Guía de Despliegue en Kubernetes

echo "--- Prerequisites Check ---"
kubectl version --client -o yaml 2>/dev/null | grep -q gitVersion && echo "PASS: kubectl" || echo "FAIL: kubectl not found"
helm version --short 2>/dev/null | grep -q v3 && echo "PASS: helm v3" || echo "FAIL: helm v3 not found"
kubectl auth can-i create namespaces 2>/dev/null | grep -q yes && echo "PASS: cluster-admin" || echo "FAIL: no cluster-admin"
kubectl get storageclass 2>/dev/null | grep -q default && echo "PASS: default StorageClass" || echo "FAIL: no default StorageClass"
[ -n "$AGENTEYE_TOKEN" ] && echo "PASS: AGENTEYE_TOKEN set" || echo "FAIL: AGENTEYE_TOKEN not set"
openssl version >/dev/null 2>&1 && echo "PASS: openssl" || echo "FAIL: openssl not found"
echo "---"

git clone https://x:${AGENTEYE_TOKEN}@github.com/agenteye-enterprise/releases.git
cd releases/deploy

ls base/kustomization.yaml

deploy/
  base/           Base compartida de Kustomize (todos los recursos K8s)
  overlays/       Sobreescrituras específicas del clúster (etiquetas de imagen, nombres de host, recursos)
  third-party/    Valores de Helm para Traefik, cert-manager y (opcional) monitorización de salud con Robusta

helm repo add jetstack https://charts.jetstack.io
helm repo update

helm install cert-manager jetstack/cert-manager \
  --namespace cert-manager --create-namespace \
  --set crds.install=true

kubectl get pods -n cert-manager

kubectl get crds | grep cert-manager

helm repo add traefik https://traefik.github.io/charts
helm repo update

helm install traefik-public traefik/traefik \
  --namespace traefik-public --create-namespace \
  --version 39.0.8 \
  -f third-party/traefik/values-public.yaml

kubectl get pods -n traefik-public

kubectl get ingressclass traefik-public

service:
  loadBalancerSourceRanges:
    - "<TU_IP_VPN>/32"

service:
  loadBalancerSourceRanges:
    - "203.0.113.10/32"       # puerta de enlace de la oficina
    - "203.0.113.11/32"       # puerta de enlace de oficina de respaldo
    - "198.51.100.0/24"       # pool de VPN
    - "192.0.2.50/32"         # IP doméstica del ingeniero de guardia

kubectl patch svc traefik-dashboard -n traefik-dashboard \
  -p '{"spec":{"loadBalancerSourceRanges":["203.0.113.10/32","198.51.100.0/24","192.0.2.50/32"]}}'

# 1. Muestra la lista de permitidos actual
kubectl get svc traefik-dashboard -n traefik-dashboard \
  -o jsonpath='{.spec.loadBalancerSourceRanges}'

# 2. Aplica el parche con la lista completa incluyendo la nueva IP
kubectl patch svc traefik-dashboard -n traefik-dashboard \
  -p '{"spec":{"loadBalancerSourceRanges":["<IP_EXISTENTE_1>/32","<IP_EXISTENTE_2>/32","<NUEVA_IP>/32"]}}'

helm install traefik-dashboard traefik/traefik \
  --namespace traefik-dashboard --create-namespace \
  --version 39.0.8 \
  -f third-party/traefik/values-dashboard.yaml

kubectl get pods -n traefik-dashboard

kubectl get ingressclass traefik-dashboard

kubectl get svc -n traefik-public
kubectl get svc -n traefik-dashboard

kubectl get svc -n traefik-public -w

kubectl create namespace agenteye

kubectl get namespace agenteye

kubectl create secret docker-registry agenteye-image-pull \
  --namespace agenteye \
  --docker-server=ghcr.io \
  --docker-username=agenteye-enterprise \
  --docker-password="${AGENTEYE_TOKEN}"

kubectl get secret agenteye-image-pull -n agenteye -o jsonpath='{.type}'

kubectl run test-pull \
  --image=ghcr.io/agenteye-enterprise/server:v0.0.1-beta.48 \
  --overrides='{"spec":{"imagePullSecrets":[{"name":"agenteye-image-pull"}]}}' \
  --restart=Never -n agenteye --command -- echo ok

# Espera unos segundos para la descarga y luego:
kubectl logs test-pull -n agenteye
kubectl delete pod test-pull -n agenteye

POSTGRES_PASSWORD=$(openssl rand -hex 24)

kubectl create secret generic agenteye-postgres \
  --namespace agenteye \
  --from-literal=POSTGRES_USER=postgres \
  --from-literal=POSTGRES_PASSWORD="${POSTGRES_PASSWORD}" \
  --from-literal=POSTGRES_DB=agenteye

kubectl get secret agenteye-postgres -n agenteye

kubectl get secret agenteye-postgres -n agenteye \
  -o jsonpath='{.data.POSTGRES_PASSWORD}' | base64 -d | wc -c

ADMIN_KEY=$(openssl rand -hex 32)

kubectl create secret generic agenteye-admin-key \
  --namespace agenteye \
  --from-literal=ADMIN_KEY="${ADMIN_KEY}"

kubectl get secret agenteye-admin-key -n agenteye

kubectl create secret generic agenteye-auth \
  --namespace agenteye \
  --from-literal=ADMIN_EMAIL="admin@tuempresa.com" \
  --from-literal=ALLOWED_EMAILS="*@tuempresa.com" \
  --from-literal=SMTP_HOST="smtp.tuproveedor.com" \
  --from-literal=SMTP_PORT="587" \
  --from-literal=SMTP_USERNAME="tu-usuario-smtp" \
  --from-literal=SMTP_PASSWORD="tu-contraseña-smtp" \
  --from-literal=SMTP_FROM="noreply@tuempresa.com" \
  --from-literal=SMTP_TLS="starttls" \
  --from-literal=DEFAULT_ORG_NAME="Acme Corp" \
  --from-literal=DEFAULT_ORG_SLUG="acme"

kubectl get secret agenteye-auth -n agenteye \
  -o jsonpath='{.data}' | grep -o '"[A-Z_]*"' | sort -u

kubectl create secret generic agenteye-org-ch-secret \
  --namespace agenteye \
  --from-literal=ORG_CH_SECRET="$(openssl rand -base64 48)"

# Reinicia el servidor para que recoja el nuevo valor.
kubectl -n agenteye rollout restart deployment/server

kubectl get secrets -n agenteye -o custom-columns='NAME:.metadata.name,TYPE:.type'

NAME                    TYPE
agenteye-admin-key      Opaque
agenteye-auth           Opaque
agenteye-image-pull     kubernetes.io/dockerconfigjson
agenteye-postgres       Opaque
agenteye-org-ch-secret  Opaque   # solo si completaste §2.6 (multi-tenant)

cp base/certificates/domain.env.example base/certificates/domain.env
# Edita base/certificates/domain.env y configura:
#   INGEST_DOMAIN=ingest.tu-empresa.example      (resuelve al LB público de Traefik)
#   DASHBOARD_DOMAIN=agenteye.tu-empresa.example (resuelve al LB de Traefik del panel)

kubectl apply -k base/
# o
kubectl apply -k overlays/<tu-entorno>/

kubectl wait --for=condition=Ready pod -l 'app in (server,dashboard,postgres,clickhouse)' \
  -n agenteye --timeout=180s

kubectl get pods -n agenteye

NAME                         READY   STATUS    RESTARTS   AGE
agent-xxxxxxxxxx-xxxxx       1/1     Running   0          ...
clickhouse-0                 1/1     Running   0          ...
dashboard-xxxxxxxxxx-xxxxx   1/1     Running   0          ...
dashboard-xxxxxxxxxx-xxxxx   1/1     Running   0          ...
postgres-0                   1/1     Running   0          ...
redis-0                      1/1     Running   0          ...
server-xxxxxxxxxx-xxxxx      1/1     Running   0          ...
server-xxxxxxxxxx-xxxxx      1/1     Running   0          ...

kubectl get pvc -n agenteye

kubectl get certificates -n agenteye

kubectl get cronjobs -n agenteye

kubectl logs -n agenteye -l app=server --tail=20

kubectl logs -n agenteye -l app=dashboard --tail=20

PUBLIC_IP=$(kubectl get svc -n traefik-public \
  -o jsonpath='{.items[0].status.loadBalancer.ingress[0].ip}')

INTERNAL_IP=$(kubectl get svc -n traefik-dashboard \
  -o jsonpath='{.items[0].status.loadBalancer.ingress[0].ip}')

echo "Público  (ingestión):    $PUBLIC_IP"
echo "Interno  (panel):        $INTERNAL_IP"

dig +short ingest.tu-empresa.example
dig +short agenteye.tu-empresa.example

curl -s --cert issued/<nombre-clúster>/client.crt \
        --key issued/<nombre-clúster>/client.key \
        https://ingest.tu-empresa.example/health

curl -s https://agenteye.tu-empresa.example/ -o /dev/null -w '%{http_code}\n'

cd base/certificates/client-certs
./issue-client-cert.sh <nombre-clúster>

kubectl get certificate mtls-client-<nombre-clúster> -n agenteye

cd base/certificates/client-certs
export AWS_REGION=us-east-1     # región donde se ejecuta tu carga de trabajo
./issue-client-cert.sh <nombre-clúster> --save-to aws-secrets-manager

curl -sk --cert issued/<nombre-clúster>/client.crt \
     --key issued/<nombre-clúster>/client.key \
     https://${PUBLIC_IP}/health

kubectl apply -f collector-mtls-secret.yaml -n <namespace-colector>

{
  "tls_cert": "/etc/agenteye/tls/client.crt",
  "tls_key": "/etc/agenteye/tls/client.key"
}

kubectl get secret agenteye-collector-mtls -n <namespace-colector>

kubectl delete certificate mtls-client-<nombre-clúster> -n agenteye

kubectl create secret generic cert-renewal-notify-config \
  --namespace agenteye \
  --from-literal=SLACK_WEBHOOK_URL="https://hooks.slack.com/services/TU/WEBHOOK/URL"

kubectl get secret cert-renewal-notify-config -n agenteye

kubectl create job --from=cronjob/cert-renewal-check test-cert-check -n agenteye

kubectl wait --for=condition=Complete job/test-cert-check -n agenteye --timeout=60s

kubectl logs -n agenteye -l job-name=test-cert-check

kubectl delete job test-cert-check -n agenteye

curl -sk --cert issued/<nombre-clúster>/client.crt \
        --key issued/<nombre-clúster>/client.key \
        https://${PUBLIC_IP}/health

COLLECTOR_KEY=$(openssl rand -hex 32)

curl -sk -X POST https://${PUBLIC_IP}/keys \
  --cert issued/<nombre-clúster>/client.crt \
  --key issued/<nombre-clúster>/client.key \
  -H "Authorization: Bearer ${ADMIN_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "prod-collector",
    "key": "'"${COLLECTOR_KEY}"'",
    "permissions": ["events:add"]
  }'

curl -sk https://${PUBLIC_IP}/keys \
  --cert issued/<nombre-clúster>/client.crt \
  --key issued/<nombre-clúster>/client.key \
  -H "Authorization: Bearer ${ADMIN_KEY}"

echo '{"session_id":"test","agent_id":"smoke-test","type":"test","timestamp":"2026-04-20T00:00:00Z"}' \
  | curl -sk --cert issued/<nombre-clúster>/client.crt \
         --key issued/<nombre-clúster>/client.key \
         -H "Authorization: Bearer ${COLLECTOR_KEY}" \
         -H "Content-Type: application/x-ndjson" \
         --data-binary @- \
         https://${PUBLIC_IP}/events

kubectl create job --from=cronjob/agenteye-backup test-backup -n agenteye

kubectl wait --for=condition=Complete job/test-backup -n agenteye --timeout=300s

kubectl logs -n agenteye -l job-name=test-backup

kubectl delete job test-backup -n agenteye

kubectl -n agenteye exec deploy/server -- \
  agenteye-orgctl org create --slug acme --name "Acme Corp"

kubectl -n agenteye exec deploy/server -- \
  agenteye-orgctl member add --org acme --email alice@acme.example --set admin

postgres.sql        # pg_dump de la base de datos relacional
events.sql          # DDL de la tabla events de ClickHouse
events.native       # Datos de la tabla events de ClickHouse (formato Native)
evaluations.sql     # DDL de la tabla evaluations de ClickHouse
evaluations.native  # Datos de la tabla evaluations de ClickHouse