platform/sicabe-core
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sync dari sicabe-doc/deploy @ bc1a6e6

Browse Source
This commit is contained in:
subroto
2026-10-11 13:59:47 +07:00
parent 4ca7a9a58e
commit cbabe96061
29 changed files with 1210 additions and 650 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/lib/cluster/generate.py
+71 -7
View File
@@ -456,6 +456,10 @@ def endpoint_lines(doc: dict, host: str, plan: dict) -> list[str]:
placement = component_placements(doc)
lines: list[str] = []
for var, component in ENDPOINT_VARS.items():
ext = inventory.external_address(doc, component)
if ext:
lines.append(f"{var}={ext}") # EKSTERNAL (pihak lain) → alamat tetap
continue
owners = placement.get(component)
if not owners:
continue
@@ -492,6 +496,10 @@ def public_url_lines(doc: dict, plan: dict | None = None) -> list[str]:
placement = component_placements(doc)
resolved: dict[str, str] = {}
for var, (component, tmpl) in PUBLIC_URL_ENDPOINTS.items():
ext = inventory.external_address(doc, component)
if ext:
resolved[var] = tmpl.format(addr=ext) # eksternal → alamat tetap
continue
owners = placement.get(component)
if not owners:
continue
@@ -655,6 +663,10 @@ def url_endpoint_lines(doc: dict, host: str, plan: dict, env_path=None) -> list[
placement = component_placements(doc)
lines: list[str] = []
for var, (component, template) in URL_ENDPOINT_VARS.items():
ext = inventory.external_address(doc, component)
if ext:
lines.append(f"{var}={template.format(addr=ext, port=_endpoint_port(var, env_path))}")
continue
owners = placement.get(component)
if not owners:
continue
@@ -684,6 +696,30 @@ def render_config_map(doc: dict, host: str, plan: dict) -> list[str]:
return args
def _rewrite_prometheus_scrapes(host_dir, doc, env_path) -> None:
"""Ganti target scrape MinIO di prometheus.yml bila MinIO EKSTERNAL.
Prometheus TIDAK mendukung substitusi env (beda dgn config Trino), dan
render-config.sh hanya memetakan hostname komponen yang dimiliki HOST LAIN —
komponen EKSTERNAL (`components.minio.address`, skenario P3) TAK dipetakan →
target tetap `minio:9000` (nama container) → scrape GAGAL dari host prometheus.
Di sini diganti `<alamat-eksternal>:<MINIO_INTERNAL_PORT>`.
MinIO se-host (single-host / P1) → tak diubah (`minio:9000`, satu jaringan Docker).
"""
yml = host_dir / "config" / "prometheus" / "prometheus.yml"
if not yml.is_file():
return
ext = inventory.external_address(doc, "minio")
if not ext:
return
port = _source_env_value(env_path, "MINIO_INTERNAL_PORT") or "9000"
txt = yml.read_text(encoding="utf-8")
new = txt.replace("minio:9000", f"{ext}:{port}")
if new != txt:
yml.write_text(new, encoding="utf-8")
def cmd_render(argv: list[str]) -> int:
if len(argv) < 7:
sys.stderr.write(__doc__ or "")
@@ -797,6 +833,9 @@ def cmd_render(argv: list[str]) -> int:
fh.write("# DIBANGKITKAN OTOMATIS dari cluster.yml oleh install.sh --generate\n")
fh.write("# — jangan disunting tangan. Target node_exporter (job `node`) semua host.\n")
yaml.safe_dump(node_targets_doc(plan), fh, sort_keys=False, allow_unicode=True)
# Prometheus tak mendukung substitusi env → target MinIO eksternal
# (`minio:9000`) di-rewrite di sini ke alamat:port publik.
_rewrite_prometheus_scrapes(host_dir, doc, env_path)
if rc.returncode != 0:
sys.stderr.write(f"[host-{host}] render-config GAGAL:\n{rc.stdout}{rc.stderr}")
return 1
@@ -872,17 +911,42 @@ def _write_bundle_runtime_files(host_dir, env_path):
elif not pw_json.is_file():
pw_json.write_text("{}\n", encoding="utf-8")
pw_json.chmod(0o666)
# 2) Trino password.db — byte-identik dari sumber bila ada; kalau tidak, FILE kosong
# (yang penting BUKAN direktori; bootstrap mengisinya).
src_db = Path(env_path).resolve().parent / "config" / "trino" / "password.db"
# 2) Trino password.db — DIBANGKITKAN dari TRINO_SVC_*_PASSWORD di .env (service
# account, HTTP Basic/bcrypt). Dulu hanya MENYALIN config/trino/password.db
# sumber — di mode cluster sumber itu sering KOSONG → bundle kosong → Trino
# menolak dgn 401 "Access Denied: Invalid credentials" (mis. dbt `svc_dbt`).
# Kini bundle MANDIRI & konsisten setelah --sync. Fallback: salin sumber bila
# htpasswd tak tersedia; kalau tidak ada, file kosong (yang penting BUKAN direktori).
dst_db = cfg / "trino" / "password.db"
dst_db.parent.mkdir(parents=True, exist_ok=True)
if dst_db.is_dir():
shutil.rmtree(dst_db)
if src_db.is_file():
shutil.copy2(src_db, dst_db)
elif not dst_db.is_file():
dst_db.write_text("", encoding="utf-8")
svc_accounts = (
("svc_seed", "TRINO_SVC_SEED_PASSWORD"),
("svc_dbt", "TRINO_SVC_DBT_PASSWORD"),
("svc_airflow", "TRINO_SVC_AIRFLOW_PASSWORD"),
("svc_om", "TRINO_SVC_OM_PASSWORD"),
)
pw_lines = []
htpasswd = shutil.which("htpasswd")
if htpasswd:
for user, key in svc_accounts:
secret = _source_env_value(env_path, key)
if not secret:
continue
proc = subprocess.run([htpasswd, "-nbB", "-C", "10", user, secret],
capture_output=True, text=True)
if proc.returncode == 0 and proc.stdout.strip():
pw_lines.append(proc.stdout.strip())
if pw_lines:
dst_db.write_text("\n".join(pw_lines) + "\n", encoding="utf-8")
dst_db.chmod(0o644)
else:
src_db = Path(env_path).resolve().parent / "config" / "trino" / "password.db"
if src_db.is_file():
shutil.copy2(src_db, dst_db)
elif not dst_db.is_file():
dst_db.write_text("", encoding="utf-8")
def main(argv: list[str]) -> int: