resultado final
|
|
535
|
+
final_status = _get_helm_release_status(release, namespace)
|
|
536
|
+
if final_status:
|
|
537
|
+
typer.secho(f" ⚠ Release ainda existe com status: {final_status}", fg=typer.colors.YELLOW)
|
|
538
|
+
else:
|
|
539
|
+
typer.secho(f" ✓ Release '{release}' limpo com sucesso", fg=typer.colors.GREEN)
|
|
356
540
|
|
|
357
541
|
|
|
358
542
|
def helm_upgrade_install(
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
Metadata-Version: 2.4
|
|
2
2
|
Name: raijin-server
|
|
3
|
-
Version: 0.2.
|
|
3
|
+
Version: 0.2.7
|
|
4
4
|
Summary: CLI para automacao de setup e hardening de servidores Ubuntu Server.
|
|
5
5
|
Home-page: https://example.com/raijin-server
|
|
6
6
|
Author: Equipe Raijin
|
|
@@ -61,52 +61,29 @@ CLI em Python (Typer) para automatizar setup e hardening de servidores Ubuntu Se
|
|
|
61
61
|
|
|
62
62
|
## Requisitos
|
|
63
63
|
|
|
64
|
-
|
|
65
|
-
- Ubuntu Server 20.04+ (testado em 24.04)
|
|
66
|
-
- Permissões root/sudo
|
|
67
|
-
- Conectividade com internet
|
|
68
|
-
- Mínimo 4GB RAM, 20GB disco livre
|
|
69
|
-
- Ferramentas: `curl`, `apt-get`, `systemctl`
|
|
64
|
+
## Instalação (sempre em venv midgard)
|
|
70
65
|
|
|
71
|
-
|
|
72
|
-
- `helm` (>=3.8 para OCI)
|
|
73
|
-
- `kubectl`, `kubeadm`
|
|
74
|
-
- `velero`, `istioctl`
|
|
75
|
-
|
|
76
|
-
## Instalacao
|
|
77
|
-
|
|
78
|
-
Sem venv (global):
|
|
66
|
+
Use apenas o venv `~/.venvs/midgard` para padronizar ambiente e logs.
|
|
79
67
|
|
|
80
68
|
```bash
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
```bash
|
|
87
|
-
python -m venv .venv
|
|
88
|
-
source .venv/bin/activate
|
|
89
|
-
python -m pip install -e .
|
|
90
|
-
```
|
|
69
|
+
# 1) Criar/reativar venv midgard
|
|
70
|
+
python3 -m venv ~/.venvs/midgard
|
|
71
|
+
source ~/.venvs/midgard/bin/activate
|
|
72
|
+
pip install -U pip setuptools
|
|
91
73
|
|
|
92
|
-
|
|
74
|
+
# 2) Instalar a partir do source (dev)
|
|
75
|
+
pip install -U raijin-server
|
|
93
76
|
|
|
94
|
-
|
|
77
|
+
# 3) Uso com sudo preservando o venv
|
|
78
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server --version
|
|
79
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server validate
|
|
80
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server full-install
|
|
95
81
|
|
|
96
|
-
|
|
97
|
-
# 1. Sair do venv atual (se estiver ativo)
|
|
82
|
+
# 4) Quando terminar
|
|
98
83
|
deactivate
|
|
84
|
+
```
|
|
99
85
|
|
|
100
|
-
|
|
101
|
-
rm -rf ~/.venvs/raijin
|
|
102
|
-
|
|
103
|
-
# 3. Criar venv novo
|
|
104
|
-
python3 -m venv ~/.venvs/raijin
|
|
105
|
-
source ~/.venvs/raijin/bin/activate
|
|
106
|
-
pip install -U pip setuptools
|
|
107
|
-
|
|
108
|
-
# 4. Instalar a versão mais recente
|
|
109
|
-
pip install -U raijin-server
|
|
86
|
+
> Dica: se precisar reinstalar, remova o venv (`rm -rf ~/.venvs/midgard`), recrie e repita o passo 2. O `-E` no sudo mantém o venv ativo para o Python.
|
|
110
87
|
|
|
111
88
|
# 5. Rodar usando root preservando o venv
|
|
112
89
|
sudo -E ~/.venvs/raijin/bin/raijin-server --version
|
|
@@ -124,30 +101,70 @@ deactivate
|
|
|
124
101
|
### Validar Sistema
|
|
125
102
|
```bash
|
|
126
103
|
# Verifica se o sistema atende pré-requisitos
|
|
127
|
-
sudo raijin-server validate
|
|
104
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server validate
|
|
128
105
|
```
|
|
129
106
|
|
|
130
107
|
### Menu Interativo
|
|
131
108
|
```bash
|
|
132
|
-
# Menu visual com
|
|
133
|
-
-
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
- `src/raijin_server/modules/`: Automações por tópico (hardening, network, essentials, firewall, kubernetes, calico, istio, traefik, kong, minio, prometheus, grafana, loki, harness, velero, kafka).
|
|
137
|
-
- `src/raijin_server/scripts/`: Shells empacotados usados pelos módulos e scripts auxiliares.
|
|
138
|
-
- `ARCHITECTURE.md`: Visão do desenho técnico.
|
|
139
|
-
- `AUDIT.md`: Relatório completo de auditoria e melhorias.
|
|
140
|
-
- `SECURITY.md`: Como reportar vulnerabilidades
|
|
109
|
+
# Menu visual com atalho para módulos
|
|
110
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server menu
|
|
111
|
+
```
|
|
112
|
+
|
|
141
113
|
### Execução Direta de Módulos
|
|
142
114
|
```bash
|
|
143
115
|
# Executar módulo específico
|
|
144
|
-
sudo raijin-server kubernetes
|
|
116
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server kubernetes
|
|
145
117
|
|
|
146
118
|
# Dry-run (simula sem aplicar)
|
|
147
|
-
sudo raijin-server --dry-run kubernetes
|
|
119
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server --dry-run kubernetes
|
|
148
120
|
|
|
149
121
|
# Pular validações (não recomendado)
|
|
150
|
-
sudo raijin-server --skip-validation kubernetes
|
|
122
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server --skip-validation kubernetes
|
|
123
|
+
```
|
|
124
|
+
|
|
125
|
+
### Instalação Completa com seleção de passos
|
|
126
|
+
```bash
|
|
127
|
+
# Rodar tudo (padrão)
|
|
128
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server full-install
|
|
129
|
+
|
|
130
|
+
# Escolher passos antes de rodar
|
|
131
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server full-install --select-steps
|
|
132
|
+
|
|
133
|
+
# Definir lista fixa (ordem original preservada)
|
|
134
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server full-install --steps "kubernetes,calico,cert_manager,traefik"
|
|
135
|
+
|
|
136
|
+
# Pedir confirmação a cada módulo
|
|
137
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server full-install --confirm-each
|
|
138
|
+
|
|
139
|
+
# Modo debug: snapshots + diagnose pós-módulo
|
|
140
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server full-install --debug-mode
|
|
141
|
+
|
|
142
|
+
# Apenas snapshots após cada módulo (pós-kubernetes)
|
|
143
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server full-install --snapshots
|
|
144
|
+
|
|
145
|
+
# Apenas diagnose pós-módulo (ex.: cert-manager)
|
|
146
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server full-install --post-diagnose
|
|
147
|
+
```
|
|
148
|
+
|
|
149
|
+
### Depuração e Logs (pós-Kubernetes)
|
|
150
|
+
```bash
|
|
151
|
+
# Ver todos os logs do CLI com pager (less)
|
|
152
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server debug logs --lines 400
|
|
153
|
+
|
|
154
|
+
# Seguir logs em tempo real
|
|
155
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server debug logs --follow
|
|
156
|
+
|
|
157
|
+
# Snapshot do cluster: nodes, pods e eventos (últimos 200)
|
|
158
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server debug kube --events 200
|
|
159
|
+
|
|
160
|
+
# Focar em um namespace (ex.: cert-manager)
|
|
161
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server debug kube --namespace cert-manager --events 150
|
|
162
|
+
|
|
163
|
+
# Consultar logs do kubelet via journalctl
|
|
164
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server debug journal --service kubelet --lines 300
|
|
165
|
+
|
|
166
|
+
# Consultar outro serviço systemd (ex.: containerd)
|
|
167
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server debug journal --service containerd --lines 200
|
|
151
168
|
```
|
|
152
169
|
|
|
153
170
|
### Automação via Arquivo de Configuração
|
|
@@ -161,41 +178,41 @@ sudo raijin-server --skip-validation kubernetes
|
|
|
161
178
|
|
|
162
179
|
```bash
|
|
163
180
|
# 1. Validar sistema
|
|
164
|
-
sudo raijin-server validate
|
|
181
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server validate
|
|
165
182
|
|
|
166
183
|
# 2. Base do sistema
|
|
167
|
-
sudo raijin-server essentials
|
|
168
|
-
sudo raijin-server hardening
|
|
169
|
-
sudo raijin-server network # OPCIONAL: pule se IP já configurado via provedor ISP
|
|
170
|
-
sudo raijin-server firewall
|
|
184
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server essentials
|
|
185
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server hardening
|
|
186
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server network # OPCIONAL: pule se IP já configurado via provedor ISP
|
|
187
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server firewall
|
|
171
188
|
|
|
172
189
|
# 3. Kubernetes
|
|
173
|
-
sudo raijin-server kubernetes
|
|
174
|
-
sudo raijin-server calico
|
|
175
|
-
sudo raijin-server secrets
|
|
176
|
-
sudo raijin-server cert-manager
|
|
190
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server kubernetes
|
|
191
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server calico
|
|
192
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server secrets
|
|
193
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server cert-manager
|
|
177
194
|
|
|
178
195
|
# 4. Ingress (escolha um)
|
|
179
|
-
sudo raijin-server traefik
|
|
196
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server traefik
|
|
180
197
|
# OU
|
|
181
|
-
sudo raijin-server kong
|
|
198
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server kong
|
|
182
199
|
|
|
183
200
|
# 5. Observabilidade
|
|
184
|
-
sudo raijin-server prometheus
|
|
185
|
-
sudo raijin-server grafana
|
|
186
|
-
sudo raijin-server observability-ingress
|
|
187
|
-
sudo raijin-server observability-dashboards
|
|
188
|
-
sudo raijin-server loki
|
|
201
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server prometheus
|
|
202
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server grafana
|
|
203
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server observability-ingress
|
|
204
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server observability-dashboards
|
|
205
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server loki
|
|
189
206
|
|
|
190
207
|
# 6. Storage e Mensageria (opcional)
|
|
191
|
-
sudo raijin-server minio
|
|
192
|
-
sudo raijin-server kafka
|
|
208
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server minio
|
|
209
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server kafka
|
|
193
210
|
|
|
194
211
|
# 7. Backup
|
|
195
|
-
sudo raijin-server velero
|
|
212
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server velero
|
|
196
213
|
|
|
197
214
|
# 8. Service Mesh (opcional)
|
|
198
|
-
sudo raijin-server istio
|
|
215
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server istio
|
|
199
216
|
```
|
|
200
217
|
|
|
201
218
|
### IP Estático (pular se já configurado)
|
|
@@ -208,7 +225,7 @@ O módulo `network` é **opcional** quando:
|
|
|
208
225
|
Para pular automaticamente em automações:
|
|
209
226
|
```bash
|
|
210
227
|
export RAIJIN_SKIP_NETWORK=1
|
|
211
|
-
sudo raijin-server full-install
|
|
228
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server full-install
|
|
212
229
|
```
|
|
213
230
|
|
|
214
231
|
O módulo detecta automaticamente se já existe um Netplan com IP estático e pergunta
|
|
@@ -222,12 +239,12 @@ se deseja pular. Se executar manualmente, basta responder "não" quando pergunta
|
|
|
222
239
|
### Comandos Úteis
|
|
223
240
|
```bash
|
|
224
241
|
# Versão (flag ou comando)
|
|
225
|
-
raijin-server --version
|
|
226
|
-
raijin-server -V
|
|
227
|
-
raijin-server version
|
|
242
|
+
~/.venvs/midgard/bin/raijin-server --version
|
|
243
|
+
~/.venvs/midgard/bin/raijin-server -V
|
|
244
|
+
~/.venvs/midgard/bin/raijin-server version
|
|
228
245
|
|
|
229
246
|
# Monitorar logs
|
|
230
|
-
|
|
247
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server debug logs --follow
|
|
231
248
|
|
|
232
249
|
# Rotacao de logs (default: 20MB, 5 backups)
|
|
233
250
|
# Ajuste via env:
|
|
@@ -317,7 +334,7 @@ O helper garante o caminho absoluto correto independentemente de onde o pacote f
|
|
|
317
334
|
O módulo [src/raijin_server/modules/apokolips_demo.py](src/raijin_server/modules/apokolips_demo.py) cria um namespace dedicado, ConfigMap com HTML, Deployment NGINX, Service e Ingress Traefik com uma landing page "Apokolips" para validar o tráfego externo.
|
|
318
335
|
|
|
319
336
|
```bash
|
|
320
|
-
sudo raijin-server apokolips-demo
|
|
337
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server apokolips-demo
|
|
321
338
|
```
|
|
322
339
|
|
|
323
340
|
Personalização rápida:
|
|
@@ -364,7 +381,7 @@ Isso permite manter o isolamento padrão enquanto libera acesso seletivo para in
|
|
|
364
381
|
Execute o modulo `secrets` para instalar os controladores:
|
|
365
382
|
|
|
366
383
|
```bash
|
|
367
|
-
sudo raijin-server secrets
|
|
384
|
+
sudo -E ~/.venvs/midgard/bin/raijin-server secrets
|
|
368
385
|
```
|
|
369
386
|
|
|
370
387
|
Passos realizados:
|
|
@@ -1,17 +1,17 @@
|
|
|
1
|
-
raijin_server/__init__.py,sha256=
|
|
2
|
-
raijin_server/cli.py,sha256=
|
|
1
|
+
raijin_server/__init__.py,sha256=30PUXP9hr-N0U9chGsPaORRkJKEeGnKMrcXhWTwR054,94
|
|
2
|
+
raijin_server/cli.py,sha256=aQxew8FCN-mZoN-ghBasm97gLk5WkOaIcpeucTpXpXY,24821
|
|
3
3
|
raijin_server/config.py,sha256=Dta2CS1d6RgNiQ84P6dTXk98boFrjzuvhs_fCdlm0I4,4810
|
|
4
4
|
raijin_server/healthchecks.py,sha256=BJyWyUDtEswEblvGwWMejtMnsUb8kJcULVdS9iycrcc,14565
|
|
5
|
-
raijin_server/utils.py,sha256=
|
|
5
|
+
raijin_server/utils.py,sha256=9RnGnPoUTYOpMVRLNa4P4lIQrJNQLkSkPUxycZRGv78,20827
|
|
6
6
|
raijin_server/validators.py,sha256=qOZMHgwjHogVf17UPlxfUCpQd9qAGQW7tycd8mUvnEs,9404
|
|
7
7
|
raijin_server/modules/__init__.py,sha256=e_IbkhLGPcF8to9QUmIESP6fpcTOYcIhaXLKIvqRJMY,920
|
|
8
8
|
raijin_server/modules/apokolips_demo.py,sha256=8ltsXRbVDwlDwLMIvh02NG-FeAfBWw_v6lh7IGOyNqs,13725
|
|
9
9
|
raijin_server/modules/bootstrap.py,sha256=oVIGNRW_JbgY8zXNHGAIP0vGbbHNHyQexthxo5zhbcw,9762
|
|
10
|
-
raijin_server/modules/calico.py,sha256=
|
|
11
|
-
raijin_server/modules/cert_manager.py,sha256=
|
|
10
|
+
raijin_server/modules/calico.py,sha256=TTPF1bLFdAKb3IVOqFqRxNblULkRmMMRylsIBp4w8I8,6700
|
|
11
|
+
raijin_server/modules/cert_manager.py,sha256=YvqInfnI06VLFEgau4H0koyBxarFh6vwxvhv7HuQ4Z0,46961
|
|
12
12
|
raijin_server/modules/essentials.py,sha256=2xUXCyCQtFGd2DnCKV81N1R6bEJqH8zaet8mLovtQ1I,689
|
|
13
13
|
raijin_server/modules/firewall.py,sha256=h6AISqiZeTinVT7BjmQIS872qRAFZJLg7meqlth3cfw,757
|
|
14
|
-
raijin_server/modules/full_install.py,sha256=
|
|
14
|
+
raijin_server/modules/full_install.py,sha256=xiKe2GLuZ97c4YdTmhP-kwDVuJJ9Xq3dlgcLlqSPeYM,15518
|
|
15
15
|
raijin_server/modules/grafana.py,sha256=zxYpWBM-fD8vTgoJ2Hmb9P66wz_JuiidO6_cGK3jG30,1809
|
|
16
16
|
raijin_server/modules/hardening.py,sha256=4hz3ifkMhPlXa2n7gPxN0gitQgzALZ-073vuU3LM4RI,1616
|
|
17
17
|
raijin_server/modules/harness.py,sha256=dhZ89YIhlkuxiRU1deN6wXVWnXm0xeI03PwYf_qgfak,1527
|
|
@@ -24,7 +24,7 @@ raijin_server/modules/minio.py,sha256=BVvsEaJlJUV92_ep7pKsBhSYPjWZrDOB3J6XAWYAHY
|
|
|
24
24
|
raijin_server/modules/network.py,sha256=bwVljaVvTc6FbbD-XtDpqqNL-fXMB9-iWVWsXToBvt4,4804
|
|
25
25
|
raijin_server/modules/observability_dashboards.py,sha256=fVz0WEOQrUTF5rJ__Nu_onyBuwL_exFmysWMmg8AE9w,7319
|
|
26
26
|
raijin_server/modules/observability_ingress.py,sha256=Fh1rlFWueBNHnOkHuoHYyhILmpO-iQXINybSUYbYsHQ,5738
|
|
27
|
-
raijin_server/modules/prometheus.py,sha256=
|
|
27
|
+
raijin_server/modules/prometheus.py,sha256=Rs9BREmaoKlyteNdAQZnSIeJfsRO0RQKyyL2gTnXyCw,3716
|
|
28
28
|
raijin_server/modules/sanitize.py,sha256=eytL_mCYF57qnjf6g752VRC4Yl27dDJ0OQP2rjxaR70,4523
|
|
29
29
|
raijin_server/modules/secrets.py,sha256=xpV3gIMnwQdAI2j69Ck5daIK4wlYJA_1rkWTtSfVNk0,3715
|
|
30
30
|
raijin_server/modules/ssh_hardening.py,sha256=oQdk-EVnEHNMKIWvoFuZzI4jK0nNO8IAY4hkB4pj8zw,4025
|
|
@@ -33,12 +33,12 @@ raijin_server/modules/velero.py,sha256=_CV0QQnWr5L-CWXDOiD9Ef4J7GaQT-s9yNBwqp_FL
|
|
|
33
33
|
raijin_server/modules/vpn.py,sha256=hF-0vA17VKTxhQLDBSEeqI5aPQpiaaj4IpUf9l6lr64,8297
|
|
34
34
|
raijin_server/scripts/__init__.py,sha256=deduGfHf8BMVWred4ux5LfBDT2NJ5XYeJAt2sDEU4qs,53
|
|
35
35
|
raijin_server/scripts/checklist.sh,sha256=j6E0Kmk1EfjLvKK1VpCqzXJAXI_7Bm67LK4ndyCxWh0,1842
|
|
36
|
-
raijin_server/scripts/install.sh,sha256=
|
|
37
|
-
raijin_server/scripts/log_size_metric.sh,sha256=
|
|
38
|
-
raijin_server/scripts/pre-deploy-check.sh,sha256=
|
|
39
|
-
raijin_server-0.2.
|
|
40
|
-
raijin_server-0.2.
|
|
41
|
-
raijin_server-0.2.
|
|
42
|
-
raijin_server-0.2.
|
|
43
|
-
raijin_server-0.2.
|
|
44
|
-
raijin_server-0.2.
|
|
36
|
+
raijin_server/scripts/install.sh,sha256=Y1ickbQ4siQ0NIPs6UgrqUr8WWy7U0LHmaTQbEgavoI,3949
|
|
37
|
+
raijin_server/scripts/log_size_metric.sh,sha256=Iv4SsX8AuCYRou-klYn32mX41xB6j0xJGLBO6riw4rU,1208
|
|
38
|
+
raijin_server/scripts/pre-deploy-check.sh,sha256=XqMo7IMIpwUHF17YEmU0-cVmTDMoCGMBFnmS39FidI4,4912
|
|
39
|
+
raijin_server-0.2.7.dist-info/licenses/LICENSE,sha256=kJsMCjOiRZE0AQNtxWqBa32z9kMAaF4EUxyHj3hKaJo,1105
|
|
40
|
+
raijin_server-0.2.7.dist-info/METADATA,sha256=YpgpUhp0TYGWYwEkKd8nDpCLY0MfyWsCWPq7D0zTrJQ,20362
|
|
41
|
+
raijin_server-0.2.7.dist-info/WHEEL,sha256=wUyA8OaulRlbfwMtmQsvNngGrxQHAvkKcvRmdizlJi0,92
|
|
42
|
+
raijin_server-0.2.7.dist-info/entry_points.txt,sha256=3ZvxDX4pvcjkIRsXAJ69wIfVmKa78LKo-C3QhqN2KVM,56
|
|
43
|
+
raijin_server-0.2.7.dist-info/top_level.txt,sha256=Yz1xneCRtsZOzbPIcTAcrSxd-1p80pohMXYAZ74dpok,14
|
|
44
|
+
raijin_server-0.2.7.dist-info/RECORD,,
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|