Kubernetes deployment

echo "--- Prerequisites Check ---"
kubectl version --client -o yaml 2>/dev/null | grep -q gitVersion && echo "PASS: kubectl" || echo "FAIL: kubectl not found"
helm version --short 2>/dev/null | grep -q v3 && echo "PASS: helm v3" || echo "FAIL: helm v3 not found"
kubectl auth can-i create namespaces 2>/dev/null | grep -q yes && echo "PASS: cluster-admin" || echo "FAIL: no cluster-admin"
kubectl get storageclass 2>/dev/null | grep -q default && echo "PASS: default StorageClass" || echo "FAIL: no default StorageClass"
[ -n "$AGENTEYE_TOKEN" ] && echo "PASS: AGENTEYE_TOKEN set" || echo "FAIL: AGENTEYE_TOKEN not set"
openssl version >/dev/null 2>&1 && echo "PASS: openssl" || echo "FAIL: openssl not found"
echo "---"

git clone https://x:${AGENTEYE_TOKEN}@github.com/agenteye-enterprise/releases.git
cd releases/deploy

ls base/kustomization.yaml

deploy/
  base/           Cơ sở Kustomize chia sẻ (tất cả tài nguyên K8s)
  overlays/       Ghi đè cụ thể cụm (thẻ hình ảnh, tên máy chủ, tài nguyên)
  third-party/    Giá trị Helm cho Traefik, cert-manager và (tùy chọn) giám sát sức khỏe Robusta

helm repo add jetstack https://charts.jetstack.io
helm repo update

helm install cert-manager jetstack/cert-manager \
  --namespace cert-manager --create-namespace \
  --set crds.install=true

kubectl get pods -n cert-manager

kubectl get crds | grep cert-manager

helm repo add traefik https://traefik.github.io/charts
helm repo update

helm install traefik-public traefik/traefik \
  --namespace traefik-public --create-namespace \
  --version 39.0.8 \
  -f third-party/traefik/values-public.yaml

kubectl get pods -n traefik-public

kubectl get ingressclass traefik-public

service:
  loadBalancerSourceRanges:
    - "<YOUR_VPN_IP>/32"

service:
  loadBalancerSourceRanges:
    - "203.0.113.10/32"       # cổng văn phòng
    - "203.0.113.11/32"       # cổng văn phòng dự phòng
    - "198.51.100.0/24"       # bộ VPN
    - "192.0.2.50/32"         # IP nhà kỹ sư trực

kubectl patch svc traefik-dashboard -n traefik-dashboard \
  -p '{"spec":{"loadBalancerSourceRanges":["203.0.113.10/32","198.51.100.0/24","192.0.2.50/32"]}}'

# 1. Hiển thị danh sách cho phép hiện tại
kubectl get svc traefik-dashboard -n traefik-dashboard \
  -o jsonpath='{.spec.loadBalancerSourceRanges}'

# 2. Vá bằng danh sách đầy đủ bao gồm IP mới
kubectl patch svc traefik-dashboard -n traefik-dashboard \
  -p '{"spec":{"loadBalancerSourceRanges":["<EXISTING_IP_1>/32","<EXISTING_IP_2>/32","<NEW_IP>/32"]}}'

helm install traefik-dashboard traefik/traefik \
  --namespace traefik-dashboard --create-namespace \
  --version 39.0.8 \
  -f third-party/traefik/values-dashboard.yaml

kubectl get pods -n traefik-dashboard

kubectl get ingressclass traefik-dashboard

kubectl get svc -n traefik-public
kubectl get svc -n traefik-dashboard

kubectl get svc -n traefik-public -w

kubectl create namespace agenteye

kubectl get namespace agenteye

kubectl create secret docker-registry agenteye-image-pull \
  --namespace agenteye \
  --docker-server=ghcr.io \
  --docker-username=agenteye-enterprise \
  --docker-password="${AGENTEYE_TOKEN}"

kubectl get secret agenteye-image-pull -n agenteye -o jsonpath='{.type}'

kubectl run test-pull \
  --image=ghcr.io/agenteye-enterprise/server:v0.0.1-beta.48 \
  --overrides='{"spec":{"imagePullSecrets":[{"name":"agenteye-image-pull"}]}}' \
  --restart=Never -n agenteye --command -- echo ok

# Chờ một vài giây để kéo, sau đó:
kubectl logs test-pull -n agenteye
kubectl delete pod test-pull -n agenteye

POSTGRES_PASSWORD=$(openssl rand -hex 24)

kubectl create secret generic agenteye-postgres \
  --namespace agenteye \
  --from-literal=POSTGRES_USER=postgres \
  --from-literal=POSTGRES_PASSWORD="${POSTGRES_PASSWORD}" \
  --from-literal=POSTGRES_DB=agenteye

kubectl get secret agenteye-postgres -n agenteye

kubectl get secret agenteye-postgres -n agenteye \
  -o jsonpath='{.data.POSTGRES_PASSWORD}' | base64 -d | wc -c

ADMIN_KEY=$(openssl rand -hex 32)

kubectl create secret generic agenteye-admin-key \
  --namespace agenteye \
  --from-literal=ADMIN_KEY="${ADMIN_KEY}"

kubectl get secret agenteye-admin-key -n agenteye

kubectl create secret generic agenteye-auth \
  --namespace agenteye \
  --from-literal=ADMIN_EMAIL="admin@yourcompany.com" \
  --from-literal=ALLOWED_EMAILS="*@yourcompany.com" \
  --from-literal=SMTP_HOST="smtp.yourprovider.com" \
  --from-literal=SMTP_PORT="587" \
  --from-literal=SMTP_USERNAME="your-smtp-user" \
  --from-literal=SMTP_PASSWORD="your-smtp-password" \
  --from-literal=SMTP_FROM="noreply@yourcompany.com" \
  --from-literal=SMTP_TLS="starttls" \
  --from-literal=DEFAULT_ORG_NAME="Acme Corp" \
  --from-literal=DEFAULT_ORG_SLUG="acme"

kubectl get secret agenteye-auth -n agenteye \
  -o jsonpath='{.data}' | grep -o '"[A-Z_]*"' | sort -u

kubectl create secret generic agenteye-org-ch-secret \
  --namespace agenteye \
  --from-literal=ORG_CH_SECRET="$(openssl rand -base64 48)"

# Khởi động lại máy chủ để nó nhận giá trị mới.
kubectl -n agenteye rollout restart deployment/server

kubectl get secrets -n agenteye -o custom-columns='NAME:.metadata.name,TYPE:.type'

NAME                    TYPE
agenteye-admin-key      Opaque
agenteye-auth           Opaque
agenteye-image-pull     kubernetes.io/dockerconfigjson
agenteye-postgres       Opaque
agenteye-org-ch-secret  Opaque   # chỉ nếu bạn hoàn thành §2.6 (đa người thuê)

cp base/certificates/domain.env.example base/certificates/domain.env
# Chỉnh sửa base/certificates/domain.env và đặt:
#   INGEST_DOMAIN=ingest.your-company.example      (phân giải thành LB Traefik công khai)
#   DASHBOARD_DOMAIN=agenteye.your-company.example (phân giải thành LB Traefik bảng điều khiển)

kubectl apply -k base/
# hoặc
kubectl apply -k overlays/<your-env>/

kubectl wait --for=condition=Ready pod -l 'app in (server,dashboard,postgres,clickhouse)' \
  -n agenteye --timeout=180s

kubectl get pods -n agenteye

NAME                         READY   STATUS    RESTARTS   AGE
agent-xxxxxxxxxx-xxxxx       1/1     Running   0          ...
clickhouse-0                 1/1     Running   0          ...
dashboard-xxxxxxxxxx-xxxxx   1/1     Running   0          ...
dashboard-xxxxxxxxxx-xxxxx   1/1     Running   0          ...
postgres-0                   1/1     Running   0          ...
redis-0                      1/1     Running   0          ...
server-xxxxxxxxxx-xxxxx      1/1     Running   0          ...
server-xxxxxxxxxx-xxxxx      1/1     Running   0          ...

kubectl get pvc -n agenteye

kubectl get certificates -n agenteye

kubectl get cronjobs -n agenteye

kubectl logs -n agenteye -l app=server --tail=20

kubectl logs -n agenteye -l app=dashboard --tail=20

PUBLIC_IP=$(kubectl get svc -n traefik-public \
  -o jsonpath='{.items[0].status.loadBalancer.ingress[0].ip}')

INTERNAL_IP=$(kubectl get svc -n traefik-dashboard \
  -o jsonpath='{.items[0].status.loadBalancer.ingress[0].ip}')

echo "Public  (ingest):    $PUBLIC_IP"
echo "Internal (dashboard): $INTERNAL_IP"

dig +short ingest.your-company.example
dig +short agenteye.your-company.example

curl -s --cert issued/<cluster-name>/client.crt \
        --key issued/<cluster-name>/client.key \
        https://ingest.your-company.example/health

curl -s https://agenteye.your-company.example/ -o /dev/null -w '%{http_code}\n'

cd base/certificates/client-certs
./issue-client-cert.sh <cluster-name>

kubectl get certificate mtls-client-<cluster-name> -n agenteye

cd base/certificates/client-certs
export AWS_REGION=us-east-1     # khu vực nơi khối lượng công việc của bạn chạy
./issue-client-cert.sh <cluster-name> --save-to aws-secrets-manager

curl -sk --cert issued/<cluster-name>/client.crt \
     --key issued/<cluster-name>/client.key \
     https://${PUBLIC_IP}/health

kubectl apply -f collector-mtls-secret.yaml -n <collector-namespace>