panxiao81
746d326292
Merge pull request '同步 iam-admin-ui 登记为 audience + groups 模型' ( #177 ) from docs/iam-console-audience into main
...
Reviewed-on: #177
2026-10-01 17:29:34 +00:00
panxiao81 and Claude Opus 5.5
4a6b5c8a1d
同步 iam-admin-ui 登记为 audience + groups 模型
...
iam-login 客户端管理 API 改为校验 audience 与 groups，iam-admin-ui
相应登记为 scope openid groups 与 audience iam-login。
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-10-01 17:28:26 +00:00
panxiao81
6e4deb2d42
Merge pull request '修正共享 PG 计数器告警在新序列上的误报' ( #174 ) from fix/shared-pg-sql-counter-new-series into main
...
yaml / yaml (push) Successful in 41s
Reviewed-on: #174
2026-10-01 16:46:02 +00:00
panxiao81
7f64c5d2b9
Merge pull request 'Hydra 为 iam-login /console 开启 CORS' ( #175 ) from feat/iam-console-cors into main
...
yaml / yaml (push) Successful in 23s
Reviewed-on: #175
2026-10-01 16:45:43 +00:00
panxiao81 and Claude Opus 5.5
5fd00be136
Hydra 为 iam-login /console 开启 CORS 并记录管理客户端登记
...
yaml / yaml (pull_request) Successful in 21s
iam-login 的 /console 是 Hydra public 客户端，浏览器直接向 Hydra
换取 token，因此 public 端口开启 CORS，只放行开发实例 origin，不放行
cookie 凭据；Gitea 等服务端客户端不受影响。README 记录 iam-admin-ui
经 Admin 带外登记的方法。
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-10-01 16:42:07 +00:00
panxiao81 and Claude Opus 5.5
2b382e1579
修正共享 PG 计数器告警在新序列上的误报
...
yaml / yaml (pull_request) Successful in 31s
MetricsQL 的 increase() 把新序列首个样本视为从 0 增长：#173 合并后 exporter
首次被抓取，laptop 上 2026-09-25 搭建期累计的 9 次归档失败被当成刚发生，
触发 SharedPostgresWalArchiveFailing。归档本身正常（切换后 .partial 已归档）。
归档失败、死锁、checkpoint 三条改为与 offset 相减：新序列返回空，
计数器重置得负值也不告警。promtool 按 Prometheus 语义执行，测不出这一差异，
新表达式已在 VictoriaMetrics 现网数据上核对为空；补充新序列与重置回归场景。
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-10-01 16:41:04 +00:00
panxiao81
2c7dd224cf
Merge pull request '新增共享 PG 的 SQL 级指标与 dev 告警分流' ( #173 ) from feat/shared-pg-sql-metrics into main
...
yaml / yaml (push) Successful in 2m44s
ansible / collection-test (push) Successful in 4m51s
ansible / lint (push) Successful in 4m53s
Reviewed-on: #173
2026-10-01 16:33:05 +00:00
panxiao81 and Claude Opus 5.5
943d31bf08
新增主库落在 pve1（HDD）时的回切提示告警
...
yaml / yaml (pull_request) Successful in 2m25s
ansible / lint (pull_request) Successful in 4m3s
ansible / collection-test (pull_request) Successful in 4m12s
自动切换后主库安全落到 pve1 不会触发无主/多主规则；2026-09-30 的切换一天无人察觉。
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-10-01 16:30:45 +00:00
panxiao81 and Claude Opus 5.5
954bb39a23
docs: 记录共享 PG SQL 级指标的部署与验证
...
ansible / collection-test (pull_request) Successful in 9m52s
yaml / yaml (pull_request) Failing after 10m40s
ansible / lint (pull_request) Successful in 12m38s
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-10-01 16:20:16 +00:00
panxiao81 and Claude Opus 5.5
549f82810e
修正 Patroni 已接收配置的判断：重启前预加载库行带 error 属预期
...
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-10-01 16:20:16 +00:00
panxiao81 and Claude Opus 5.5
567b42ed13
修正 monitoring.yml 的 check 模式与 Patroni pending 判断
...
只读探测在 check 模式下照常执行；依赖真实执行结果的等待与验证在 check 模式跳过。
patronictl JSON 会省略空值字段，pending 判断先检查键是否存在。
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-10-01 16:20:15 +00:00
panxiao81 and Claude Opus 5.5
0cd4a67e12
新增共享 PG 的 SQL 级指标与 dev 告警分流
...
- 数据库主机上按实例运行 prometheus-community/postgres_exporter 0.20.1，
以实例 OS 用户走本地 socket，经 peer + ident 映射到仅有 pg_monitor 的
homelab_monitor 角色；无密码、不经 Bao。版本与官方 sha256sums.txt 同源。
- prod/dev 启用 pg_stat_statements；monitoring.yml 仅在未生效时 reload/重启
（prod 走 Patroni pending restart），重复执行 changed=0。
- 告警以上游 postgres_mixin 为底改写为 PrometheusRule，阈值对齐 Patroni
failover lag 与 max_slot_wal_keep_size；抓取目标带 env 标签。
- Alertmanager 新增 env="dev" 路由到独立 dev 频道，dev SQL 检查告警补 env。
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-10-01 16:20:15 +00:00
panxiao81
186a0cb582
Merge pull request 'Backstage 通过 Flux image automation 自动部署 latest' ( #172 ) from feat/backstage-image-automation into main
yaml / yaml (push) Successful in 30s
2026-10-01 16:06:35 +00:00
panxiao81 and Claude Opus 5.5
7f5bef829f
feat: deploy backstage latest via Flux image automation
...
yaml / yaml (pull_request) Successful in 23s
Install image-reflector and image-automation controllers, track the digest
behind backstage:latest, and let flux-bot commit digest updates to main.
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-10-01 16:05:13 +00:00
panxiao81
53e2854993
Merge pull request '将 Hydra 实验登录接至 Spring IAM 开发实例' ( #168 ) from feat/iam-login-hydra-acceptance into main
...
yaml / yaml (push) Successful in 20s
Reviewed-on: #168
2026-10-01 14:40:20 +00:00
panxiao81
39768b2ace
Merge pull request #171 : 部署修复后的 Backstage 事件总线镜像
yaml / yaml (push) Successful in 19s
2026-09-29 16:31:37 +00:00
panxiao81
d5a191b7d7
deploy: upgrade fixed Backstage event bus image
yaml / yaml (pull_request) Successful in 14s
2026-09-29 16:31:22 +00:00
panxiao81
6b969b1c81
Merge pull request #170 : 回退 Backstage externalAccess 配置错误镜像
yaml / yaml (push) Successful in 41s
2026-09-29 16:00:38 +00:00
panxiao81
fdad8ebc3d
fix: rollback Backstage external access config
yaml / yaml (pull_request) Successful in 35s
2026-09-29 16:00:24 +00:00
panxiao81
5ea0e20897
Merge pull request #169 : 升级 Backstage 事件总线镜像
yaml / yaml (push) Successful in 32s
2026-09-29 15:57:49 +00:00
panxiao81
37cbc51629
deploy: upgrade Backstage event bus image
yaml / yaml (pull_request) Successful in 18s
2026-09-29 15:57:24 +00:00
panxiao81
61674df541
将 Hydra 实验登录回调接至 Spring IAM 开发实例
yaml / yaml (pull_request) Successful in 26s
2026-09-29 15:45:21 +00:00
panxiao81
78a73d80aa
revert: 撤回超出数据库任务范围的 Ayatori 接入文档修改
2026-09-27 18:02:49 +00:00
panxiao81
b6c6287ae3
docs: 明确数据库环境隔离交付与控制面职责边界
2026-09-27 17:58:27 +00:00
panxiao81
7da5bc1181
docs: 记录共享数据维护告警 GitOps 接管结果
2026-09-27 17:38:13 +00:00
panxiao81
589c34ee60
Merge pull request '补齐共享 etcd/PG 的备份、证书续签及 dev 健康告警' ( #166 ) from feat/shared-pg-health into main
...
yaml / yaml (push) Successful in 56s
ansible / collection-test (push) Successful in 2m16s
ansible / lint (push) Successful in 2m52s
Reviewed-on: #166
2026-09-27 17:35:27 +00:00
panxiao81
396109d462
docs: 明确 exporter 升级方式与 PrometheusRule 声明
2026-09-27 17:29:49 +00:00
panxiao81
0d633cf0cc
fix: 使用 PrometheusRule 并按 exporter 版本获取官方校验和
yaml / yaml (pull_request) Successful in 51s
ansible / collection-test (pull_request) Successful in 2m28s
ansible / lint (pull_request) Successful in 4m5s
2026-09-27 17:29:40 +00:00
panxiao81
26a8ffed83
docs: 补充共享数据维护监控与告警排障
2026-09-27 17:07:34 +00:00
panxiao81
0988f5c37e
feat: 补齐共享数据备份、证书续签与开发实例监控
yaml / yaml (pull_request) Successful in 27s
ansible / collection-test (pull_request) Successful in 1m59s
ansible / lint (pull_request) Successful in 3m14s
2026-09-27 17:05:24 +00:00
panxiao81
06943d4c65
将 laptop ZFS ARC 预算限制为 4 GiB
...
yaml / yaml (push) Successful in 25s
Co-authored-by: panxiao81 <[email protected]
2026-09-27 03:31:25 +00:00
panxiao81
f5c8c09f96
允许 Envoy 后端协商 TLS 1.3 以接入 Incus
...
yaml / yaml (push) Successful in 2m45s
Co-authored-by: panxiao81 <[email protected]
2026-09-25 21:12:10 +00:00
panxiao81
7137426e8f
补齐 OpenBao 内部健康与快照新鲜度告警
...
yaml / yaml (push) Successful in 1m28s
ansible / collection-test (push) Successful in 2m27s
ansible / lint (push) Successful in 8m18s
Co-authored-by: panxiao81 <[email protected]
2026-09-25 20:59:36 +00:00
panxiao81
834f654941
接入 OpenBao 受鉴权监控并修复快照续期 ( #162 )
...
yaml / yaml (push) Successful in 35s
terraform / validate (push) Successful in 1m43s
ansible / collection-test (push) Successful in 1m55s
ansible / lint (push) Successful in 2m48s
Co-authored-by: panxiao81 <[email protected]
2026-09-25 20:39:31 +00:00
panxiao81
52322116f9
docs: 确认共享数据库监控由 Flux 接管
2026-09-25 19:51:35 +00:00
panxiao81
f6d12d673a
Merge pull request '纳管共享 etcd 与 k3s 外 PostgreSQL 高可用、备份及 Ayatori 接入声明' ( #159 ) from feat/shared-postgresql-etcd into main
...
yaml / yaml (push) Failing after 13m25s
ansible / collection-test (push) Failing after 13m36s
terraform / validate (push) Successful in 13m21s
ansible / lint (push) Successful in 18m35s
Reviewed-on: #159
2026-09-25 19:48:49 +00:00
panxiao81
67d4869c88
merge: 合入 main 并保留两侧监控资源声明
ansible / collection-test (pull_request) Successful in 13m2s
yaml / yaml (pull_request) Successful in 13m2s
terraform / validate (pull_request) Failing after 14m25s
ansible / lint (pull_request) Successful in 15m50s
2026-09-25 19:47:41 +00:00
panxiao81
655ca567ba
避免 OCI HelmRepository 无 Ready 条件误报 ( #161 )
...
yaml / yaml (push) Successful in 43s
Co-authored-by: panxiao81 <[email protected]
2026-09-25 19:39:47 +00:00
panxiao81
b75043cb45
补齐证书、秘密同步、GitOps 与数据服务监控 ( #160 )
...
yaml / yaml (push) Successful in 2m53s
Co-authored-by: panxiao81 <[email protected]
2026-09-25 19:36:30 +00:00
panxiao81
3a2fe5fa0c
feat: 纳管共享 etcd 与 k3s 外 PostgreSQL 高可用及备份
yaml / yaml (pull_request) Successful in 41s
ansible / collection-test (pull_request) Successful in 2m41s
terraform / validate (pull_request) Successful in 2m41s
ansible / lint (pull_request) Successful in 4m36s
2026-09-25 19:34:48 +00:00
panxiao81
acd4b55722
docs: 记录共享 etcd 与外置 PostgreSQL 部署和接入边界
2026-09-25 19:31:14 +00:00
panxiao81
235288189d
Merge 更新 OpenSandbox Pool runner 镜像
yaml / yaml (push) Successful in 23s
2026-09-25 19:29:32 +00:00
panxiao81
15676a6a06
fix: 更新 OpenSandbox Pool runner 镜像
yaml / yaml (pull_request) Successful in 29s
2026-09-25 19:27:59 +00:00
panxiao81
18ded1e4a8
Merge 原子部署解耦后的 dynamic runner 镜像
yaml / yaml (push) Successful in 4m32s
2026-09-25 19:12:07 +00:00
panxiao81
ca0862fe5a
fix: 原子部署解耦后的 controller 与 runner
yaml / yaml (pull_request) Failing after 10m54s
2026-09-25 19:11:39 +00:00
panxiao81
a729f01546
Merge 部署修复后的 dynamic runner placement v2
yaml / yaml (push) Successful in 17s
2026-09-25 18:54:41 +00:00
panxiao81
bbcd5d6aa5
fix: 部署合法 consumer 名称的 placement v2
yaml / yaml (pull_request) Successful in 20s
2026-09-25 18:53:23 +00:00
panxiao81
c0c4ff521b
Merge pull request '部署 dynamic runner placement v2' ( #154 ) from deploy/workload-placement-v2 into main
...
yaml / yaml (push) Successful in 31s
Reviewed-on: #154
2026-09-25 18:37:40 +00:00
panxiao81
8bc039b40f
Merge pull request #155 : 授予 Backstage Kubernetes 只读观察权限
yaml / yaml (push) Successful in 27s
2026-09-25 18:33:32 +00:00
panxiao81
349aa77fb0
ops: 暂停 placement v2 自动 rollout
yaml / yaml (pull_request) Successful in 50s
2026-09-25 18:30:55 +00:00
panxiao81
cae6acbfb0
feat: 授予 Backstage Kubernetes 只读观察权限
yaml / yaml (pull_request) Successful in 43s
2026-09-25 18:30:42 +00:00
panxiao81
4d80f8efd7
deploy: 切换 dynamic runner placement v2
yaml / yaml (pull_request) Successful in 42s
2026-09-25 18:11:05 +00:00
panxiao81
9009e3fa11
启用 Backstage 显式目录位置 ( #153 )
yaml / yaml (push) Successful in 49s
2026-09-25 18:07:37 +00:00
panxiao81
a252ee5602
fix: 启用 Backstage 显式目录位置
yaml / yaml (pull_request) Successful in 47s
2026-09-25 18:06:59 +00:00
panxiao81
dbf66590ac
修复告警 Source 链接并接入 Grafana Alertmanager 数据源 ( #152 )
...
yaml / yaml (push) Successful in 51s
Co-authored-by: panxiao81 <[email protected]
2026-09-25 18:02:14 +00:00
panxiao81
e8e7bd4b20
优先使用 PrometheusRule 声明基础告警 ( #151 )
...
yaml / yaml (push) Successful in 51s
Co-authored-by: panxiao81 <[email protected]
2026-09-25 17:53:07 +00:00
panxiao81
185e3edaba
修复 Backstage 首次启动 ( #150 )
yaml / yaml (push) Successful in 1m13s
2026-09-25 17:47:34 +00:00
panxiao81
072936ce03
fix: 修正 Backstage 数据库模式与健康探针
yaml / yaml (pull_request) Successful in 54s
2026-09-25 17:46:49 +00:00
panxiao81
39aeac25ee
补齐集群状态、主机与通知链路基础监控 ( #149 )
...
yaml / yaml (push) Successful in 1m10s
Co-authored-by: panxiao81 <[email protected]
2026-09-25 17:45:56 +00:00
panxiao81
a43b7d3c26
修复 kubelet 超限与旧 Docker 采集目标 ( #148 )
...
yaml / yaml (push) Failing after 10m32s
Co-authored-by: panxiao81 <[email protected]
2026-09-25 17:22:01 +00:00
panxiao81
c06c6f7857
启用 Alertmanager Telegram 频道告警 ( #147 )
...
yaml / yaml (push) Successful in 39s
Co-authored-by: panxiao81 <[email protected]
2026-09-25 17:10:30 +00:00
panxiao81
6a27adc18d
部署 Backstage 门户第一版 ( #146 )
yaml / yaml (push) Successful in 51s
2026-09-25 17:08:01 +00:00
panxiao81
29b3bdeeb1
feat: 部署 Backstage 门户第一版
yaml / yaml (pull_request) Successful in 22s
2026-09-25 16:09:23 +00:00
panxiao81
7a62dde601
Merge pull request '为 Backstage 镜像仓库配置 SPIFFE 发布权限' ( #145 ) from feat/zot-backstage-access into main
...
yaml / yaml (push) Successful in 25s
Reviewed-on: #145
2026-09-25 15:26:38 +00:00
panxiao81
521a49599a
为 Backstage 镜像仓库配置 SPIFFE 发布权限
yaml / yaml (pull_request) Successful in 30s
2026-09-25 15:23:56 +00:00
panxiao81
185a47e2bb
合并 zot 本地维护身份删除权限修正
yaml / yaml (push) Successful in 25s
2026-09-25 14:53:58 +00:00
panxiao81
8dabbdce68
修复 zot 本地维护身份在 CI 镜像仓库的删除权限
yaml / yaml (pull_request) Successful in 25s
2026-09-25 14:52:14 +00:00
panxiao81
d5b1bb9640
为 Gitea 添加 Hydra OIDC 登录入口
yaml / yaml (push) Successful in 25s
2026-09-25 13:56:23 +00:00
panxiao81
cfb2fddfa9
feat: 为 Gitea 添加 Hydra OIDC 登录入口
yaml / yaml (pull_request) Successful in 17s
2026-09-25 13:55:03 +00:00
panxiao81
7f218531ed
部署 Hydra 与通用 OIDC 登录适配器
yaml / yaml (push) Successful in 30s
ansible / collection-test (push) Successful in 1m38s
ansible / lint (push) Successful in 3m13s
2026-09-25 13:54:11 +00:00
panxiao81
8f3d1ed04a
fix: 使用非 root runner 的 Ansible collections 目录
yaml / yaml (pull_request) Successful in 1m50s
ansible / collection-test (pull_request) Successful in 4m16s
hydra-login / verify (pull_request) Successful in 4m16s
ansible / lint (pull_request) Successful in 4m38s
2026-09-25 13:48:39 +00:00
panxiao81
5435d7d2d5
feat: 部署 Hydra 与通用 OIDC 登录适配器
ansible / lint (pull_request) Failing after 4m34s
hydra-login / verify (pull_request) Successful in 6m9s
ansible / collection-test (pull_request) Successful in 8m24s
2026-09-25 13:42:39 +00:00
panxiao81
e325a703dd
Merge 部署内置 SPIRE CLI 的 runner 镜像
yaml / yaml (push) Successful in 16s
2026-09-24 07:29:53 +00:00
panxiao81
130849040c
chore(runner): 部署内置 SPIRE CLI 镜像
yaml / yaml (pull_request) Successful in 22s
2026-09-24 07:29:36 +00:00
panxiao81
bcd034355e
Merge 部署 runner 工作目录修复镜像
yaml / yaml (push) Failing after 8s
2026-09-24 06:57:48 +00:00
panxiao81
506e0cb983
chore(runner): 部署工作目录修复镜像
yaml / yaml (pull_request) Failing after 8s
2026-09-24 06:57:30 +00:00
panxiao81
c07709e078
Merge 为 OpenSandbox runner 挂载独立工作目录
yaml / yaml (push) Failing after 8s
2026-09-24 06:29:37 +00:00
panxiao81
e1979ebbb8
fix(runner): 挂载独立工作目录
yaml / yaml (pull_request) Failing after 7s
2026-09-24 06:29:02 +00:00
panxiao81
b02b2aec96
Merge 滚动部署最终 Docker runner 镜像
yaml / yaml (push) Successful in 18s
2026-09-24 06:12:24 +00:00
panxiao81
ff92037a28
chore(runner): 滚动部署最终 Docker 运行环境镜像
yaml / yaml (pull_request) Successful in 19s
2026-09-24 06:11:49 +00:00
panxiao81
9360eb2ea0
Merge 自动 Docker runner 镜像 rollout
yaml / yaml (push) Successful in 19s
2026-09-21 17:43:19 +00:00
panxiao81
0c7eb371e5
chore: rollout job-local Docker runner image
yaml / yaml (pull_request) Successful in 28s
2026-09-21 17:40:12 +00:00
panxiao81
757c21fc0b
Merge pull request 'feat: 启用生产 VM runner 标签' ( #136 ) from rollout/vm-runner-production into main
...
yaml / yaml (push) Successful in 12s
Reviewed-on: #136
2026-09-21 15:23:31 +00:00
panxiao81
c8e163f01e
feat: 启用生产 VM runner 标签
yaml / yaml (pull_request) Successful in 21s
2026-09-21 15:22:36 +00:00
panxiao81
59fe28faa5
Merge Kata kind executor 最低资源配置
yaml / yaml (push) Successful in 20s
2026-09-21 12:36:20 +00:00
panxiao81
69c90b9fdf
fix: 为 Kata kind executor 配置最低资源
yaml / yaml (pull_request) Successful in 19s
2026-09-21 12:33:35 +00:00
panxiao81
a6a861cc7e
Merge 统一 Pod 与 VM executor 运行模型
yaml / yaml (push) Successful in 19s
2026-09-21 12:06:02 +00:00
panxiao81
5c9a09edde
refactor: 统一 Pod 与 VM executor 运行模型
yaml / yaml (pull_request) Successful in 31s
2026-09-21 12:01:55 +00:00
panxiao81
cfb9c2d150
Merge Kata DinD guest ext4 存储修复
yaml / yaml (push) Successful in 16s
2026-09-21 11:50:26 +00:00
panxiao81
1ddec34149
fix: 为 Kata DinD 使用 guest ext4 数据盘
yaml / yaml (pull_request) Successful in 21s
2026-09-21 11:48:57 +00:00
panxiao81
db63503ec9
Merge Kata kind 资源规格
yaml / yaml (push) Successful in 16s
2026-09-21 11:34:00 +00:00
panxiao81
9953fae93d
fix: 为 Kata kind 任务分配明确资源
yaml / yaml (pull_request) Successful in 25s
2026-09-21 11:31:57 +00:00
panxiao81
56598d6c84
Merge Kata DinD cgroup nesting 修复
yaml / yaml (push) Successful in 16s
2026-09-21 11:16:48 +00:00
panxiao81
834fdcb771
fix: 恢复 Kata DinD cgroup 初始化
yaml / yaml (pull_request) Successful in 17s
2026-09-21 11:14:52 +00:00
panxiao81
47ff73cefb
Merge pull request '彻底删除旧静态 Gitea Runner' ( #130 ) from retire/static-gitea-runner-phase2 into main
yaml / yaml (push) Successful in 19s
2026-09-21 10:23:05 +00:00
panxiao81
bb24c76704
chore: 删除旧静态 Gitea Runner
yaml / yaml (pull_request) Successful in 18s
2026-09-21 10:21:33 +00:00
panxiao81
b0791e4095
Merge pull request '退役旧静态 Gitea Runner（第一阶段）' ( #129 ) from retire/static-gitea-runner-phase1 into main
yaml / yaml (push) Successful in 19s
2026-09-21 10:18:44 +00:00
panxiao81
26179f700f
chore: 开始退役旧静态 Gitea Runner
yaml / yaml (pull_request) Successful in 16s
2026-09-21 10:17:06 +00:00
panxiao81
1ac99f4476
Merge pull request '部署 Runner 结构化生命周期日志' ( #128 ) from deploy/structured-runner-logs into main
yaml / yaml (push) Successful in 23s
2026-09-21 09:46:47 +00:00
panxiao81
891c6b90e7
deploy: 更新 Runner 结构化日志镜像
yaml / yaml (pull_request) Successful in 21s
2026-09-21 09:45:33 +00:00
panxiao81
