deploy: configure NC01 HWLAB monitor exposure

2026-07-08 05:34:11 +02:00
parent 5dfb78f000
commit a328aa909e
41 changed files with 2522 additions and 110 deletions
@@ -0,0 +1,472 @@
+#!/usr/bin/env bun
+import { readFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { resolve } from "node:path";
+
+function required(value, path) {
+  if (typeof value !== "string" || value.length === 0) throw new Error(`${path} must be a non-empty string`);
+  return value;
+}
+
+function record(value, path) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${path} must be an object`);
+  return value;
+}
+
+function readEnvFile(path) {
+  const values = {};
+  const text = readFileSync(path, "utf8");
+  for (const [index, rawLine] of text.split(/\r?\n/u).entries()) {
+    const line = rawLine.trim();
+    if (line.length === 0 || line.startsWith("#")) continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0) throw new Error(`${path}:${index + 1} must be KEY=value`);
+    values[line.slice(0, eq)] = line.slice(eq + 1);
+  }
+  return values;
+}
+
+function sha(value) {
+  return createHash("sha256").update(value).digest("hex").slice(0, 16);
+}
+
+function yamlScalar(value) {
+  return JSON.stringify(String(value));
+}
+
+function indent(text, spaces) {
+  const pad = " ".repeat(spaces);
+  return text.split("\n").map((line) => line.length > 0 ? `${pad}${line}` : line).join("\n");
+}
+
+function labels(config) {
+  const name = required(record(config.metadata, "metadata").name, "metadata.name");
+  return [
+    "app.kubernetes.io/part-of: unidesk",
+    `unidesk.ai/deployment: ${name}`,
+    `unidesk.ai/target: ${required(record(config.target, "target").id, "target.id")}`,
+  ].join("\n");
+}
+
+function envFromSecret(secretName, keyName, envName) {
+  return [
+    `- name: ${envName}`,
+    "  valueFrom:",
+    "    secretKeyRef:",
+    `      name: ${secretName}`,
+    `      key: ${keyName}`,
+  ].join("\n");
+}
+
+function envFromConfig(configName, keyName, envName) {
+  return [
+    `- name: ${envName}`,
+    "  valueFrom:",
+    "    configMapKeyRef:",
+    `      name: ${configName}`,
+    `      key: ${keyName}`,
+  ].join("\n");
+}
+
+function resourceBlock(resources) {
+  const requests = record(record(resources, "resources").requests, "resources.requests");
+  const limits = record(resources.limits, "resources.limits");
+  return [
+    "resources:",
+    "  requests:",
+    `    cpu: ${yamlScalar(required(requests.cpu, "resources.requests.cpu"))}`,
+    `    memory: ${yamlScalar(required(requests.memory, "resources.requests.memory"))}`,
+    "  limits:",
+    ...(limits.cpu ? [`    cpu: ${yamlScalar(limits.cpu)}`] : []),
+    `    memory: ${yamlScalar(required(limits.memory, "resources.limits.memory"))}`,
+  ].join("\n");
+}
+
+const configPath = process.argv[2] ?? "config/unidesk-host-k8s.yaml";
+const config = Bun.YAML.parse(readFileSync(configPath, "utf8"));
+const target = record(config.target, "target");
+const runtime = record(config.runtime, "runtime");
+const images = record(config.images, "images");
+const database = record(config.database, "database");
+const services = record(config.services, "services");
+const backend = record(services.backendCore, "services.backendCore");
+const frontend = record(services.frontend, "services.frontend");
+const runtimeConfig = record(config.runtimeConfig, "runtimeConfig");
+const runtimeSecrets = record(config.runtimeSecrets, "runtimeSecrets");
+const secretTarget = record(runtimeSecrets.target, "runtimeSecrets.target");
+const secretKeys = record(secretTarget.keys, "runtimeSecrets.target.keys");
+const namespace = required(target.namespace, "target.namespace");
+const secretName = required(secretTarget.name, "runtimeSecrets.target.name");
+const sourcePath = resolve(required(record(runtimeSecrets.sourceRef, "runtimeSecrets.sourceRef").path, "runtimeSecrets.sourceRef.path"));
+const secrets = readEnvFile(sourcePath);
+const requiredSecretKeys = Object.values(secretKeys);
+for (const key of requiredSecretKeys) {
+  if (typeof secrets[key] !== "string" || secrets[key].length === 0) throw new Error(`missing ${key} in ${sourcePath}`);
+}
+const secretFingerprint = sha(requiredSecretKeys.map((key) => `${key}=${secrets[key]}`).join("\n"));
+const runtimeConfigFingerprint = sha(JSON.stringify(runtimeConfig));
+const runtimeConfigName = "unidesk-runtime-config";
+const databaseMode = database.mode === undefined ? "k8s-postgres" : required(database.mode, "database.mode");
+if (databaseMode !== "k8s-postgres" && databaseMode !== "host-native") throw new Error("database.mode must be k8s-postgres or host-native");
+const dbService = required(database.serviceName, "database.serviceName");
+const dbHost = databaseMode === "host-native" ? required(database.host, "database.host") : `${dbService}.${namespace}.svc.cluster.local`;
+const dbPort = required(String(database.port), "database.port");
+const dbName = secrets[secretKeys.postgresDb];
+if (secrets[secretKeys.databaseUrl] !== `postgres://${secrets[secretKeys.postgresUser]}:${secrets[secretKeys.postgresPassword]}@${dbHost}:${dbPort}/${dbName}`) {
+  throw new Error(`DATABASE_URL in ${sourcePath} must target ${dbHost}:${dbPort}/${dbName}`);
+}
+
+const docs = [];
+docs.push(`apiVersion: v1
+kind: Namespace
+metadata:
+  name: ${namespace}
+  labels:
+${indent(labels(config), 4)}`);
+docs.push(`apiVersion: v1
+kind: Secret
+metadata:
+  name: ${secretName}
+  namespace: ${namespace}
+  labels:
+${indent(labels(config), 4)}
+  annotations:
+    unidesk.ai/source-ref: ${yamlScalar(required(record(runtimeSecrets.sourceRef, "runtimeSecrets.sourceRef").path, "runtimeSecrets.sourceRef.path"))}
+    unidesk.ai/fingerprint: ${yamlScalar(secretFingerprint)}
+type: Opaque
+stringData:
+${indent(requiredSecretKeys.map((key) => `${key}: ${yamlScalar(secrets[key])}`).join("\n"), 2)}`);
+docs.push(`apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ${runtimeConfigName}
+  namespace: ${namespace}
+  labels:
+${indent(labels(config), 4)}
+data:
+  UNIDESK_ENV: ${yamlScalar(required(runtime.environment, "runtime.environment"))}
+  UNIDESK_NAMESPACE: ${yamlScalar(namespace)}
+  UNIDESK_DEPLOY_REF: ${yamlScalar(required(runtime.deployRef, "runtime.deployRef"))}
+  UNIDESK_DEPLOY_REPO: ${yamlScalar(required(runtime.repository, "runtime.repository"))}
+  UNIDESK_DEPLOY_COMMIT: ${yamlScalar(required(runtime.commit, "runtime.commit"))}
+  UNIDESK_DEPLOY_REQUESTED_COMMIT: ${yamlScalar(required(runtime.commit, "runtime.commit"))}
+  UNIDESK_DATABASE_NAME: ${yamlScalar(dbName)}
+  UNIDESK_DATABASE_MODE: ${yamlScalar(databaseMode)}
+  UNIDESK_DATABASE_HOST: ${yamlScalar(dbHost)}
+  UNIDESK_DATABASE_PORT: ${yamlScalar(dbPort)}
+  DATABASE_VOLUME_NAME: ${yamlScalar(required(database.pvcName, "database.pvcName"))}
+  DATABASE_VOLUME_SIZE: ${yamlScalar(required(database.storageSize, "database.storageSize"))}
+  HEARTBEAT_TIMEOUT_MS: ${yamlScalar(required(runtimeConfig.heartBeatTimeoutMs, "runtimeConfig.heartBeatTimeoutMs"))}
+  TASK_PENDING_TIMEOUT_MS: ${yamlScalar(required(runtimeConfig.taskPendingTimeoutMs, "runtimeConfig.taskPendingTimeoutMs"))}
+  DATABASE_POOL_MAX: ${yamlScalar(required(runtimeConfig.databasePoolMax, "runtimeConfig.databasePoolMax"))}
+  SESSION_TTL_SECONDS: ${yamlScalar(required(runtimeConfig.sessionTtlSeconds, "runtimeConfig.sessionTtlSeconds"))}
+  AUTH_USERNAME: ${yamlScalar(required(runtimeConfig.authUsername, "runtimeConfig.authUsername"))}
+  UNIDESK_SSH_CLIENT_ROUTE_ALLOWLIST: ${yamlScalar(required(runtimeConfig.sshClientRouteAllowlist, "runtimeConfig.sshClientRouteAllowlist"))}
+  MICROSERVICES_JSON: ${yamlScalar(required(runtimeConfig.microservicesJson, "runtimeConfig.microservicesJson"))}
+  NO_PROXY: ${yamlScalar(required(runtime.noProxy, "runtime.noProxy"))}
+  no_proxy: ${yamlScalar(required(runtime.noProxy, "runtime.noProxy"))}`);
+if (databaseMode === "k8s-postgres") {
+docs.push(`apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: ${required(database.pvcName, "database.pvcName")}
+  namespace: ${namespace}
+  labels:
+${indent(labels(config), 4)}
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: ${required(database.storageClassName, "database.storageClassName")}
+  resources:
+    requests:
+      storage: ${required(database.storageSize, "database.storageSize")}`);
+docs.push(`apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: unidesk-db-init
+  namespace: ${namespace}
+  labels:
+${indent(labels(config), 4)}
+data:
+  001_unidesk_init.sql: |
+${indent(readFileSync("src/components/database/init/001_unidesk_init.sql", "utf8"), 4)}`);
+docs.push(`apiVersion: v1
+kind: Service
+metadata:
+  name: ${dbService}
+  namespace: ${namespace}
+  labels:
+${indent(labels(config), 4)}
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: database
+  ports:
+    - name: pg
+      port: ${database.port}
+      targetPort: pg`);
+docs.push(`apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: database
+  namespace: ${namespace}
+  labels:
+${indent(labels(config), 4)}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: database
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: database
+        app.kubernetes.io/part-of: unidesk
+      annotations:
+        unidesk.ai/secret-fingerprint: ${yamlScalar(secretFingerprint)}
+        unidesk.ai/runtime-config-fingerprint: ${yamlScalar(runtimeConfigFingerprint)}
+    spec:
+      securityContext:
+        fsGroup: 70
+      containers:
+        - name: postgres
+          image: ${required(images.postgres, "images.postgres")}
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: pg
+              containerPort: ${database.port}
+          env:
+${indent(envFromSecret(secretName, secretKeys.postgresUser, "POSTGRES_USER"), 12)}
+${indent(envFromSecret(secretName, secretKeys.postgresPassword, "POSTGRES_PASSWORD"), 12)}
+${indent(envFromSecret(secretName, secretKeys.postgresDb, "POSTGRES_DB"), 12)}
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+            - name: init
+              mountPath: /docker-entrypoint-initdb.d
+              readOnly: true
+          readinessProbe:
+            exec:
+              command: ["sh", "-ec", "pg_isready -U \\"$POSTGRES_USER\\" -d \\"$POSTGRES_DB\\""]
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 18
+          startupProbe:
+            exec:
+              command: ["sh", "-ec", "pg_isready -U \\"$POSTGRES_USER\\" -d \\"$POSTGRES_DB\\""]
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 60
+${indent(resourceBlock(database.resources), 10)}
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: ${required(database.pvcName, "database.pvcName")}
+        - name: init
+          configMap:
+            name: unidesk-db-init`);
+}
+docs.push(`apiVersion: v1
+kind: Service
+metadata:
+  name: ${required(backend.serviceName, "services.backendCore.serviceName")}
+  namespace: ${namespace}
+  labels:
+${indent(labels(config), 4)}
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: backend-core
+  ports:
+    - name: http
+      port: ${backend.containerPort}
+      targetPort: http
+    - name: provider
+      port: ${backend.providerPort}
+      targetPort: provider
+    - name: provider-data
+      port: ${backend.providerDataPort}
+      targetPort: provider-data`);
+docs.push(`apiVersion: v1
+kind: Service
+metadata:
+  name: ${required(backend.providerPublicServiceName, "services.backendCore.providerPublicServiceName")}
+  namespace: ${namespace}
+  labels:
+${indent(labels(config), 4)}
+spec:
+  type: LoadBalancer
+  selector:
+    app.kubernetes.io/name: backend-core
+  ports:
+    - name: provider
+      port: ${backend.providerPublicPort}
+      targetPort: provider
+    - name: provider-data
+      port: ${backend.providerDataPublicPort}
+      targetPort: provider-data`);
+docs.push(`apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ${required(backend.deploymentName, "services.backendCore.deploymentName")}
+  namespace: ${namespace}
+  labels:
+${indent(labels(config), 4)}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: backend-core
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: backend-core
+        app.kubernetes.io/part-of: unidesk
+      annotations:
+        unidesk.ai/secret-fingerprint: ${yamlScalar(secretFingerprint)}
+        unidesk.ai/runtime-config-fingerprint: ${yamlScalar(runtimeConfigFingerprint)}
+    spec:
+      initContainers:
+        - name: wait-database
+          image: ${required(images.postgres, "images.postgres")}
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: PGHOST
+              value: ${yamlScalar(dbHost)}
+            - name: PGPORT
+              value: ${yamlScalar(dbPort)}
+${indent(envFromSecret(secretName, secretKeys.postgresUser, "PGUSER"), 12)}
+${indent(envFromSecret(secretName, secretKeys.postgresPassword, "PGPASSWORD"), 12)}
+${indent(envFromSecret(secretName, secretKeys.postgresDb, "PGDATABASE"), 12)}
+          command: ["sh", "-ec", "until pg_isready -h \\"$PGHOST\\" -p \\"$PGPORT\\" -U \\"$PGUSER\\" -d \\"$PGDATABASE\\" >/dev/null 2>&1; do sleep 2; done"]
+      containers:
+        - name: backend-core
+          image: ${required(images.backendCore, "images.backendCore")}
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: ${backend.containerPort}
+            - name: provider
+              containerPort: ${backend.providerPort}
+            - name: provider-data
+              containerPort: ${backend.providerDataPort}
+          envFrom:
+            - configMapRef:
+                name: ${runtimeConfigName}
+          env:
+            - name: PORT
+              value: ${yamlScalar(backend.containerPort)}
+            - name: PROVIDER_PORT
+              value: ${yamlScalar(backend.providerPort)}
+            - name: PROVIDER_DATA_PORT
+              value: ${yamlScalar(backend.providerDataPort)}
+${indent(envFromSecret(secretName, secretKeys.databaseUrl, "DATABASE_URL"), 12)}
+${indent(envFromSecret(secretName, secretKeys.providerToken, "PROVIDER_TOKEN"), 12)}
+            - name: LOG_FILE
+              value: ${yamlScalar(required(backend.logFile, "services.backendCore.logFile"))}
+          volumeMounts:
+            - name: logs
+              mountPath: /var/log/unidesk
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: http
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 20
+          startupProbe:
+            httpGet:
+              path: /health
+              port: http
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 60
+${indent(resourceBlock(backend.resources), 10)}
+      volumes:
+        - name: logs
+          emptyDir: {}`);
+docs.push(`apiVersion: v1
+kind: Service
+metadata:
+  name: ${required(frontend.serviceName, "services.frontend.serviceName")}
+  namespace: ${namespace}
+  labels:
+${indent(labels(config), 4)}
+spec:
+  type: LoadBalancer
+  selector:
+    app.kubernetes.io/name: frontend
+  ports:
+    - name: http
+      port: ${frontend.publicPort}
+      targetPort: http`);
+docs.push(`apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ${required(frontend.deploymentName, "services.frontend.deploymentName")}
+  namespace: ${namespace}
+  labels:
+${indent(labels(config), 4)}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: frontend
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: frontend
+        app.kubernetes.io/part-of: unidesk
+      annotations:
+        unidesk.ai/secret-fingerprint: ${yamlScalar(secretFingerprint)}
+        unidesk.ai/runtime-config-fingerprint: ${yamlScalar(runtimeConfigFingerprint)}
+    spec:
+      containers:
+        - name: frontend
+          image: ${required(images.frontend, "images.frontend")}
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: ${frontend.containerPort}
+          envFrom:
+            - configMapRef:
+                name: ${runtimeConfigName}
+          env:
+            - name: PORT
+              value: ${yamlScalar(frontend.containerPort)}
+            - name: CORE_INTERNAL_URL
+              value: ${yamlScalar(`http://${backend.serviceName}.${namespace}.svc.cluster.local:${backend.containerPort}`)}
+            - name: FRONTEND_PUBLIC_URL
+              value: ${yamlScalar(`http://${runtime.publicHost}:${frontend.publicPort}`)}
+            - name: PROVIDER_INGRESS_PUBLIC_URL
+              value: ${yamlScalar(`ws://${runtime.publicHost}:${backend.providerPort}/ws/provider`)}
+${indent(envFromConfig(runtimeConfigName, "AUTH_USERNAME", "AUTH_USERNAME"), 12)}
+${indent(envFromSecret(secretName, secretKeys.authPassword, "AUTH_PASSWORD"), 12)}
+${indent(envFromSecret(secretName, secretKeys.providerToken, "PROVIDER_TOKEN"), 12)}
+${indent(envFromSecret(secretName, secretKeys.sshClientToken, "UNIDESK_SSH_CLIENT_TOKEN"), 12)}
+${indent(envFromSecret(secretName, secretKeys.sessionSecret, "SESSION_SECRET"), 12)}
+            - name: LOG_FILE
+              value: ${yamlScalar(required(frontend.logFile, "services.frontend.logFile"))}
+          volumeMounts:
+            - name: logs
+              mountPath: /var/log/unidesk
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: http
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 20
+          startupProbe:
+            httpGet:
+              path: /health
+              port: http
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 60
+${indent(resourceBlock(frontend.resources), 10)}
+      volumes:
+        - name: logs
+          emptyDir: {}`);
+
+process.stdout.write(`${docs.join("\n---\n")}\n`);