abrban/cloud-host
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: resolve critical deployment issues across Helm charts, Dockerfile, and K8s fallback

Browse Source 
- Add helm/kubectl binaries and chart directory to backend Dockerfile
- Extend Helm templates for MongoDB/MariaDB database support (env vars, probes, ports)
- Add Redis and RabbitMQ Helm templates (deployment, service, secret, PVC)
- Add generic app-storage PVC and Fluent Bit sidecar with ES authentication
- Fix imagePullSecrets in K8s API fallback, prevent secret regeneration on redeploy
- Clean up Redis/RabbitMQ/FluentBit resources on app deletion without removing shared secrets
- Fix HelmService chartPath resolution for production Docker builds

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
keyhan
2026-05-13 19:16:07 +03:30
parent 38748b0827
commit 9937ee457d
11 changed files with 665 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/kubernetes/kubernetes.service.ts
+98 -43
View File
@@ -34,8 +34,11 @@ interface ManifestContext {
dbStorageSize: string;
appStorageSize: string;
enableRedis: boolean;
redisVersion: string;
enableRabbitmq: boolean;
rabbitmqVersion: string;
enableElasticsearch: boolean;
elasticsearchVersion: string;
logPaths: string[];
}
@@ -225,8 +228,11 @@ export class KubernetesService implements OnModuleInit {
dbStorageSize: app.dbStorageSize || '1Gi',
appStorageSize: app.appStorageSize || '2Gi',
enableRedis: app.enableRedis || false,
redisVersion: app.redisVersion || '7.2',
enableRabbitmq: app.enableRabbitmq || false,
rabbitmqVersion: app.rabbitmqVersion || '3.13',
enableElasticsearch: app.enableElasticsearch || false,
elasticsearchVersion: app.elasticsearchVersion || '8.12',
logPaths: app.logPaths || [],
};
@@ -412,6 +418,7 @@ export class KubernetesService implements OnModuleInit {
template: {
metadata: { labels: { app: ctx.appName, runtime: ctx.runtime } },
spec: {
imagePullSecrets: [{ name: 'registry-pull-secret' }],
containers: this.buildContainersSpec(ctx, envFrom, extraEnv),
volumes: this.buildVolumesSpec(ctx),
},
@@ -511,12 +518,6 @@ export class KubernetesService implements OnModuleInit {
// Add Fluent Bit sidecar for log collection if Elasticsearch is enabled
if (ctx.enableElasticsearch) {
const logPaths = ctx.logPaths && ctx.logPaths.length > 0
? ctx.logPaths
: ['/var/log/app/*.log'];
const fluentbitConfig = this.buildFluentBitConfig(ctx.appName, ctx.namespace, logPaths);
containers.push({
name: 'fluent-bit',
image: 'fluent/fluent-bit:2.2',
@@ -531,9 +532,9 @@ export class KubernetesService implements OnModuleInit {
env: [
{ name: 'APP_NAME', value: ctx.appName },
{ name: 'APP_NAMESPACE', value: ctx.namespace },
// Elasticsearch host - assumes cluster-level ES at elasticsearch.logging namespace
{ name: 'ES_HOST', value: 'elasticsearch.logging.svc.cluster.local' },
{ name: 'ES_PORT', value: '9200' },
{ name: 'ES_PASSWORD', valueFrom: { secretKeyRef: { name: 'elasticsearch-credentials', key: 'ELASTIC_PASSWORD', optional: true } } },
],
});
}
@@ -569,40 +570,84 @@ export class KubernetesService implements OnModuleInit {
return volumes;
}
/**
* Get default log paths based on runtime type
*/
private getDefaultLogPaths(runtime: string): string[] {
switch (runtime) {
case AppRuntime.WORDPRESS:
return ['/var/www/html/wp-content/debug.log', '/var/log/app/*.log'];
case AppRuntime.LARAVEL:
return ['/var/www/html/storage/logs/*.log', '/var/log/app/*.log'];
case AppRuntime.PHP:
return ['/var/www/html/storage/logs/*.log', '/var/log/php/*.log', '/var/log/app/*.log'];
case AppRuntime.DJANGO:
return ['/app/logs/*.log', '/var/log/app/*.log'];
case AppRuntime.PYTHON:
return ['/app/logs/*.log', '/var/log/app/*.log'];
case AppRuntime.NODEJS:
return ['/app/logs/*.log', '/var/log/app/*.log'];
case AppRuntime.GO:
return ['/app/logs/*.log', '/var/log/app/*.log'];
case AppRuntime.DOTNET:
return ['/app/logs/*.log', '/var/log/app/*.log'];
default:
return ['/var/log/app/*.log'];
}
}
/**
* Build Fluent Bit configuration for log collection
*/
private buildFluentBitConfig(appName: string, namespace: string, logPaths: string[]): string {
private buildFluentBitConfig(appName: string, namespace: string, runtime: string, customLogPaths?: string[]): string {
const logPaths = customLogPaths && customLogPaths.length > 0
? customLogPaths
: this.getDefaultLogPaths(runtime);
const pathsStr = logPaths.join(',');
return `
[SERVICE]
Flush 5
Daemon Off
Log_Level info
Parsers_File /fluent-bit/etc/parsers.conf
[INPUT]
Name tail
Path ${pathsStr}
Tag app.${appName}
Parser json
Refresh_Interval 5
Mem_Buf_Limit 5MB
Skip_Long_Lines On
[FILTER]
Name record_modifier
Match *
Record app ${appName}
Record namespace ${namespace}
Record runtime ${runtime}
[FILTER]
Name parser
Match *
Key_Name log
Parser json
Reserve_Data On
Preserve_Key On
[OUTPUT]
Name es
Match *
Host \${ES_HOST}
Port \${ES_PORT}
HTTP_User elastic
HTTP_Passwd \${ES_PASSWORD}
Index logs-${namespace}-${appName}
Type _doc
Logstash_Format On
Logstash_Prefix logs-${namespace}
Suppress_Type_Name On
tls Off
Retry_Limit 3
`;
}
@@ -615,9 +660,9 @@ export class KubernetesService implements OnModuleInit {
): Promise<void> {
if (!ctx.enableElasticsearch) return;
const logPaths = ctx.logPaths && ctx.logPaths.length > 0
const customLogPaths = ctx.logPaths && ctx.logPaths.length > 0
? ctx.logPaths
: ['/var/log/app/*.log'];
: undefined;
const configMap = {
apiVersion: 'v1',
@@ -628,7 +673,7 @@ export class KubernetesService implements OnModuleInit {
labels: { app: ctx.appName },
},
data: {
'fluent-bit.conf': this.buildFluentBitConfig(ctx.appName, ctx.namespace, logPaths),
'fluent-bit.conf': this.buildFluentBitConfig(ctx.appName, ctx.namespace, ctx.runtime, customLogPaths),
'parsers.conf': `
[PARSER]
Name json
@@ -920,20 +965,20 @@ export class KubernetesService implements OnModuleInit {
// Create PVC for Redis persistence
await this.createPVC(coreApi, ctx.namespace, `${redisName}-data`, '1Gi');
// Create Redis password secret
const redisPassword = this.generatePassword(16);
const redisSecret = {
apiVersion: 'v1',
kind: 'Secret',
metadata: { name: `${redisName}-secret`, namespace: ctx.namespace },
data: {
password: Buffer.from(redisPassword).toString('base64'),
},
};
// Only create Redis password secret if it doesn't already exist
try {
await coreApi.replaceNamespacedSecret(`${redisName}-secret`, ctx.namespace, redisSecret);
await coreApi.readNamespacedSecret(`${redisName}-secret`, ctx.namespace);
this.logger.log(`Redis secret ${redisName}-secret already exists, skipping`);
} catch {
const redisPassword = this.generatePassword(16);
const redisSecret = {
apiVersion: 'v1',
kind: 'Secret',
metadata: { name: `${redisName}-secret`, namespace: ctx.namespace },
data: {
password: Buffer.from(redisPassword).toString('base64'),
},
};
await coreApi.createNamespacedSecret(ctx.namespace, redisSecret);
}
@@ -951,7 +996,7 @@ export class KubernetesService implements OnModuleInit {
containers: [
{
name: 'redis',
image: 'redis:7.2-alpine',
image: `redis:${ctx.redisVersion}-alpine`,
args: ['--requirepass', '$(REDIS_PASSWORD)'],
ports: [{ containerPort: 6379 }],
env: [
@@ -1032,22 +1077,22 @@ export class KubernetesService implements OnModuleInit {
// Create PVC for RabbitMQ persistence
await this.createPVC(coreApi, ctx.namespace, `${rabbitName}-data`, '2Gi');
// Create RabbitMQ credentials secret
const rabbitUser = 'appuser';
const rabbitPassword = this.generatePassword(16);
const rabbitSecret = {
apiVersion: 'v1',
kind: 'Secret',
metadata: { name: `${rabbitName}-secret`, namespace: ctx.namespace },
data: {
username: Buffer.from(rabbitUser).toString('base64'),
password: Buffer.from(rabbitPassword).toString('base64'),
},
};
// Only create RabbitMQ credentials secret if it doesn't already exist
try {
await coreApi.replaceNamespacedSecret(`${rabbitName}-secret`, ctx.namespace, rabbitSecret);
await coreApi.readNamespacedSecret(`${rabbitName}-secret`, ctx.namespace);
this.logger.log(`RabbitMQ secret ${rabbitName}-secret already exists, skipping`);
} catch {
const rabbitUser = 'appuser';
const rabbitPassword = this.generatePassword(16);
const rabbitSecret = {
apiVersion: 'v1',
kind: 'Secret',
metadata: { name: `${rabbitName}-secret`, namespace: ctx.namespace },
data: {
username: Buffer.from(rabbitUser).toString('base64'),
password: Buffer.from(rabbitPassword).toString('base64'),
},
};
await coreApi.createNamespacedSecret(ctx.namespace, rabbitSecret);
}
@@ -1065,7 +1110,7 @@ export class KubernetesService implements OnModuleInit {
containers: [
{
name: 'rabbitmq',
image: 'rabbitmq:3.13-management-alpine',
image: `rabbitmq:${ctx.rabbitmqVersion}-management-alpine`,
ports: [
{ containerPort: 5672, name: 'amqp' },
{ containerPort: 15672, name: 'management' },
@@ -1601,8 +1646,18 @@ export class KubernetesService implements OnModuleInit {
() => coreApi.deleteNamespacedPersistentVolumeClaim(`${app.name}-wp-content`, namespace),
// App env secret
() => coreApi.deleteNamespacedSecret(`${app.name}-env`, namespace),
// Registry pull secret (shared, but labeled per-app — safe to delete)
() => coreApi.deleteNamespacedSecret('registry-pull-secret', namespace),
// Fluent Bit config (if elasticsearch was enabled)
() => coreApi.deleteNamespacedConfigMap(`${app.name}-fluent-bit-config`, namespace),
// Redis resources
() => appsApi.deleteNamespacedDeployment(`${app.name}-redis`, namespace),
() => coreApi.deleteNamespacedService(`${app.name}-redis`, namespace),
() => coreApi.deleteNamespacedPersistentVolumeClaim(`${app.name}-redis-data`, namespace),
() => coreApi.deleteNamespacedSecret(`${app.name}-redis-secret`, namespace),
// RabbitMQ resources
() => appsApi.deleteNamespacedDeployment(`${app.name}-rabbitmq`, namespace),
() => coreApi.deleteNamespacedService(`${app.name}-rabbitmq`, namespace),
() => coreApi.deleteNamespacedPersistentVolumeClaim(`${app.name}-rabbitmq-data`, namespace),
() => coreApi.deleteNamespacedSecret(`${app.name}-rabbitmq-secret`, namespace),
// TLS secret created by cert-manager
() => coreApi.deleteNamespacedSecret(`${app.name}-tls`, namespace),
];