git
This commit is contained in:
v
parent
4a4972553c
commit
fc886fb03e
3
.gitignore
vendored
Normal file
3
.gitignore
vendored
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
/state/snapshots
|
||||
zarya-code.xml
|
||||
zarya-state.xml
|
||||
0
state/collect_state.sh
Normal file → Executable file
0
state/collect_state.sh
Normal file → Executable file
567
zarya-code.xml
567
zarya-code.xml
|
|
@ -45,13 +45,20 @@ The content is organized as follows:
|
|||
|
||||
<directory_structure>
|
||||
bin/
|
||||
fc
|
||||
gg
|
||||
op
|
||||
zarya
|
||||
cmd/
|
||||
a.sh
|
||||
disks.sh
|
||||
errors.sh
|
||||
exec.sh
|
||||
flux.sh
|
||||
git-credential.sh
|
||||
logs.sh
|
||||
net.sh
|
||||
nodes.sh
|
||||
pack.sh
|
||||
pods.sh
|
||||
run.sh
|
||||
|
|
@ -81,64 +88,48 @@ state/
|
|||
03_vyos.sh
|
||||
04_tier0.sh
|
||||
05_k8s.sh
|
||||
collect_state.sh
|
||||
config.env
|
||||
</directory_structure>
|
||||
|
||||
<files>
|
||||
This section contains the contents of the repository's files.
|
||||
|
||||
<file path="bin/zarya">
|
||||
<file path="bin/fc">
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
source "${ZARYA_DIR}/lib/common.sh"
|
||||
if [[ $# -eq 0 ]]; then
|
||||
echo "Использование: fc <файл>"
|
||||
exit 1
|
||||
fi
|
||||
if [[ -f "$1" ]]; then
|
||||
wl-copy < "$1"
|
||||
echo "'$1' +++"
|
||||
else
|
||||
echo "'$1'+++"
|
||||
fi
|
||||
</file>
|
||||
|
||||
SUBCMD="${1:-help}"
|
||||
shift || true
|
||||
<file path="bin/gg">
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
if [[ -z "${1:-}" ]]; then
|
||||
echo "Тема СВО не раскрыта: gg \"сообщение\""
|
||||
exit 1
|
||||
fi
|
||||
git add . && git commit -m "$1" && git push
|
||||
</file>
|
||||
|
||||
case "${SUBCMD}" in
|
||||
p|pod|pods) exec "${ZARYA_DIR}/cmd/pods.sh" "$@" ;;
|
||||
e|err|errors) exec "${ZARYA_DIR}/cmd/errors.sh" "$@" ;;
|
||||
l|log|logs) exec "${ZARYA_DIR}/cmd/logs.sh" "$@" ;;
|
||||
n|net) exec "${ZARYA_DIR}/cmd/net.sh" "$@" ;;
|
||||
d|df|disks) exec "${ZARYA_DIR}/cmd/disks.sh" "$@" ;;
|
||||
unseal) exec "${ZARYA_DIR}/cmd/unseal.sh" "$@" ;;
|
||||
login|start) exec "${ZARYA_DIR}/cmd/session.sh" "start" "$@" ;;
|
||||
logout|clean) exec "${ZARYA_DIR}/cmd/session.sh" "clean" "$@" ;;
|
||||
up) exec "${ZARYA_DIR}/cmd/up.sh" "$@" ;;
|
||||
run) exec "${ZARYA_DIR}/cmd/run.sh" "$@" ;;
|
||||
a|apply) exec "${ZARYA_DIR}/cmd/a.sh" "$@" ;;
|
||||
snap) exec "${ZARYA_DIR}/cmd/snap.sh" "$@" ;;
|
||||
pack) exec "${ZARYA_DIR}/cmd/pack.sh" "$@" ;;
|
||||
reset|nuke) exec "${ZARYA_DIR}/layers/reset.sh" "$@" ;;
|
||||
gc) exec "${ZARYA_DIR}/layers/gc.sh" "$@" ;;
|
||||
help|--help|-h)
|
||||
cat <<EOF
|
||||
Zarya C2 Operator Interface (z)
|
||||
Команды диагностики:
|
||||
z pods [-w] [-n <ns>] [-s <query>] [-A] Просмотр подов
|
||||
z errors Мгновенный триаж сломанных сервисов
|
||||
z logs <service> [-f] [-t <N>] Логи любого сервиса без ввода неймспейса
|
||||
z net Сетевой радар доступности узлов (1 сек)
|
||||
z disks Срез пулов astra/terra и ZVOL томов K8s
|
||||
Управление и сессия:
|
||||
z login [TTL] Открытие смены (YubiKey + RAM)
|
||||
z logout Мгновенная очистка RAM
|
||||
z unseal Распечатывание OpenBao Vault
|
||||
Деплой и IaC:
|
||||
z up [layer] Макро-слои (host, net, tier0, talos, apps, all)
|
||||
z run <selector> Плейбуки Ansible (01, 02)
|
||||
z a [-auto-approve] OpenTofu apply в RAM-изоляции
|
||||
Телеметрия и LLM:
|
||||
z snap Снятие полного .md аудита в snapshots/
|
||||
z pack [code|state|atlas] Сборка контекста Repomix
|
||||
EOF
|
||||
;;
|
||||
*)
|
||||
log_err "Неизвестная команда: ${SUBCMD}. Введите 'z help'."
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
<file path="bin/op">
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
if [[ $# -eq 0 ]]; then
|
||||
echo "Использование: op <файл...>"
|
||||
exit 1
|
||||
fi
|
||||
for f in "$@"; do
|
||||
printf "file://%s\r\n" "$(realpath "$f")"
|
||||
done | wl-copy -t text/uri-list
|
||||
</file>
|
||||
|
||||
<file path="cmd/a.sh">
|
||||
|
|
@ -201,6 +192,47 @@ if [[ "$has_errors" == false ]]; then
|
|||
fi
|
||||
</file>
|
||||
|
||||
<file path="cmd/exec.sh">
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
source "${ZARYA_DIR}/lib/common.sh"
|
||||
if [[ $# -eq 0 ]]; then
|
||||
log_err "Использование: z exec <команда> [аргументы...]"
|
||||
exit 1
|
||||
fi
|
||||
run_isolated "$@"
|
||||
</file>
|
||||
|
||||
<file path="cmd/flux.sh">
|
||||
#!/bin/bash
|
||||
set -uo pipefail
|
||||
ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
source "${ZARYA_DIR}/lib/common.sh"
|
||||
subcmd="${1:-status}"
|
||||
shift || true
|
||||
case "${subcmd}" in
|
||||
sync|reconcile|s)
|
||||
log_info "Принудительная конвергенция FluxCD..."
|
||||
flux reconcile source git atlas-repo -n flux-system 2>/dev/null || true
|
||||
flux reconcile kustomization infra-sync -n flux-system 2>/dev/null || true
|
||||
flux reconcile kustomization apps-sync -n flux-system 2>/dev/null || true
|
||||
log_ok "Синхронизация завершена."
|
||||
;;
|
||||
logs|log|l)
|
||||
log_info "Стриминг логов kustomize-controller..."
|
||||
exec kubectl -n flux-system logs -l app.kubernetes.io/name=kustomize-controller --tail=50 -f
|
||||
;;
|
||||
status|st)
|
||||
echo -e "${BLUE}=== СТАТУС РЕПОЗИТОРИЕВ И KUSTOMIZATION (FLUX) ===${NC}"
|
||||
kubectl -n flux-system get gitrepositories,kustomizations,helmreleases 2>/dev/null || log_err "Flux недоступен"
|
||||
;;
|
||||
*)
|
||||
kubectl -n flux-system get kustomizations 2>/dev/null || log_err "Flux недоступен"
|
||||
;;
|
||||
esac
|
||||
</file>
|
||||
|
||||
<file path="cmd/logs.sh">
|
||||
#!/bin/bash
|
||||
set -uo pipefail
|
||||
|
|
@ -264,34 +296,49 @@ check_target "Traefik L2 VIP" "10.0.30.200" 443
|
|||
check_target "Perimeter VPS" "153.76.194.24" 443
|
||||
</file>
|
||||
|
||||
<file path="cmd/pack.sh">
|
||||
<file path="cmd/nodes.sh">
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
mode="${1:-state}"
|
||||
case "${mode}" in
|
||||
state)
|
||||
echo "==> Снятие свежего аудита..."
|
||||
"${ZARYA_DIR}/state/collect_state.sh" all >/dev/null 2>&1 || true
|
||||
echo "==> Упаковка среза состояния Repomix (zarya-state.xml)..."
|
||||
repomix --config "${ZARYA_DIR}/repomix.state.json"
|
||||
echo "✔ Файл zarya-state.xml готов для отправки в LLM."
|
||||
;;
|
||||
code)
|
||||
echo "==> Упаковка кодовой базы zarya (zarya-code.xml)..."
|
||||
repomix --config "${ZARYA_DIR}/repomix.config.json"
|
||||
echo "✔ Файл zarya-code.xml готов."
|
||||
;;
|
||||
atlas)
|
||||
echo "==> Упаковка чистой инфраструктуры atlas (atlas-code.xml)..."
|
||||
cd "${ATLAS_DIR}" && repomix
|
||||
echo "✔ Файл atlas/repomix-output.xml готов."
|
||||
;;
|
||||
*)
|
||||
echo "Использование: z pack [state|code|atlas]"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
set -u
|
||||
watch_mode=false
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
-w|--watch) watch_mode=true; shift ;;
|
||||
*) shift ;;
|
||||
esac
|
||||
done
|
||||
render_nodes() {
|
||||
local raw
|
||||
raw=$(kubectl get nodes -L topology.kubernetes.io/zone,topology.kubernetes.io/region 2>/dev/null || true)
|
||||
echo "$raw" | awk '
|
||||
BEGIN {
|
||||
ERR = "\033[38;2;255;46;76m"
|
||||
RUN = "\033[38;2;166;227;161m"
|
||||
HEAD = "\033[38;2;147;154;183m"
|
||||
RST = "\033[0m"
|
||||
}
|
||||
NR==1 { print HEAD $0 RST; next }
|
||||
{
|
||||
if ($2 ~ /Ready/ && $2 !~ /NotReady/) {
|
||||
print RUN $0 RST
|
||||
}
|
||||
else {
|
||||
print ERR $0 RST
|
||||
}
|
||||
}'
|
||||
}
|
||||
if [[ "$watch_mode" == true ]]; then
|
||||
trap 'tput cnorm 2>/dev/null || true; echo ""; exit 0' INT TERM
|
||||
tput civis 2>/dev/null || true
|
||||
clear
|
||||
while true; do
|
||||
tput cup 0 0 2>/dev/null || true
|
||||
render_nodes
|
||||
tput ed 2>/dev/null || true
|
||||
sleep 1
|
||||
done
|
||||
else
|
||||
render_nodes
|
||||
fi
|
||||
</file>
|
||||
|
||||
<file path="cmd/pods.sh">
|
||||
|
|
@ -727,99 +774,6 @@ log_warn() { echo -e "${YELLOW}⚠${NC} $*"; }
|
|||
log_err() { echo -e "${RED}✖${NC} $*"; }
|
||||
</file>
|
||||
|
||||
<file path="lib/net.sh">
|
||||
#!/bin/bash
|
||||
# Network routing and terminal prerequisites
|
||||
ensure_prerequisites() {
|
||||
local target_ip="${VAULT_ADDR#*//}"
|
||||
target_ip="${target_ip%%:*}"
|
||||
if ! ip route get "${target_ip}" 2>/dev/null | grep -q "${VYOS_ROUTER_IP}"; then
|
||||
log_info "Восстанавливаем маршрут к ${NET_PREFIX} через VyOS (${VYOS_ROUTER_IP})..."
|
||||
sudo ip route replace "${NET_PREFIX}" via "${VYOS_ROUTER_IP}" 2>/dev/null || true
|
||||
fi
|
||||
# Регистрация Git Credential Helper (доменный и прямой IP Tier-0)
|
||||
local target_helper="!${REPO_ROOT}/deploy.sh git-credential"
|
||||
local current_helper
|
||||
current_helper=$(git config --global --get credential."https://${GIT_HOST}".helper 2>/dev/null || true)
|
||||
if [[ "${current_helper}" != "${target_helper}" ]]; then
|
||||
git config --global credential."https://${GIT_HOST}".helper "${target_helper}"
|
||||
fi
|
||||
local direct_helper
|
||||
direct_helper=$(git config --global --get credential."http://10.0.10.13:3000".helper 2>/dev/null || true)
|
||||
if [[ "${direct_helper}" != "${target_helper}" ]]; then
|
||||
git config --global credential."http://10.0.10.13:3000".helper "${target_helper}"
|
||||
fi
|
||||
# Нативная привязка IdentityFile для всех C2-хостов и LXC-контейнеров
|
||||
local ssh_hosts="proxmox pve0 vyos vyos_router 10.0.* dns0 vault0 git0 storage0 registry0"
|
||||
if [[ -f "${HOME}/.ssh/config" ]] && ! grep -q "IdentityFile ${RAM_KEY}" "${HOME}/.ssh/config"; then
|
||||
printf "\nHost %s\n IdentityFile %s\n IdentitiesOnly yes\n" "${ssh_hosts}" "${RAM_KEY}" >> "${HOME}/.ssh/config"
|
||||
fi
|
||||
}
|
||||
</file>
|
||||
|
||||
<file path="lib/session.sh">
|
||||
#!/bin/bash
|
||||
# Session state in RAM tmpfs and YubiKey integration
|
||||
load_secrets_to_ram() {
|
||||
local hours="${1:-$DEFAULT_SESSION_TTL}"
|
||||
local now
|
||||
now=$(date +%s)
|
||||
ensure_prerequisites
|
||||
# Валидация сессии по наличию непустых кэша секретов и SSH-ключа
|
||||
if [[ -f "${RAM_CACHE}" ]] && [[ -f "${RAM_KEY}" ]] && [[ -s "${RAM_KEY}" ]]; then
|
||||
local created age cached_ttl
|
||||
created=$(stat -c %Y "${RAM_CACHE}" 2>/dev/null || echo 0)
|
||||
age=$(( now - created ))
|
||||
cached_ttl=$(grep '^# TTL_SECONDS=' "${RAM_CACHE}" 2>/dev/null | cut -d= -f2 || echo 3600)
|
||||
if [[ "${cached_ttl}" -ne 0 ]] && (( age >= cached_ttl )); then
|
||||
log_warn "Время сессии истекло ($(( age / 60 )) мин >= $(( cached_ttl / 60 )) мин). Инвалидация кэша..."
|
||||
rm -f "${RAM_CACHE}" "${RAM_KEY}"
|
||||
else
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
local ttl_seconds
|
||||
if [[ "${hours}" -eq 0 ]]; then
|
||||
ttl_seconds=0
|
||||
else
|
||||
ttl_seconds=$(( hours * 3600 ))
|
||||
fi
|
||||
log_info "🔐 Вход в защищенный контур C2..."
|
||||
read -s -p "Master Password: " KP_PASS
|
||||
echo ""
|
||||
local yk_args=()
|
||||
if ykman info >/dev/null 2>&1; then
|
||||
yk_args=("-y" "2")
|
||||
log_info "YubiKey обнаружен. Приготовьтесь к аппаратному подтверждению (1 касание)..."
|
||||
fi
|
||||
# Атомарный 1-Touch экспорт всей базы KDBX в RAM (ровно 1 касание YubiKey на всю сессию)
|
||||
local tmp_dump="/dev/shm/.kdbx_dump_${now}_$$.xml"
|
||||
rm -f "${tmp_dump}"
|
||||
touch "${tmp_dump}"
|
||||
chmod 600 "${tmp_dump}"
|
||||
if ! echo "${KP_PASS}" | keepassxc-cli export "${yk_args[@]}" "${KDBX_PATH}" -f xml > "${tmp_dump}" 2>/dev/null; then
|
||||
log_err "Ошибка расшифровки базы KDBX (неверный пароль или таймаут касания YubiKey)"
|
||||
rm -f "${tmp_dump}"
|
||||
unset KP_PASS
|
||||
return 1
|
||||
fi
|
||||
unset KP_PASS
|
||||
python3 "${REPO_ROOT}/scripts/lib/kdbx_parser.py" "${tmp_dump}" "${RAM_CACHE}" "${RAM_KEY}" "${ttl_seconds}" "${PVE_ENDPOINT}" "${VAULT_ADDR}"
|
||||
rm -f "${tmp_dump}"
|
||||
log_ok "База расшифрована за 1 касание. Ключ и секреты в RAM (TTL: ${hours}ч)"
|
||||
}
|
||||
run_isolated() {
|
||||
ensure_prerequisites
|
||||
load_secrets_to_ram
|
||||
(
|
||||
set -a
|
||||
source "${RAM_CACHE}"
|
||||
set +a
|
||||
"$@"
|
||||
)
|
||||
}
|
||||
</file>
|
||||
|
||||
<file path="lib/vault.sh">
|
||||
#!/bin/bash
|
||||
# OpenBao Vault operations and Kubernetes Secret synchronization
|
||||
|
|
@ -1161,6 +1115,71 @@ timeout 10s kubectl --kubeconfig="${KUBECONFIG_PATH}" -n storage exec statefulse
|
|||
echo '```'
|
||||
</file>
|
||||
|
||||
<file path="state/collect_state.sh">
|
||||
#!/bin/bash
|
||||
set -uo pipefail
|
||||
ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
STATE_DIR="${ZARYA_DIR}/state"
|
||||
SNAPSHOTS_DIR="${STATE_DIR}/snapshots"
|
||||
TARGET="${1:-all}"
|
||||
MODULES=(
|
||||
"00_workstation.sh"
|
||||
"01_pve.sh"
|
||||
"02_vps.sh"
|
||||
"03_vyos.sh"
|
||||
"04_tier0.sh"
|
||||
"05_k8s.sh"
|
||||
)
|
||||
mkdir -p "${SNAPSHOTS_DIR}"
|
||||
generate_header() {
|
||||
local mod_name="$1"
|
||||
local timestamp branch short_hash commit_msg
|
||||
timestamp=$(date -u +"%Y-%m-%d %H:%M:%S UTC")
|
||||
branch=$(git -C "${ATLAS_DIR:-$HOME/Projects/atlas}" branch --show-current 2>/dev/null || echo "unknown")
|
||||
short_hash=$(git -C "${ATLAS_DIR:-$HOME/Projects/atlas}" rev-parse --short HEAD 2>/dev/null || echo "none")
|
||||
commit_msg=$(git -C "${ATLAS_DIR:-$HOME/Projects/atlas}" log -1 --format='%s' 2>/dev/null || echo "none")
|
||||
cat <<EOF
|
||||
# Sovereign C2 Runtime: ${mod_name}
|
||||
**Срез:** ${timestamp} | **Git:** ${branch}@${short_hash} ("${commit_msg}")
|
||||
EOF
|
||||
}
|
||||
run_single_module() {
|
||||
local mod="$1"
|
||||
local mod_name="${mod%.sh}"
|
||||
local script="${STATE_DIR}/${mod}"
|
||||
local out_file="${SNAPSHOTS_DIR}/${mod_name}.md"
|
||||
local tmp_file="${out_file}.tmp"
|
||||
echo " -> Сбор модуля: ${mod_name}..."
|
||||
generate_header "${mod_name}" > "${tmp_file}"
|
||||
if [[ -x "${script}" ]]; then
|
||||
"${script}" >> "${tmp_file}" 2>&1
|
||||
else
|
||||
bash "${script}" >> "${tmp_file}" 2>&1
|
||||
fi
|
||||
mv "${tmp_file}" "${out_file}"
|
||||
}
|
||||
if [[ "${TARGET}" == "all" ]]; then
|
||||
echo "==> Сбор полного аудита Sovereign C2 в ${SNAPSHOTS_DIR}..."
|
||||
for mod in "${MODULES[@]}"; do
|
||||
run_single_module "${mod}"
|
||||
done
|
||||
echo "✔ Все модули телеметрии успешно сохранены."
|
||||
else
|
||||
case "${TARGET}" in
|
||||
00_workstation|workstation|host) run_single_module "00_workstation.sh" ;;
|
||||
01_pve|pve) run_single_module "01_pve.sh" ;;
|
||||
02_vps|vps) run_single_module "02_vps.sh" ;;
|
||||
03_vyos|vyos|net) run_single_module "03_vyos.sh" ;;
|
||||
04_tier0|tier0) run_single_module "04_tier0.sh" ;;
|
||||
05_k8s|k8s|talos) run_single_module "05_k8s.sh" ;;
|
||||
*)
|
||||
echo "Неизвестный модуль: ${TARGET}"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
</file>
|
||||
|
||||
<file path="config.env">
|
||||
#!/bin/bash
|
||||
# Atlas C2 Configuration SSOT
|
||||
|
|
@ -1178,4 +1197,216 @@ PVE_ENDPOINT="https://192.168.1.177:8006/"
|
|||
DEFAULT_SESSION_TTL=1
|
||||
</file>
|
||||
|
||||
<file path="bin/zarya">
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
source "${ZARYA_DIR}/lib/common.sh"
|
||||
|
||||
SUBCMD="${1:-help}"
|
||||
shift || true
|
||||
|
||||
case "${SUBCMD}" in
|
||||
git-credential) exec "${ZARYA_DIR}/cmd/git-credential.sh" "$@" ;;
|
||||
exec) exec "${ZARYA_DIR}/cmd/exec.sh" "$@" ;;
|
||||
p|pod|pods) exec "${ZARYA_DIR}/cmd/pods.sh" "$@" ;;
|
||||
node|nodes) exec "${ZARYA_DIR}/cmd/nodes.sh" "$@" ;;
|
||||
flux) exec "${ZARYA_DIR}/cmd/flux.sh" "$@" ;;
|
||||
e|err|errors) exec "${ZARYA_DIR}/cmd/errors.sh" "$@" ;;
|
||||
l|log|logs) exec "${ZARYA_DIR}/cmd/logs.sh" "$@" ;;
|
||||
n|net) exec "${ZARYA_DIR}/cmd/net.sh" "$@" ;;
|
||||
d|df|disks) exec "${ZARYA_DIR}/cmd/disks.sh" "$@" ;;
|
||||
unseal) exec "${ZARYA_DIR}/cmd/unseal.sh" "$@" ;;
|
||||
login|start) exec "${ZARYA_DIR}/cmd/session.sh" "start" "$@" ;;
|
||||
logout|clean) exec "${ZARYA_DIR}/cmd/session.sh" "clean" "$@" ;;
|
||||
up) exec "${ZARYA_DIR}/cmd/up.sh" "$@" ;;
|
||||
run) exec "${ZARYA_DIR}/cmd/run.sh" "$@" ;;
|
||||
a|apply) exec "${ZARYA_DIR}/cmd/a.sh" "$@" ;;
|
||||
snap) exec "${ZARYA_DIR}/cmd/snap.sh" "$@" ;;
|
||||
pack) exec "${ZARYA_DIR}/cmd/pack.sh" "$@" ;;
|
||||
reset|nuke) exec "${ZARYA_DIR}/layers/reset.sh" "$@" ;;
|
||||
gc) exec "${ZARYA_DIR}/layers/gc.sh" "$@" ;;
|
||||
help|--help|-h)
|
||||
cat <<EOF
|
||||
ZARYA Operator Interface (z)
|
||||
Диагностика и мониторинг:
|
||||
z pods [-w] [-n <ns>] [-s <query>] [-A] Просмотр подов
|
||||
z nodes [-w] Статус нод, роли, зона и регион
|
||||
z errors Мгновенный триаж сломанных сервисов
|
||||
z logs <service> [-f] [-t <N>] Логи сервиса без ввода неймспейса
|
||||
z net Сетевой радар доступности узлов (1 сек)
|
||||
z disks Срез пулов astra/terra и томов K8s
|
||||
GitOps и оркестрация:
|
||||
z flux [status|sync|logs] Управление GitOps-конвергенцией
|
||||
z exec <команда...> Вызов бинарников внутри RAM-изоляции
|
||||
Сессия и доступы:
|
||||
z login [TTL] Открытие смены (YubiKey + RAM)
|
||||
z logout Мгновенная очистка RAM
|
||||
z unseal Распечатывание OpenBao Vault
|
||||
Деплой и IaC:
|
||||
z up [layer] Макро-слои (host, net, tier0, talos, apps, all)
|
||||
z run <selector> Плейбуки Ansible (01, 02)
|
||||
z a [-auto-approve] OpenTofu apply в RAM-изоляции
|
||||
Телеметрия и LLM:
|
||||
z snap Снятие аудита в state/snapshots/
|
||||
z pack [all|atlas|code|state] Сборка контекстов Repomix для LLM
|
||||
EOF
|
||||
;;
|
||||
*)
|
||||
log_err "Неизвестная команда: ${SUBCMD}. Введите 'z help'."
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
</file>
|
||||
|
||||
<file path="cmd/git-credential.sh">
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
source "${ZARYA_DIR}/lib/common.sh"
|
||||
if [[ -f "${RAM_CACHE}" ]]; then
|
||||
token=$(grep '^export ATLAS_PUSH_TOKEN=' "${RAM_CACHE}" 2>/dev/null | cut -d= -f2- | tr -d '"'\'' ' || true)
|
||||
if [[ -n "${token}" ]]; then
|
||||
echo "username=atlas"
|
||||
echo "password=${token}"
|
||||
fi
|
||||
fi
|
||||
exit 0
|
||||
</file>
|
||||
|
||||
<file path="cmd/pack.sh">
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
source "${ZARYA_DIR}/lib/common.sh"
|
||||
mode="${1:-all}"
|
||||
pack_atlas() {
|
||||
log_info "==> [1/3] Упаковка чистой архитектуры Atlas (atlas-code.xml)..."
|
||||
(cd "${ATLAS_DIR}" && repomix --config "${ATLAS_DIR}/repomix.config.json")
|
||||
log_ok "Файл ${ATLAS_DIR}/atlas-code.xml готов."
|
||||
}
|
||||
pack_zarya() {
|
||||
log_info "==> [2/3] Упаковка станции оператора Zarya (zarya-code.xml)..."
|
||||
(cd "${ZARYA_DIR}" && repomix --config "${ZARYA_DIR}/repomix.config.json")
|
||||
log_ok "Файл ${ZARYA_DIR}/zarya-code.xml готов."
|
||||
}
|
||||
pack_state() {
|
||||
log_info "==> [3/3] Снятие живого аудита и упаковка телеметрии (zarya-state.xml)..."
|
||||
"${ZARYA_DIR}/state/collect_state.sh" all
|
||||
(cd "${ZARYA_DIR}" && repomix --config "${ZARYA_DIR}/repomix.state.json")
|
||||
log_ok "Файл ${ZARYA_DIR}/zarya-state.xml готов."
|
||||
}
|
||||
case "${mode}" in
|
||||
all)
|
||||
pack_atlas
|
||||
echo ""
|
||||
pack_zarya
|
||||
echo ""
|
||||
pack_state
|
||||
echo ""
|
||||
log_ok "Все три контекста Repomix собраны без ошибок."
|
||||
;;
|
||||
atlas)
|
||||
pack_atlas
|
||||
;;
|
||||
code)
|
||||
pack_zarya
|
||||
;;
|
||||
state)
|
||||
pack_state
|
||||
;;
|
||||
*)
|
||||
log_err "Использование: z pack [all|atlas|code|state]"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
</file>
|
||||
|
||||
<file path="lib/net.sh">
|
||||
#!/bin/bash
|
||||
ensure_prerequisites() {
|
||||
local target_ip="${VAULT_ADDR#*//}"
|
||||
target_ip="${target_ip%%:*}"
|
||||
if ! ip route get "${target_ip}" 2>/dev/null | grep -q "${VYOS_ROUTER_IP}"; then
|
||||
log_info "Восстанавливаем маршрут к ${NET_PREFIX} через VyOS (${VYOS_ROUTER_IP})..."
|
||||
sudo ip route replace "${NET_PREFIX}" via "${VYOS_ROUTER_IP}" 2>/dev/null || true
|
||||
fi
|
||||
local target_helper="!${ZARYA_DIR}/bin/zarya git-credential"
|
||||
local current_helper
|
||||
current_helper=$(git config --global --get credential."https://${GIT_HOST}".helper 2>/dev/null || true)
|
||||
if [[ "${current_helper}" != "${target_helper}" ]]; then
|
||||
git config --global credential."https://${GIT_HOST}".helper "${target_helper}"
|
||||
fi
|
||||
local direct_helper
|
||||
direct_helper=$(git config --global --get credential."http://10.0.10.13:3000".helper 2>/dev/null || true)
|
||||
if [[ "${direct_helper}" != "${target_helper}" ]]; then
|
||||
git config --global credential."http://10.0.10.13:3000".helper "${target_helper}"
|
||||
fi
|
||||
local ssh_hosts="proxmox pve0 vyos vyos_router 10.0.* dns0 vault0 git0 storage0 registry0"
|
||||
if [[ -f "${HOME}/.ssh/config" ]] && ! grep -q "IdentityFile ${RAM_KEY}" "${HOME}/.ssh/config"; then
|
||||
printf "\nHost %s\n IdentityFile %s\n IdentitiesOnly yes\n" "${ssh_hosts}" "${RAM_KEY}" >> "${HOME}/.ssh/config"
|
||||
fi
|
||||
}
|
||||
</file>
|
||||
|
||||
<file path="lib/session.sh">
|
||||
#!/bin/bash
|
||||
load_secrets_to_ram() {
|
||||
local hours="${1:-$DEFAULT_SESSION_TTL}"
|
||||
local now
|
||||
now=$(date +%s)
|
||||
ensure_prerequisites
|
||||
if [[ -f "${RAM_CACHE}" ]] && [[ -f "${RAM_KEY}" ]] && [[ -s "${RAM_KEY}" ]]; then
|
||||
local created age cached_ttl
|
||||
created=$(stat -c %Y "${RAM_CACHE}" 2>/dev/null || echo 0)
|
||||
age=$(( now - created ))
|
||||
cached_ttl=$(grep '^# TTL_SECONDS=' "${RAM_CACHE}" 2>/dev/null | cut -d= -f2 || echo 3600)
|
||||
if [[ "${cached_ttl}" -ne 0 ]] && (( age >= cached_ttl )); then
|
||||
log_warn "Время сессии истекло ($(( age / 60 )) мин >= $(( cached_ttl / 60 )) мин). Инвалидация кэша..."
|
||||
rm -f "${RAM_CACHE}" "${RAM_KEY}"
|
||||
else
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
local ttl_seconds
|
||||
if [[ "${hours}" -eq 0 ]]; then
|
||||
ttl_seconds=0
|
||||
else
|
||||
ttl_seconds=$(( hours * 3600 ))
|
||||
fi
|
||||
log_info "🔐 Вход в защищенный контур Zarya..."
|
||||
read -s -p "Master Password: " KP_PASS
|
||||
echo ""
|
||||
local yk_args=()
|
||||
if ykman info >/dev/null 2>&1; then
|
||||
yk_args=("-y" "2")
|
||||
log_info "YubiKey обнаружен. Приготовьтесь к аппаратному подтверждению (1 касание)..."
|
||||
fi
|
||||
local tmp_dump="/dev/shm/.kdbx_dump_${now}_$$.xml"
|
||||
rm -f "${tmp_dump}"
|
||||
touch "${tmp_dump}"
|
||||
chmod 600 "${tmp_dump}"
|
||||
if ! echo "${KP_PASS}" | keepassxc-cli export "${yk_args[@]}" "${KDBX_PATH}" -f xml > "${tmp_dump}" 2>/dev/null; then
|
||||
log_err "Ошибка расшифровки базы KDBX (неверный пароль или таймаут касания YubiKey)"
|
||||
rm -f "${tmp_dump}"
|
||||
unset KP_PASS
|
||||
return 1
|
||||
fi
|
||||
unset KP_PASS
|
||||
python3 "${ZARYA_DIR}/lib/kdbx_parser.py" "${tmp_dump}" "${RAM_CACHE}" "${RAM_KEY}" "${ttl_seconds}" "${PVE_ENDPOINT}" "${VAULT_ADDR}"
|
||||
rm -f "${tmp_dump}"
|
||||
log_ok "База расшифрована за 1 касание. Ключ и секреты в RAM (TTL: ${hours}ч)"
|
||||
}
|
||||
run_isolated() {
|
||||
ensure_prerequisites
|
||||
load_secrets_to_ram
|
||||
(
|
||||
set -a
|
||||
source "${RAM_CACHE}"
|
||||
set +a
|
||||
"$@"
|
||||
)
|
||||
}
|
||||
</file>
|
||||
|
||||
</files>
|
||||
|
|
|
|||
849
zarya-state.xml
849
zarya-state.xml
|
|
@ -42,10 +42,857 @@ The content is organized as follows:
|
|||
</file_summary>
|
||||
|
||||
<directory_structure>
|
||||
|
||||
state/
|
||||
snapshots/
|
||||
00_workstation.md
|
||||
01_pve.md
|
||||
02_vps.md
|
||||
03_vyos.md
|
||||
04_tier0.md
|
||||
05_k8s.md
|
||||
</directory_structure>
|
||||
|
||||
<files>
|
||||
This section contains the contents of the repository's files.
|
||||
|
||||
<file path="state/snapshots/00_workstation.md">
|
||||
# Sovereign C2 Runtime: 00_workstation
|
||||
**Срез:** 2026-10-25 15:20:06 UTC | **Git:** master@10fbe14 ("git")
|
||||
## 0. Рабочая станция администратора (Operator Environment)
|
||||
### Инфраструктурные SSH-хосты (~/.ssh/config):
|
||||
```text
|
||||
Host proxmox pve0
|
||||
Hostname 192.168.1.177
|
||||
Port 22
|
||||
User root
|
||||
|
||||
Host vyos vyos_router
|
||||
Hostname 192.168.1.2
|
||||
Port 22
|
||||
User vyos
|
||||
|
||||
Host 10.0.* dns0 vault0 git0 storage0 registry0
|
||||
User root
|
||||
StrictHostKeyChecking no
|
||||
UserKnownHostsFile /dev/null
|
||||
LogLevel ERROR
|
||||
|
||||
Host fin21
|
||||
Hostname 153.76.194.24
|
||||
Port 22
|
||||
User atlas
|
||||
|
||||
Host incserv
|
||||
Hostname 31.76.100.166
|
||||
Port 8765
|
||||
User root
|
||||
|
||||
Host router
|
||||
Hostname 192.168.1.1
|
||||
Port 1488
|
||||
User root
|
||||
|
||||
Host proxmox pve0 vyos vyos_router fin21 10.0.*
|
||||
IdentityFile /dev/shm/.atlas_core
|
||||
IdentitiesOnly yes
|
||||
```
|
||||
### Рабочие алиасы и функции оператора (Active Workflow Aliases):
|
||||
```bash
|
||||
# Маркер # >>> ATLAS C2 WORKFLOW >>> не найден в ~/.bashrc
|
||||
```
|
||||
### Статус RAM-кэша секретов (/dev/shm/.atlas_secrets_cache):
|
||||
```text
|
||||
Размер: 1058 байт | Права: 600 | Создан: 2026-10-25 18:08:15.915202821 +0300
|
||||
```
|
||||
### Проверка Git Credential Helper (git.svo88.space):
|
||||
```text
|
||||
Username: atlas
|
||||
Password: [PRESENT in RAM]
|
||||
```
|
||||
### Ядро, память, ZRAM и параметры Coredump:
|
||||
```text
|
||||
Kernel: 7.2.5-3-omarchy
|
||||
Swapon: NAME TYPE SIZE USED PRIO
|
||||
/swap/swapfile file 13.5G 0B 0
|
||||
/dev/zram0 partition 13.5G 358M 100
|
||||
NAME ALGORITHM DISKSIZE DATA COMPR TOTAL STREAMS MOUNTPOINT
|
||||
/dev/zram0 zstd 13.5G 331.5M 89.6M 95M [SWAP]
|
||||
Coredump config:
|
||||
#Storage=external
|
||||
#ProcessSizeMax=32G
|
||||
```
|
||||
### Токены безопасности и ключи в ssh-agent:
|
||||
```text
|
||||
Active SSH Agent keys:
|
||||
The agent has no identities.
|
||||
YubiKey / FIDO2 Status:
|
||||
Device type: YubiKey 5 Nano
|
||||
Serial number: 29508635
|
||||
Firmware version: 5.7.1
|
||||
Form factor: Nano (USB-A)
|
||||
Enabled USB interfaces: OTP, FIDO, CCID
|
||||
|
||||
Applications
|
||||
Yubico OTP Enabled
|
||||
FIDO U2F Enabled
|
||||
FIDO2 Enabled
|
||||
OATH Enabled
|
||||
PIV Enabled
|
||||
OpenPGP Enabled
|
||||
YubiHSM Auth Enabled
|
||||
```
|
||||
### Зеркала пакетов Pacman (Mirrorlist):
|
||||
```text
|
||||
/etc/pacman.conf:[options]
|
||||
/etc/pacman.conf:[core]
|
||||
/etc/pacman.conf:[extra]
|
||||
/etc/pacman.conf:[multilib]
|
||||
/etc/pacman.conf:[omarchy]
|
||||
/etc/pacman.conf:Server = https://pkgs.omarchy.org/stable/$arch
|
||||
/etc/pacman.d/mirrorlist:Server = https://stable-mirror.omarchy.org/$repo/os/$arch
|
||||
/etc/pacman.d/mirrorlist.bak:Server = https://mirror.omarchy.org/$repo/os/$arch
|
||||
/etc/pacman.d/mirrorlist.omarchy-upgrade-to-quattro.20260905155315.bak:Server = https://mirror.omarchy.org/$repo/os/$arch
|
||||
Нет данных о зеркалах
|
||||
```
|
||||
### Маршрутизация на хосте (Routing to C2):
|
||||
```text
|
||||
default via 192.168.1.2 dev enp34s0 proto dhcp src 192.168.1.247 metric 100
|
||||
10.0.0.0/16 via 192.168.1.2 dev enp34s0 proto static metric 100
|
||||
192.168.1.0/24 dev enp34s0 proto kernel scope link src 192.168.1.247 metric 100
|
||||
```
|
||||
### Версии локальных инструментов:
|
||||
```text
|
||||
OpenTofu: OpenTofu v1.12.1
|
||||
Kubectl: gitVersion: v1.36.4
|
||||
Talosctl: Client:
|
||||
Talos v1.14.0
|
||||
```
|
||||
### Состояние локального Git-репозитория (SSOT Source):
|
||||
```text
|
||||
fatal: not a git repository (or any parent up to mount point /)
|
||||
Stopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set).
|
||||
fatal: not a git repository (or any parent up to mount point /)
|
||||
Stopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set).
|
||||
Последний коммит:
|
||||
Remote URL: no remote
|
||||
```
|
||||
---
|
||||
</file>
|
||||
|
||||
<file path="state/snapshots/01_pve.md">
|
||||
# Sovereign C2 Runtime: 01_pve
|
||||
**Срез:** 2026-10-25 15:20:06 UTC | **Git:** master@10fbe14 ("git")
|
||||
## 1. Гипервизор Proxmox VE (192.168.1.177)
|
||||
### Память хоста, Uptime и Температура CPU:
|
||||
```text
|
||||
18:20:07 up 3:30, 1 user, load average: 1.59, 1.90, 1.69
|
||||
|
||||
total used free shared buff/cache available
|
||||
Mem: 37Gi 30Gi 5.8Gi 75Mi 1.3Gi 6.6Gi
|
||||
Swap: 0B 0B 0B
|
||||
|
||||
```
|
||||
### Здоровье физических дисков (SMART):
|
||||
```text
|
||||
/dev/sda: SMART overall-health self-assessment test result: PASSED
|
||||
/dev/sdb: SMART overall-health self-assessment test result: PASSED
|
||||
/dev/sdc: SMART overall-health self-assessment test result: PASSED
|
||||
/dev/sdd: SMART overall-health self-assessment test result: PASSED
|
||||
/dev/sde: SMART overall-health self-assessment test result: PASSED
|
||||
/dev/sdf: SMART overall-health self-assessment test result: PASSED
|
||||
```
|
||||
### Статус шифрования ZFS (Encryption & Keys):
|
||||
```text
|
||||
NAME PROPERTY VALUE SOURCE
|
||||
astra encryption aes-256-gcm -
|
||||
astra keystatus available -
|
||||
astra keyformat raw -
|
||||
astra keylocation file:///etc/zfs/keys/astra.key local
|
||||
terra encryption aes-256-gcm -
|
||||
terra keystatus available -
|
||||
terra keyformat raw -
|
||||
terra keylocation file:///etc/zfs/keys/terra.key local
|
||||
```
|
||||
### Здоровье и емкость ZFS-пулов:
|
||||
```text
|
||||
NAME SIZE ALLOC FREE FRAG CAP HEALTH
|
||||
astra 2.78T 540G 2.25T 9% 18% ONLINE
|
||||
terra 1.81T 345G 1.48T 0% 18% ONLINE
|
||||
|
||||
NAME USED AVAIL REFER MOUNTPOINT
|
||||
astra 360G 1.44T 55.0M /astra
|
||||
astra/vm-100-cloudinit 128K 1.44T 128K -
|
||||
astra/vm-100-disk-0 1.06G 1.44T 1.06G -
|
||||
astra/vm-201-disk-0 1.38G 1.44T 1.38G -
|
||||
astra/vm-202-disk-0 14.8G 1.44T 14.8G -
|
||||
astra/vm-203-disk-0 20.4G 1.44T 20.4G -
|
||||
astra/vm-9999-pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8 27.2M 1.44T 27.2M -
|
||||
astra/vm-9999-pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945 8.61M 1.44T 8.61M -
|
||||
astra/vm-9999-pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd 203M 1.44T 203M -
|
||||
astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b 714K 1.44T 714K -
|
||||
astra/vm-9999-pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7 5.13M 1.44T 5.13M -
|
||||
astra/vm-9999-pvc-6eb8c148-32b0-45af-8945-2799d04875a3 884K 1.44T 884K -
|
||||
astra/vm-9999-pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb 1.05M 1.44T 1.05M -
|
||||
astra/vm-9999-pvc-79601320-1a12-492e-82bc-8ed0fcf61205 416K 1.44T 416K -
|
||||
astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f 7.02M 1.44T 7.02M -
|
||||
astra/vm-9999-pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9 320G 1.44T 320G -
|
||||
astra/vm-9999-pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780 970K 1.44T 970K -
|
||||
astra/vm-9999-pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 375M 1.44T 375M -
|
||||
astra/vm-9999-pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 1.33M 1.44T 1.33M -
|
||||
astra/vm-9999-pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2 2.54M 1.44T 2.54M -
|
||||
astra/vm-9999-pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242 704M 1.44T 704M -
|
||||
astra/vm-9999-pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 14.5M 1.44T 14.5M -
|
||||
astra/vm-9999-pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4 20.7M 1.44T 20.7M -
|
||||
terra 345G 1.42T 12.6G /terra
|
||||
terra/media 248K 1.42T 248K /terra/media
|
||||
terra/s3 192K 1.42T 192K /terra/s3
|
||||
terra/vault 333G 1.42T 333G /terra/vault
|
||||
```
|
||||
### Физическая емкость каталогов на /terra:
|
||||
```text
|
||||
68K /terra/media
|
||||
4.6M /terra/models
|
||||
171K /terra/packages
|
||||
13G /terra/registry
|
||||
8.5K /terra/s3
|
||||
4.3M /terra/torrents
|
||||
333G /terra/vault
|
||||
```
|
||||
### Блочные устройства хоста и тома ZVOL (lsblk):
|
||||
```text
|
||||
NAME FSTYPE SIZE MOUNTPOINTS
|
||||
loop0 ext4 4G
|
||||
loop1 ext4 4G
|
||||
loop2 ext4 2G
|
||||
loop3 ext4 8G
|
||||
loop4 ext4 8G
|
||||
sda 1.8T
|
||||
├─sda1 zfs_member 1.8T
|
||||
└─sda9 8M
|
||||
sdb 953.9G
|
||||
├─sdb1 zfs_member 953.9G
|
||||
└─sdb9 8M
|
||||
sdc 476.9G
|
||||
├─sdc1 vfat 976M /boot/efi
|
||||
├─sdc2 linux_raid_member 977M
|
||||
│ └─md0 ext4 976M /boot
|
||||
└─sdc3 linux_raid_member 445.3G
|
||||
└─md1 crypto_LUKS 445.1G
|
||||
└─md1_crypt ext4 445.1G /
|
||||
sdd 953.9G
|
||||
├─sdd1 zfs_member 953.9G
|
||||
└─sdd9 8M
|
||||
sde 447.1G
|
||||
├─sde1 vfat 976M
|
||||
├─sde2 linux_raid_member 977M
|
||||
│ └─md0 ext4 976M /boot
|
||||
└─sde3 linux_raid_member 445.2G
|
||||
└─md1 crypto_LUKS 445.1G
|
||||
└─md1_crypt ext4 445.1G /
|
||||
sdf 953.9G
|
||||
├─sdf1 zfs_member 953.9G
|
||||
└─sdf9 8M
|
||||
zd0 ext4 2G
|
||||
zd16 ext4 10G
|
||||
zd32 ext4 10G
|
||||
zd48 ext4 20G
|
||||
zd64 iso9660 4M
|
||||
zd80 ext4 5G
|
||||
zd96 ext4 5G
|
||||
zd112 ext4 5G
|
||||
zd128 ext4 5G
|
||||
zd144 100G
|
||||
├─zd144p1 vfat 100M
|
||||
├─zd144p2 1M
|
||||
├─zd144p3 xfs 2G
|
||||
├─zd144p4 1M
|
||||
├─zd144p5 xfs 100M
|
||||
└─zd144p6 xfs 97.8G
|
||||
zd160 ext4 30G
|
||||
zd176 ext4 30G
|
||||
zd192 ext4 400G
|
||||
zd208 ext4 100G
|
||||
zd224 100G
|
||||
├─zd224p1 vfat 100M
|
||||
├─zd224p2 1M
|
||||
├─zd224p3 xfs 2G
|
||||
├─zd224p4 1M
|
||||
├─zd224p5 xfs 100M
|
||||
└─zd224p6 xfs 97.8G
|
||||
zd240 10G
|
||||
├─zd240p1 1M
|
||||
├─zd240p2 vfat 256M
|
||||
└─zd240p3 ext4 9G
|
||||
zd256 ext4 100G
|
||||
zd272 20G
|
||||
├─zd272p1 vfat 100M
|
||||
├─zd272p2 1M
|
||||
├─zd272p3 xfs 2G
|
||||
├─zd272p4 1M
|
||||
├─zd272p5 xfs 100M
|
||||
└─zd272p6 xfs 17.8G
|
||||
zd288 ext4 20G
|
||||
zd304 ext4 15G
|
||||
zd320 ext4 5G
|
||||
zd336 ext4 30G
|
||||
```
|
||||
### Виртуальные диски K8s и ВМ (ZVOLs на astra):
|
||||
```text
|
||||
NAME VOLSIZE USED REFER
|
||||
astra/vm-100-cloudinit 4M 128K 128K
|
||||
astra/vm-100-disk-0 10G 1.06G 1.06G
|
||||
astra/vm-201-disk-0 20G 1.38G 1.38G
|
||||
astra/vm-202-disk-0 100G 14.8G 14.8G
|
||||
astra/vm-203-disk-0 100G 20.4G 20.4G
|
||||
astra/vm-9999-pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8 10G 27.2M 27.2M
|
||||
astra/vm-9999-pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945 100G 8.61M 8.61M
|
||||
astra/vm-9999-pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd 100G 203M 203M
|
||||
astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b 5G 714K 714K
|
||||
astra/vm-9999-pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7 20G 5.13M 5.13M
|
||||
astra/vm-9999-pvc-6eb8c148-32b0-45af-8945-2799d04875a3 10G 884K 884K
|
||||
astra/vm-9999-pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb 15G 1.05M 1.05M
|
||||
astra/vm-9999-pvc-79601320-1a12-492e-82bc-8ed0fcf61205 2G 416K 416K
|
||||
astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f 5G 7.02M 7.02M
|
||||
astra/vm-9999-pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9 400G 320G 320G
|
||||
astra/vm-9999-pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780 5G 970K 970K
|
||||
astra/vm-9999-pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 5G 375M 375M
|
||||
astra/vm-9999-pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 20G 1.33M 1.33M
|
||||
astra/vm-9999-pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2 5G 2.54M 2.54M
|
||||
astra/vm-9999-pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242 30G 704M 704M
|
||||
astra/vm-9999-pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 30G 14.5M 14.5M
|
||||
astra/vm-9999-pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4 30G 20.7M 20.7M
|
||||
```
|
||||
### Модули ядра (nfsd, zfs):
|
||||
```text
|
||||
zfs 6262784 44
|
||||
nfsd 1011712 3
|
||||
```
|
||||
### Теги сетевых карт ВМ 100 (VyOS) в Proxmox:
|
||||
```text
|
||||
net0: virtio=BC:24:11:DC:6D:EC,bridge=vmbr0,firewall=0
|
||||
net1: virtio=BC:24:11:3F:CB:C9,bridge=vmbr0,firewall=0,tag=20
|
||||
net2: virtio=BC:24:11:EA:32:2F,bridge=vmbr0,firewall=0,tag=30
|
||||
net3: virtio=BC:24:11:59:E8:8D,bridge=vmbr0,firewall=0,tag=10
|
||||
```
|
||||
### Точки монтирования LXC-контейнеров (/etc/pve/lxc/*.conf):
|
||||
```text
|
||||
/etc/pve/lxc/101.conf:mp0: /astra/data/dns0,mp=/opt/technitium/dns/config
|
||||
/etc/pve/lxc/102.conf:mp0: /astra/data/vault0,mp=/var/lib/bao/data
|
||||
/etc/pve/lxc/103.conf:mp0: /astra/data/git0,mp=/var/lib/forgejo
|
||||
/etc/pve/lxc/104.conf:mp0: /terra/media,mp=/media
|
||||
/etc/pve/lxc/104.conf:mp1: /terra/torrents,mp=/torrents
|
||||
/etc/pve/lxc/104.conf:mp2: /terra/vault,mp=/backups
|
||||
/etc/pve/lxc/104.conf:mp3: /terra/models,mp=/models
|
||||
/etc/pve/lxc/104.conf:mp4: /terra/packages,mp=/packages
|
||||
/etc/pve/lxc/105.conf:mp0: /terra/registry,mp=/mnt/registry
|
||||
```
|
||||
### Флаги автостарта ВМ и Контейнеров (onboot):
|
||||
```text
|
||||
/etc/pve/qemu-server/100.conf:onboot: 1
|
||||
/etc/pve/qemu-server/201.conf:onboot: 1
|
||||
/etc/pve/qemu-server/202.conf:onboot: 1
|
||||
/etc/pve/qemu-server/203.conf:onboot: 1
|
||||
/etc/pve/lxc/101.conf:onboot: 1
|
||||
/etc/pve/lxc/102.conf:onboot: 1
|
||||
/etc/pve/lxc/103.conf:onboot: 1
|
||||
/etc/pve/lxc/104.conf:onboot: 1
|
||||
/etc/pve/lxc/105.conf:onboot: 1
|
||||
```
|
||||
### Виртуальные машины (QEMU) и Контейнеры (LXC):
|
||||
```text
|
||||
VMID NAME STATUS MEM(MB) BOOTDISK(GB) PID
|
||||
100 vyos-router running 2048 10.00 2594
|
||||
201 talos-master-1 running 2560 20.00 2698
|
||||
202 talos-worker-1 running 10240 100.00 3869
|
||||
203 talos-worker-2 running 10240 100.00 4919
|
||||
|
||||
VMID Status Lock Name
|
||||
101 running dns0
|
||||
102 running vault0
|
||||
103 running git0
|
||||
104 running storage0
|
||||
105 running registry0
|
||||
```
|
||||
---
|
||||
</file>
|
||||
|
||||
<file path="state/snapshots/02_vps.md">
|
||||
# Sovereign C2 Runtime: 02_vps
|
||||
**Срез:** 2026-10-25 15:20:12 UTC | **Git:** master@10fbe14 ("git")
|
||||
## 2. Периметр: Белый VPS (Host: fin21, IP: 153.76.194.24)
|
||||
### WireGuard wg0 на VPS:
|
||||
```text
|
||||
interface: wg0
|
||||
public key: tS0m/x/dVCs8+N+mtSH3PENWpEUymJDiuPNWrCySMWY=
|
||||
private key: (hidden)
|
||||
listening port: 51820
|
||||
|
||||
peer: yYiGIZK3nTqxmMm6OXDkeniwtsAJkM6ozcGibexitR4=
|
||||
endpoint: 45.93.6.172:46777
|
||||
allowed ips: 10.8.0.2/32, 10.0.30.200/32
|
||||
latest handshake: 3 hours, 28 minutes, 44 seconds ago
|
||||
transfer: 64.06 MiB received, 54.22 MiB sent
|
||||
```
|
||||
### Статус системных сервисов (Edge Stack):
|
||||
```text
|
||||
WireGuard: active | HAProxy: active | Xray: active | Nginx: active
|
||||
```
|
||||
### Прослушиваемые сокеты (Ports 80, 443, 4443, 8443, 51820):
|
||||
```text
|
||||
udp UNCONN 0 0 0.0.0.0:51820 0.0.0.0:*
|
||||
udp UNCONN 0 0 [::]:51820 [::]:*
|
||||
tcp LISTEN 0 4096 127.0.0.1:4443 0.0.0.0:* users:(("haproxy",pid=862,fd=10))
|
||||
tcp LISTEN 0 511 127.0.0.1:8443 0.0.0.0:* users:(("nginx",pid=739,fd=5),("nginx",pid=735,fd=5))
|
||||
tcp LISTEN 0 4096 0.0.0.0:80 0.0.0.0:* users:(("haproxy",pid=862,fd=9))
|
||||
tcp LISTEN 0 4096 *:443 *:* users:(("xray",pid=690,fd=3))
|
||||
```
|
||||
### Тест аварийной заглушки Nginx (127.0.0.1:8443):
|
||||
```text
|
||||
Atlas Sovereign Home Server is currently offline for maintenance.
|
||||
```
|
||||
### Конфигурация SSH-демона (sshd runtime):
|
||||
```text
|
||||
permitrootlogin no
|
||||
passwordauthentication yes
|
||||
```
|
||||
---
|
||||
</file>
|
||||
|
||||
<file path="state/snapshots/03_vyos.md">
|
||||
# Sovereign C2 Runtime: 03_vyos
|
||||
**Срез:** 2026-10-25 15:20:15 UTC | **Git:** master@10fbe14 ("git")
|
||||
## 3. Маршрутизатор VyOS (192.168.1.2)
|
||||
### Сетевые интерфейсы и L2-транк (VLANs 10, 20, 30):
|
||||
```text
|
||||
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
|
||||
Interface IP Address MAC VRF MTU S/L Description
|
||||
----------- -------------- ----------------- ------- ----- ----- -------------------
|
||||
eth0 192.168.1.2/24 bc:24:11:dc:6d:ec default 1500 u/u WAN_TRUNK
|
||||
eth1 10.0.20.1/24 bc:24:11:3f:cb:c9 default 1500 u/u K8S
|
||||
eth2 10.0.10.1/24 bc:24:11:59:e8:8d default 1500 u/u TIER0
|
||||
eth3 10.0.30.1/24 bc:24:11:ea:32:2f default 1500 u/u LAN_CLIENTS
|
||||
lo 127.0.0.1/8 00:00:00:00:00:00 default 65536 u/u
|
||||
::1/128
|
||||
tun0 172.19.0.1/30 n/a default 65535 u/u
|
||||
wg0 10.8.0.2/24 n/a default 1420 u/u TUNNEL_TO_VPS_FIN21
|
||||
```
|
||||
### ARP-таблица K8s-интерфейса eth1 (проверка связности с нодами):
|
||||
```text
|
||||
10.0.20.11 lladdr bc:24:11:12:c5:1b REACHABLE
|
||||
10.0.20.12 lladdr bc:24:11:ef:1a:d4 STALE
|
||||
10.0.20.10 lladdr bc:24:11:71:b6:82 REACHABLE
|
||||
fe80::be24:11ff:fe12:c51b lladdr bc:24:11:12:c5:1b STALE
|
||||
fe80::be24:11ff:feef:1ad4 lladdr bc:24:11:ef:1a:d4 STALE
|
||||
fe80::be24:11ff:fe71:b682 lladdr bc:24:11:71:b6:82 STALE
|
||||
```
|
||||
### DHCP-сервер и выданные лизы (Options 3, 6):
|
||||
```text
|
||||
IP Address MAC address State Lease start Lease expiration Remaining Pool Hostname Origin
|
||||
------------ ----------------- ------- ------------------- ------------------- ----------- ----------- -------------- --------
|
||||
10.0.20.10 bc:24:11:71:b6:82 active 2026-10-25 11:51:32 2026-10-26 11:51:32 20:31:16 K8S talos-master-1 local
|
||||
10.0.20.11 bc:24:11:12:c5:1b active 2026-10-25 12:29:01 2026-10-26 12:29:01 21:08:45 K8S talos-worker-1 local
|
||||
10.0.20.12 bc:24:11:ef:1a:d4 active 2026-10-25 12:29:04 2026-10-26 12:29:04 21:08:48 K8S talos-worker-2 local
|
||||
10.0.30.100 bc:24:11:eb:38:63 active 2026-10-25 12:29:02 2026-10-26 12:29:02 21:08:46 LAN_CLIENTS talos-worker-1 local
|
||||
10.0.30.101 bc:24:11:bb:00:d3 active 2026-10-25 12:29:05 2026-10-26 12:29:05 21:08:49 LAN_CLIENTS talos-worker-2 local
|
||||
```
|
||||
### Перехват DNS через DNAT (Rule 53 -> 127.0.0.42:53):
|
||||
```text
|
||||
Rule Source Destination Proto In-Int Translation
|
||||
------ --------- ------------- -------- -------- -------------
|
||||
53 0.0.0.0/0 0.0.0.0/0 TCP, UDP LAN 127.0.0.42
|
||||
sport any dport 53 port 53
|
||||
```
|
||||
### Контейнеры маршрутизатора (Sing-Box & Zapret2):
|
||||
```text
|
||||
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
|
||||
9217a0a6ac83 ghcr.io/sagernet/sing-box:latest run -c /etc/sing-... 3 hours ago Up 3 hours sing-box
|
||||
c7e27e9bb9fc docker.io/vernette/ss-zapret2:latest /etc/zapret/run.s... 3 hours ago Up 3 hours 1080/tcp, 8388/tcp zapret2
|
||||
```
|
||||
### Наличие /dev/net/tun внутри контейнера sing-box:
|
||||
```text
|
||||
crw-rw-rw- 1 root root 10, 200 Oct 25 11:51 /dev/net/tun
|
||||
```
|
||||
### Задержка VLESS-канала через Clash API (Main-1-out -> fin21):
|
||||
```text
|
||||
{"type": "VLESS", "name": "Main-1-out", "udp": true, "history": [{"time":"2026-10-25T15:19:30.52662628Z","delay":122}]}```
|
||||
### Статус таймера автосинхронизации Git (singbox-sync):
|
||||
```text
|
||||
● singbox-sync.timer - Periodic Sing-Box Config Git Sync Timer
|
||||
Loaded: loaded (/etc/systemd/system/singbox-sync.timer; enabled; preset: enabled)
|
||||
Active: active (waiting) since Sun 2026-10-25 11:51:13 UTC; 3h 29min ago
|
||||
Trigger: Sun 2026-10-25 15:20:23 UTC; 6s left
|
||||
Triggers: ● singbox-sync.service
|
||||
|
||||
Oct 25 11:51:13 vyos-router systemd[1]: Started Periodic Sing-Box Config Git Sync Timer.
|
||||
|
||||
Oct 25 15:19:23 vyos-router systemd[1]: singbox-sync.service: Deactivated successfully.
|
||||
Oct 25 15:19:23 vyos-router systemd[1]: Finished Automated Sing-Box Config Git Sync.
|
||||
Oct 25 15:19:53 vyos-router systemd[1]: Starting Automated Sing-Box Config Git Sync...
|
||||
Oct 25 15:19:54 vyos-router systemd[1]: singbox-sync.service: Deactivated successfully.
|
||||
Oct 25 15:19:54 vyos-router systemd[1]: Finished Automated Sing-Box Config Git Sync.
|
||||
```
|
||||
### Статус WireGuard туннеля wg0 и пинг до VPS:
|
||||
```text
|
||||
interface: wg0
|
||||
public key: yYiGIZK3nTqxmMm6OXDkeniwtsAJkM6ozcGibexitR4=
|
||||
private key: (hidden)
|
||||
listening port: 34756
|
||||
|
||||
peer: tS0m/x/dVCs8+N+mtSH3PENWpEUymJDiuPNWrCySMWY=
|
||||
endpoint: 153.76.194.24:51820
|
||||
allowed ips: 10.8.0.0/24
|
||||
latest handshake: 3 hours, 28 minutes, 47 seconds ago
|
||||
transfer: 1.12 KiB received, 282.34 KiB sent
|
||||
persistent keepalive: every 25 seconds
|
||||
|
||||
VyOS или туннель недоступен
|
||||
```
|
||||
### Таблица маршрутизации (show ip route):
|
||||
```text
|
||||
Codes: K - kernel route, C - connected, L - local, S - static,
|
||||
R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
|
||||
T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
|
||||
f - OpenFabric, t - Table-Direct,
|
||||
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
|
||||
t - trapped, o - offload failure
|
||||
|
||||
IPv4 unicast VRF default:
|
||||
S>* 0.0.0.0/0 [1/0] via 192.168.1.1, eth0, weight 1, 03:28:52
|
||||
C>* 10.0.10.0/24 is directly connected, eth2, weight 1, 03:28:58
|
||||
L>* 10.0.10.1/32 is directly connected, eth2, weight 1, 03:28:58
|
||||
C>* 10.0.20.0/24 is directly connected, eth1, weight 1, 03:28:58
|
||||
L>* 10.0.20.1/32 is directly connected, eth1, weight 1, 03:28:58
|
||||
C>* 10.0.30.0/24 is directly connected, eth3, weight 1, 03:28:58
|
||||
L>* 10.0.30.1/32 is directly connected, eth3, weight 1, 03:28:58
|
||||
C>* 10.8.0.0/24 is directly connected, wg0, weight 1, 03:28:57
|
||||
L>* 10.8.0.2/32 is directly connected, wg0, weight 1, 03:28:57
|
||||
C>* 172.19.0.0/30 is directly connected, tun0, weight 1, 03:28:55
|
||||
L>* 172.19.0.1/32 is directly connected, tun0, weight 1, 03:28:55
|
||||
C>* 192.168.1.0/24 is directly connected, eth0, weight 1, 03:28:58
|
||||
L>* 192.168.1.2/32 is directly connected, eth0, weight 1, 03:28:58
|
||||
```
|
||||
---
|
||||
</file>
|
||||
|
||||
<file path="state/snapshots/04_tier0.md">
|
||||
# Sovereign C2 Runtime: 04_tier0
|
||||
**Срез:** 2026-10-25 15:20:22 UTC | **Git:** master@10fbe14 ("git")
|
||||
## 4. Сервисы Tier-0 (Air-Gap фундамент)
|
||||
### Technitium DNS (10.0.10.11:53):
|
||||
* **Внутренний домен (*.svo88.space -> 10.0.30.200):** 10.0.30.200
|
||||
* **Внешний резолв (google.com):** 173.194.220.100
|
||||
### OpenBao Vault (10.0.10.12:8200):
|
||||
```json
|
||||
{"type":"shamir","initialized":true,"sealed":false,"t":1,"n":1,"progress":0,"nonce":"","version":"2.0.1","build_date":"2024-09-03T19:57:34Z","migration":false,"cluster_name":"vault-cluster-74026fc7","cluster_id":"79b6d270-a6b1-b082-39be-aeb24d8841f5","recovery_seal":false,"storage_type":"file"}
|
||||
```
|
||||
### Zot OCI Registry (10.0.10.15:5000):
|
||||
```json
|
||||
{"repositories":["alpine","docker.io/getmeili/meilisearch","docker.io/grafana/loki","docker.io/jellyfin/jellyfin","docker.io/library/alpine","docker.io/library/busybox","docker.io/library/nginx","docker.io/library/postgres","docker.io/library/redis","docker.io/library/traefik","docker.io/netboxcommunity/netbox","docker.io/opencloudeu/opencloud-rolling","docker.io/owncloud/ocis","docker.io/searxng/searxng","docker.io/vaultwarden/server","docker.io/victoriametrics/victoria-metrics","docker.io/xream/sub-store","ghcr.io/anatol/pacoloco","ghcr.io/donkie/spoolman","ghcr.io/external-secrets/external-secrets","ghcr.io/fluxcd/helm-controller","ghcr.io/fluxcd/image-automation-controller","ghcr.io/fluxcd/image-reflector-controller","ghcr.io/fluxcd/kustomize-controller","ghcr.io/fluxcd/notification-controller","ghcr.io/fluxcd/source-controller","ghcr.io/fluxcd/source-watcher","ghcr.io/goauthentik/server","ghcr.io/immich-app/postgres","ghcr.io/karakeep-app/karakeep","ghcr.io/karakeep-app/karakeep-chrome","ghcr.io/kiwix/kiwix-serve","ghcr.io/sergelogvinov/proxmox-csi-controller","ghcr.io/sergelogvinov/proxmox-csi-node","ghcr.io/siderolabs/kubelet","ghcr.io/sysadminsmedia/homebox","ghcr.io/triliumnext/notes","ghcr.io/triliumnext/trilium","ghcr.io/we-promise/sure","ghcr.io/xiao-villamor/printstash","k8s.io/coredns/coredns","k8s.io/kube-apiserver","k8s.io/kube-controller-manager","k8s.io/kube-proxy","k8s.io/kube-scheduler","k8s.io/sig-storage/csi-attacher","k8s.io/sig-storage/csi-provisioner","k8s.io/sig-storage/csi-resizer","k8s.io/sig-storage/livenessprobe","quay.io/invidious/invidious","quay.io/invidious/invidious-companion","quay.io/jetstack/cert-manager-cainjector"]}```
|
||||
### Forgejo GitOps Server (10.0.10.13:3000):
|
||||
```json
|
||||
{"version":"7.0.4+gitea-1.21.11"}
|
||||
```
|
||||
### Ядерный NFS nfsd (storage0 - 10.0.10.14):
|
||||
```text
|
||||
== Активные экспорты ядра (exportfs):
|
||||
/media 127.0.0.1(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
|
||||
/torrents 127.0.0.1(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
|
||||
/backups 127.0.0.1(async,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
|
||||
/models 127.0.0.1(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
|
||||
/packages 127.0.0.1(async,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
|
||||
/media 10.0.0.0/16(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
|
||||
/torrents 10.0.0.0/16(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
|
||||
/backups 10.0.0.0/16(async,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
|
||||
/models 10.0.0.0/16(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
|
||||
/packages 10.0.0.0/16(async,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
|
||||
|
||||
== Емкость смонтированных ZFS-датасетов:
|
||||
Filesystem Size Used Available Use% Mounted on
|
||||
terra/media 1.4T 1.0M 1.4T 0% /media
|
||||
terra 1.4T 12.6G 1.4T 1% /torrents
|
||||
terra/vault 1.7T 332.6G 1.4T 19% /backups
|
||||
terra 1.4T 12.6G 1.4T 1% /torrents
|
||||
|
||||
== Права точки монтирования OpenCloud:
|
||||
drwxrws--- 5 1000 1000 5 Oct 25 12:31 /backups/opencloud-users
|
||||
```
|
||||
---
|
||||
</file>
|
||||
|
||||
<file path="state/snapshots/05_k8s.md">
|
||||
# Sovereign C2 Runtime: 05_k8s
|
||||
**Срез:** 2026-10-25 15:20:22 UTC | **Git:** master@10fbe14 ("git")
|
||||
## 5. Kubernetes Платформа & Нагрузки
|
||||
### Участники кластера Talos (OS-level):
|
||||
```text
|
||||
10.0.20.10: error getting server version: error constructing client: failed to create client connection: failed to resolve configuration context: talos config file is empty
|
||||
Talos API недоступен
|
||||
```
|
||||
### Ноды кластера K8s:
|
||||
```text
|
||||
NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME
|
||||
talos-1il-vwa Ready control-plane 3h26m v1.37.0 10.0.20.10 <none> Talos (v1.14.0) 6.18.48-talos (amd64) containerd://2.3.4
|
||||
talos-worker-1 Ready <none> 171m v1.37.0 10.0.20.11 <none> Talos (v1.14.0) 6.18.48-talos (amd64) containerd://2.3.4
|
||||
talos-worker-2 Ready <none> 170m v1.37.0 10.0.20.12 <none> Talos (v1.14.0) 6.18.48-talos (amd64) containerd://2.3.4
|
||||
```
|
||||
### Топологические лейблы нод (Proxmox-CSI topology):
|
||||
```text
|
||||
NAME STATUS ROLES AGE VERSION ZONE REGION
|
||||
talos-1il-vwa Ready control-plane 3h26m v1.37.0
|
||||
talos-worker-1 Ready <none> 171m v1.37.0 pve0 atlas
|
||||
talos-worker-2 Ready <none> 170m v1.37.0 pve0 atlas
|
||||
```
|
||||
### Статус ExternalSecrets (Синхронизация из Vault):
|
||||
```text
|
||||
NAME AGE STATUS CAPABILITIES READY
|
||||
clustersecretstore.external-secrets.io/openbao-backend 33d Valid ReadWrite True
|
||||
|
||||
NAMESPACE NAME STORETYPE STORE REFRESH INTERVAL STATUS READY LAST SYNC
|
||||
authentik externalsecret.external-secrets.io/authentik-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 49m
|
||||
databases externalsecret.external-secrets.io/all-db-passwords ClusterSecretStore openbao-backend 1h SecretSynced True 20m
|
||||
databases externalsecret.external-secrets.io/postgres-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
|
||||
documents externalsecret.external-secrets.io/paperless-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
|
||||
flux-system externalsecret.external-secrets.io/atlas-repo-auth ClusterSecretStore openbao-backend 1h SecretSyncedError False 3d1h
|
||||
infra externalsecret.external-secrets.io/netbox-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
|
||||
kube-system externalsecret.external-secrets.io/proxmox-csi-config ClusterSecretStore openbao-backend 1h SecretSynced True 20m
|
||||
media externalsecret.external-secrets.io/immich-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
|
||||
media externalsecret.external-secrets.io/invidious-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
|
||||
monitoring externalsecret.external-secrets.io/grafana-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
|
||||
security externalsecret.external-secrets.io/vaultwarden-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
|
||||
tools externalsecret.external-secrets.io/homebox-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
|
||||
tools externalsecret.external-secrets.io/karakeep-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
|
||||
tools externalsecret.external-secrets.io/printstash-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
|
||||
tools externalsecret.external-secrets.io/searxng-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
|
||||
tools externalsecret.external-secrets.io/sure-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
|
||||
```
|
||||
### Сетевой ingress, сертификаты TLS и L2 Fast-Path VIP:
|
||||
```text
|
||||
NAMESPACE NAME READY SECRET AGE
|
||||
authentik certificate.cert-manager.io/auth-svo88-tls True auth-svo88-tls 27d
|
||||
devices certificate.cert-manager.io/print-svo88-tls True print-svo88-tls 7d5h
|
||||
documents certificate.cert-manager.io/paperless-svo88-tls True paperless-svo88-tls 26d
|
||||
documents certificate.cert-manager.io/trilium-svo88-tls True trilium-svo88-tls 21d
|
||||
infra certificate.cert-manager.io/dns-svo88-tls True dns-svo88-tls 26d
|
||||
infra certificate.cert-manager.io/git-svo88-tls True git-svo88-tls 27d
|
||||
infra certificate.cert-manager.io/netbox-svo88-tls True netbox-svo88-tls 26d
|
||||
infra certificate.cert-manager.io/pkg-svo88-tls True pkg-svo88-tls 6d20h
|
||||
infra certificate.cert-manager.io/pve-svo88-tls True pve-svo88-tls 26d
|
||||
infra certificate.cert-manager.io/vault-svo88-tls True vault-svo88-tls 26d
|
||||
infra certificate.cert-manager.io/zot-svo88-tls True zot-svo88-tls 27d
|
||||
media certificate.cert-manager.io/immich-svo88-tls True immich-svo88-tls 25d
|
||||
media certificate.cert-manager.io/jellyfin-svo88-tls True jellyfin-svo88-tls 21d
|
||||
media certificate.cert-manager.io/metube-svo88-tls True metube-svo88-tls 21d
|
||||
media certificate.cert-manager.io/yt-svo88-tls True yt-svo88-tls 21d
|
||||
security certificate.cert-manager.io/vw-svo88-tls True vw-svo88-tls 31d
|
||||
storage certificate.cert-manager.io/opencloud-svo88-tls True opencloud-svo88-tls 26d
|
||||
tools certificate.cert-manager.io/dash-svo88-tls True dash-svo88-tls 21d
|
||||
tools certificate.cert-manager.io/finance-svo88-tls True finance-svo88-tls 26d
|
||||
tools certificate.cert-manager.io/homebox-svo88-tls True homebox-svo88-tls 27d
|
||||
tools certificate.cert-manager.io/keep-svo88-tls True keep-svo88-tls 21d
|
||||
tools certificate.cert-manager.io/printstash-svo88-tls True printstash-svo88-tls 27d
|
||||
tools certificate.cert-manager.io/search-svo88-tls True search-svo88-tls 26d
|
||||
tools certificate.cert-manager.io/spoolman-svo88-tls True spoolman-svo88-tls 7d5h
|
||||
tools certificate.cert-manager.io/sub-store-svo88-tls True sub-store-svo88-tls 3d9h
|
||||
|
||||
NAMESPACE NAME CLASS HOSTS ADDRESS PORTS AGE
|
||||
authentik ingress.networking.k8s.io/authentik traefik auth.svo88.space 10.0.30.200 80, 443 27d
|
||||
devices ingress.networking.k8s.io/qidi-printer traefik print.svo88.space 10.0.30.200 80, 443 7d5h
|
||||
documents ingress.networking.k8s.io/paperless traefik paperless.svo88.space 10.0.30.200 80, 443 26d
|
||||
documents ingress.networking.k8s.io/trilium traefik trilium.svo88.space 10.0.30.200 80, 443 21d
|
||||
infra ingress.networking.k8s.io/forgejo-git traefik git.svo88.space 10.0.30.200 80, 443 27d
|
||||
infra ingress.networking.k8s.io/netbox traefik netbox.svo88.space 10.0.30.200 80, 443 26d
|
||||
infra ingress.networking.k8s.io/openbao-vault traefik vault.svo88.space 10.0.30.200 80, 443 26d
|
||||
infra ingress.networking.k8s.io/pkg-custom traefik pkg.svo88.space 10.0.30.200 80 6d20h
|
||||
infra ingress.networking.k8s.io/pkg-server traefik pkg.svo88.space 10.0.30.200 80, 443 6d20h
|
||||
infra ingress.networking.k8s.io/proxmox-ve traefik pve.svo88.space 10.0.30.200 80, 443 26d
|
||||
infra ingress.networking.k8s.io/technitium-dns traefik dns.svo88.space 10.0.30.200 80, 443 26d
|
||||
infra ingress.networking.k8s.io/zot-registry traefik zot.svo88.space 10.0.30.200 80, 443 27d
|
||||
media ingress.networking.k8s.io/immich traefik immich.svo88.space 10.0.30.200 80, 443 25d
|
||||
media ingress.networking.k8s.io/invidious traefik yt.svo88.space 10.0.30.200 80, 443 21d
|
||||
media ingress.networking.k8s.io/jellyfin traefik jellyfin.svo88.space 10.0.30.200 80, 443 21d
|
||||
media ingress.networking.k8s.io/metube traefik metube.svo88.space 10.0.30.200 80, 443 21d
|
||||
security ingress.networking.k8s.io/vaultwarden traefik vw.svo88.space 10.0.30.200 80, 443 31d
|
||||
storage ingress.networking.k8s.io/opencloud traefik opencloud.svo88.space 10.0.30.200 80, 443 26d
|
||||
tools ingress.networking.k8s.io/dashboard traefik dash.svo88.space 10.0.30.200 80, 443 21d
|
||||
tools ingress.networking.k8s.io/homebox traefik homebox.svo88.space 10.0.30.200 80, 443 27d
|
||||
tools ingress.networking.k8s.io/karakeep traefik keep.svo88.space 10.0.30.200 80, 443 21d
|
||||
tools ingress.networking.k8s.io/printstash traefik printstash.svo88.space 10.0.30.200 80, 443 27d
|
||||
tools ingress.networking.k8s.io/searxng traefik search.svo88.space 10.0.30.200 80, 443 26d
|
||||
tools ingress.networking.k8s.io/spoolman traefik spoolman.svo88.space 10.0.30.200 80, 443 7d5h
|
||||
tools ingress.networking.k8s.io/sub-store traefik sub-store.svo88.space 10.0.30.200 80, 443 3d9h
|
||||
tools ingress.networking.k8s.io/sure-finance traefik finance.svo88.space 10.0.30.200 80, 443 26d
|
||||
|
||||
NAME AGE
|
||||
ciliuml2announcementpolicy.cilium.io/lan-fastpath-announcement 35d
|
||||
|
||||
NAME DISABLED CONFLICTING IPS AVAILABLE AGE
|
||||
ciliumloadbalancerippool.cilium.io/lan-ingress-pool false False 0 35d
|
||||
|
||||
Traefik VIP (10.0.30.200:443) HTTP Status: 404
|
||||
```
|
||||
### Диски и тома (PVC / PV):
|
||||
```text
|
||||
NAMESPACE NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS VOLUMEATTRIBUTESCLASS AGE
|
||||
databases persistentvolumeclaim/postgres-data-postgres-core-0 Bound pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd 100Gi RWO proxmox-csi-db <unset> 32d
|
||||
documents persistentvolumeclaim/paperless-data-pvc Bound pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4 30Gi RWO proxmox-csi-general <unset> 32d
|
||||
documents persistentvolumeclaim/trilium-data-pvc Bound pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8 10Gi RWO proxmox-csi-general <unset> 21d
|
||||
infra persistentvolumeclaim/netbox-media-pvc Bound pvc-6eb8c148-32b0-45af-8945-2799d04875a3 10Gi RWO proxmox-csi-general <unset> 32d
|
||||
infra persistentvolumeclaim/nfs-packages-pvc Bound nfs-packages-pv 200Gi RWX <unset> 6d20h
|
||||
media persistentvolumeclaim/immich-db-pvc Bound pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242 30Gi RWO proxmox-csi-db <unset> 25d
|
||||
media persistentvolumeclaim/immich-library-pvc Bound pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9 400Gi RWO proxmox-csi-general <unset> 25d
|
||||
media persistentvolumeclaim/jellyfin-config-pvc Bound pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7 20Gi RWO proxmox-csi-general <unset> 21d
|
||||
media persistentvolumeclaim/nfs-kiwix-pvc Bound nfs-kiwix-pv 200Gi ROX <unset> 32d
|
||||
media persistentvolumeclaim/nfs-media-pvc Bound nfs-media-pv 1Ti RWX <unset> 21d
|
||||
media persistentvolumeclaim/nfs-torrents-pvc Bound nfs-torrents-pv 500Gi RWX <unset> 32d
|
||||
monitoring persistentvolumeclaim/grafana-data-pvc Bound pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 5Gi RWO proxmox-csi-general <unset> 16d
|
||||
monitoring persistentvolumeclaim/loki-data-pvc Bound pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 30Gi RWO proxmox-csi-general <unset> 16d
|
||||
monitoring persistentvolumeclaim/victoria-metrics-pvc Bound pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 20Gi RWO proxmox-csi-general <unset> 16d
|
||||
security persistentvolumeclaim/vaultwarden-data-pvc Bound pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f 5Gi RWO proxmox-csi-general <unset> 32d
|
||||
storage persistentvolumeclaim/nfs-opencloud-users-pvc Bound nfs-opencloud-users-pv 600Gi RWX <unset> 21d
|
||||
storage persistentvolumeclaim/opencloud-data-pvc Bound pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945 100Gi RWO proxmox-csi-general <unset> 16d
|
||||
tools persistentvolumeclaim/homebox-data-pvc Bound pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780 5Gi RWO proxmox-csi-general <unset> 32d
|
||||
tools persistentvolumeclaim/karakeep-data-pvc Bound pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb 15Gi RWO proxmox-csi-general <unset> 21d
|
||||
tools persistentvolumeclaim/karakeep-meili-pvc Bound pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b 5Gi RWO proxmox-csi-general <unset> 21d
|
||||
tools persistentvolumeclaim/printstash-models-pvc Bound printstash-models-pv 100Gi RWX <unset> 32d
|
||||
tools persistentvolumeclaim/spoolman-data-pvc Bound pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2 5Gi RWO proxmox-csi-general <unset> 7d5h
|
||||
tools persistentvolumeclaim/sub-store-data-pvc Bound pvc-79601320-1a12-492e-82bc-8ed0fcf61205 2Gi RWO proxmox-csi-general <unset> 3d9h
|
||||
|
||||
NAMESPACE NAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS CLAIM STORAGECLASS VOLUMEATTRIBUTESCLASS REASON AGE
|
||||
persistentvolume/nfs-kiwix-pv 200Gi ROX Retain Bound media/nfs-kiwix-pvc <unset> 32d
|
||||
persistentvolume/nfs-media-pv 1Ti RWX Retain Bound media/nfs-media-pvc <unset> 21d
|
||||
persistentvolume/nfs-opencloud-users-pv 600Gi RWX Retain Bound storage/nfs-opencloud-users-pvc <unset> 21d
|
||||
persistentvolume/nfs-packages-pv 200Gi RWX Retain Bound infra/nfs-packages-pvc <unset> 6d20h
|
||||
persistentvolume/nfs-torrents-pv 500Gi RWX Retain Bound media/nfs-torrents-pvc <unset> 32d
|
||||
persistentvolume/printstash-models-pv 100Gi RWX Retain Bound tools/printstash-models-pvc <unset> 32d
|
||||
persistentvolume/pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8 10Gi RWO Delete Bound documents/trilium-data-pvc proxmox-csi-general <unset> 21d
|
||||
persistentvolume/pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945 100Gi RWO Delete Bound storage/opencloud-data-pvc proxmox-csi-general <unset> 16d
|
||||
persistentvolume/pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd 100Gi RWO Delete Bound databases/postgres-data-postgres-core-0 proxmox-csi-db <unset> 32d
|
||||
persistentvolume/pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b 5Gi RWO Delete Bound tools/karakeep-meili-pvc proxmox-csi-general <unset> 21d
|
||||
persistentvolume/pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7 20Gi RWO Delete Bound media/jellyfin-config-pvc proxmox-csi-general <unset> 21d
|
||||
persistentvolume/pvc-6eb8c148-32b0-45af-8945-2799d04875a3 10Gi RWO Delete Bound infra/netbox-media-pvc proxmox-csi-general <unset> 32d
|
||||
persistentvolume/pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb 15Gi RWO Delete Bound tools/karakeep-data-pvc proxmox-csi-general <unset> 21d
|
||||
persistentvolume/pvc-79601320-1a12-492e-82bc-8ed0fcf61205 2Gi RWO Delete Bound tools/sub-store-data-pvc proxmox-csi-general <unset> 3d9h
|
||||
persistentvolume/pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f 5Gi RWO Delete Bound security/vaultwarden-data-pvc proxmox-csi-general <unset> 32d
|
||||
persistentvolume/pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9 400Gi RWO Delete Bound media/immich-library-pvc proxmox-csi-general <unset> 25d
|
||||
persistentvolume/pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780 5Gi RWO Delete Bound tools/homebox-data-pvc proxmox-csi-general <unset> 32d
|
||||
persistentvolume/pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 5Gi RWO Delete Bound monitoring/grafana-data-pvc proxmox-csi-general <unset> 16d
|
||||
persistentvolume/pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 20Gi RWO Delete Bound monitoring/victoria-metrics-pvc proxmox-csi-general <unset> 16d
|
||||
persistentvolume/pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2 5Gi RWO Delete Bound tools/spoolman-data-pvc proxmox-csi-general <unset> 7d5h
|
||||
persistentvolume/pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242 30Gi RWO Delete Bound media/immich-db-pvc proxmox-csi-db <unset> 25d
|
||||
persistentvolume/pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 30Gi RWO Delete Bound monitoring/loki-data-pvc proxmox-csi-general <unset> 16d
|
||||
persistentvolume/pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4 30Gi RWO Delete Bound documents/paperless-data-pvc proxmox-csi-general <unset> 32d
|
||||
```
|
||||
### Статус DaemonSet Proxmox-CSI Node:
|
||||
```text
|
||||
NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE
|
||||
proxmox-csi-plugin-node 2 2 2 2 2 <none> 33d
|
||||
```
|
||||
### Статус пространства мониторинга (VictoriaMetrics & Grafana):
|
||||
```text
|
||||
NAME READY AGE
|
||||
statefulset.apps/grafana 1/1 16d
|
||||
statefulset.apps/loki 1/1 16d
|
||||
statefulset.apps/victoriametrics 1/1 16d
|
||||
|
||||
NAME READY STATUS RESTARTS AGE
|
||||
pod/grafana-0 1/1 Running 0 169m
|
||||
pod/loki-0 1/1 Running 0 169m
|
||||
pod/victoriametrics-0 1/1 Running 0 169m
|
||||
|
||||
NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS VOLUMEATTRIBUTESCLASS AGE
|
||||
persistentvolumeclaim/grafana-data-pvc Bound pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 5Gi RWO proxmox-csi-general <unset> 16d
|
||||
persistentvolumeclaim/loki-data-pvc Bound pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 30Gi RWO proxmox-csi-general <unset> 16d
|
||||
persistentvolumeclaim/victoria-metrics-pvc Bound pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 20Gi RWO proxmox-csi-general <unset> 16d
|
||||
```
|
||||
### Логи ошибок Proxmox CSI Plugin (последние строки):
|
||||
```text
|
||||
Defaulted container "proxmox-csi-plugin-controller" out of: proxmox-csi-plugin-controller, csi-attacher, csi-provisioner, csi-resizer, liveness-probe
|
||||
Defaulted container "proxmox-csi-plugin-node" out of: proxmox-csi-plugin-node, csi-node-driver-registrar, liveness-probe
|
||||
Defaulted container "proxmox-csi-plugin-node" out of: proxmox-csi-plugin-node, csi-node-driver-registrar, liveness-probe
|
||||
[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.012208 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4" nodeID="talos-worker-2"
|
||||
[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.131792 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb" nodeID="talos-worker-2"
|
||||
[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.206486 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7" nodeID="talos-worker-2"
|
||||
[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.277975 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b" nodeID="talos-worker-2"
|
||||
[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.352701 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f" nodeID="talos-worker-2"
|
||||
[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.430266 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780" nodeID="talos-worker-2"
|
||||
[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.509551 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2" nodeID="talos-worker-2"
|
||||
[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.669146 1 controller.go:513] "ControllerPublishVolume: called" args="{\"node_id\":\"talos-worker-2\",\"volume_capability\":{\"access_mode\":{\"mode\":\"SINGLE_NODE_MULTI_WRITER\"},\"mount\":{\"fs_type\":\"ext4\"}},\"volume_context\":{\"backup\":\"0\",\"cache\":\"none\",\"discard\":\"on\",\"iothread\":\"1\",\"replicate\":\"0\",\"ssd\":\"1\",\"storage\":\"astra\",\"storage.kubernetes.io/csiProvisionerIdentity\":\"1790776828491-7787-csi.proxmox.sinextra.dev\"},\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b\"}"
|
||||
[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.669198 1 controller.go:554] "ControllerPublishVolume: VM ID not found in NodeID, will lookup by node name" nodeID="talos-worker-2"
|
||||
[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.681187 1 controller.go:1112] "failed to get proxmox VMID from ProviderID" nodeID="talos-worker-2" providerID=""
|
||||
[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.873038 1 controller.go:513] "ControllerPublishVolume: called" args="{\"node_id\":\"talos-worker-2\",\"volume_capability\":{\"access_mode\":{\"mode\":\"SINGLE_NODE_MULTI_WRITER\"},\"mount\":{\"fs_type\":\"ext4\"}},\"volume_context\":{\"backup\":\"0\",\"cache\":\"none\",\"discard\":\"on\",\"iothread\":\"1\",\"replicate\":\"0\",\"ssd\":\"1\",\"storage\":\"astra\",\"storage.kubernetes.io/csiProvisionerIdentity\":\"1790090280571-543-csi.proxmox.sinextra.dev\"},\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f\"}"
|
||||
[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.873096 1 controller.go:554] "ControllerPublishVolume: VM ID not found in NodeID, will lookup by node name" nodeID="talos-worker-2"
|
||||
[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.882474 1 controller.go:1112] "failed to get proxmox VMID from ProviderID" nodeID="talos-worker-2" providerID=""
|
||||
[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:44.084431 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b" nodeID="talos-worker-2"
|
||||
[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:44.357862 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f" nodeID="talos-worker-2"
|
||||
[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:29.408317 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-6eb8c148-32b0-45af-8945-2799d04875a3\",\"volume_path\":\"/var/lib/kubelet/pods/b6ccf3ff-f0fc-411e-b5aa-5bbd61174578/volumes/kubernetes.io~csi/pvc-6eb8c148-32b0-45af-8945-2799d04875a3/mount\"}"
|
||||
[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:37.576536 1 node.go:524] "NodeGetCapabilities: called"
|
||||
[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:37.577998 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945\",\"volume_path\":\"/var/lib/kubelet/pods/f3402b78-9a95-4a5c-89c9-7535456d39e0/volumes/kubernetes.io~csi/pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945/mount\"}"
|
||||
[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:47.887356 1 node.go:524] "NodeGetCapabilities: called"
|
||||
[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:47.888572 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f\",\"volume_path\":\"/var/lib/kubelet/pods/ce3b896c-9957-4a70-b713-265ab487c32b/volumes/kubernetes.io~csi/pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f/mount\"}"
|
||||
[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:49.095236 1 node.go:524] "NodeGetCapabilities: called"
|
||||
[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:49.096521 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780\",\"volume_path\":\"/var/lib/kubelet/pods/919bd05a-93f8-44e3-850e-7a8dd2a570d6/volumes/kubernetes.io~csi/pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780/mount\"}"
|
||||
[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:53.657181 1 node.go:524] "NodeGetCapabilities: called"
|
||||
[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:53.658240 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b\",\"volume_path\":\"/var/lib/kubelet/pods/6f2a60b0-1a3a-405b-9344-59e91ed09b23/volumes/kubernetes.io~csi/pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b/mount\"}"
|
||||
[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:53.659625 1 node.go:524] "NodeGetCapabilities: called"
|
||||
[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:53.660965 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb\",\"volume_path\":\"/var/lib/kubelet/pods/6f2a60b0-1a3a-405b-9344-59e91ed09b23/volumes/kubernetes.io~csi/pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb/mount\"}"
|
||||
[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:20:09.981192 1 node.go:524] "NodeGetCapabilities: called"
|
||||
[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:20:09.982711 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242\",\"volume_path\":\"/var/lib/kubelet/pods/fa9abffb-f2c3-470f-9ee7-7bd93688270c/volumes/kubernetes.io~csi/pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242/mount\"}"
|
||||
[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:20:11.278791 1 node.go:524] "NodeGetCapabilities: called"
|
||||
[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:20:11.280160 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd\",\"volume_path\":\"/var/lib/kubelet/pods/9ce6cd32-c936-4d17-8597-3efdb4845bc8/volumes/kubernetes.io~csi/pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd/mount\"}"
|
||||
[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:03.366763 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8\",\"volume_path\":\"/var/lib/kubelet/pods/acf12f16-e6fd-4934-a561-577be079d7fa/volumes/kubernetes.io~csi/pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8/mount\"}"
|
||||
[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:32.621786 1 node.go:524] "NodeGetCapabilities: called"
|
||||
[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:32.622940 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9\",\"volume_path\":\"/var/lib/kubelet/pods/71957a25-d462-4eed-a51a-25bec487e7d6/volumes/kubernetes.io~csi/pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9/mount\"}"
|
||||
[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:52.802709 1 node.go:524] "NodeGetCapabilities: called"
|
||||
[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:52.804175 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f\",\"volume_path\":\"/var/lib/kubelet/pods/baea777b-a7d7-404b-b642-f7e41d3b74de/volumes/kubernetes.io~csi/pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f/mount\"}"
|
||||
[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:11.307289 1 node.go:524] "NodeGetCapabilities: called"
|
||||
[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:11.308598 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf\",\"volume_path\":\"/var/lib/kubelet/pods/288247da-f98a-4d43-9f15-e882d4c7acb5/volumes/kubernetes.io~csi/pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf/mount\"}"
|
||||
[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:37.015178 1 node.go:524] "NodeGetCapabilities: called"
|
||||
[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:37.016475 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-fd1afe82-6d46-464d-bd8c-159690678f3a\",\"volume_path\":\"/var/lib/kubelet/pods/096b52fa-6650-4996-8813-dd472343cf8e/volumes/kubernetes.io~csi/pvc-fd1afe82-6d46-464d-bd8c-159690678f3a/mount\"}"
|
||||
[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:54.754757 1 node.go:524] "NodeGetCapabilities: called"
|
||||
[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:54.755939 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8\",\"volume_path\":\"/var/lib/kubelet/pods/acf12f16-e6fd-4934-a561-577be079d7fa/volumes/kubernetes.io~csi/pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8/mount\"}"
|
||||
[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:57.979195 1 node.go:524] "NodeGetCapabilities: called"
|
||||
[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:57.980398 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9\",\"volume_path\":\"/var/lib/kubelet/pods/71957a25-d462-4eed-a51a-25bec487e7d6/volumes/kubernetes.io~csi/pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9/mount\"}"
|
||||
[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:20:20.775598 1 node.go:524] "NodeGetCapabilities: called"
|
||||
[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:20:20.776955 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f\",\"volume_path\":\"/var/lib/kubelet/pods/baea777b-a7d7-404b-b642-f7e41d3b74de/volumes/kubernetes.io~csi/pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f/mount\"}"
|
||||
```
|
||||
### Синхронизация GitOps (FluxCD):
|
||||
```text
|
||||
NAMESPACE NAME URL AGE READY STATUS
|
||||
flux-system gitrepository.source.toolkit.fluxcd.io/atlas-repo http://10.0.10.13:3000/atlas/atlas.git 33d True stored artifact for revision 'master@sha1:10fbe14ef463bef034856278733f9ad3155cd866'
|
||||
|
||||
NAMESPACE NAME AGE READY STATUS
|
||||
flux-system kustomization.kustomize.toolkit.fluxcd.io/apps-sync 33d True Applied revision: master@sha1:10fbe14ef463bef034856278733f9ad3155cd866
|
||||
flux-system kustomization.kustomize.toolkit.fluxcd.io/infra-sync 33d True Applied revision: master@sha1:10fbe14ef463bef034856278733f9ad3155cd866
|
||||
|
||||
NAMESPACE NAME AGE READY STATUS
|
||||
cert-manager helmrelease.helm.toolkit.fluxcd.io/cert-manager 33d True Helm upgrade succeeded for release cert-manager/cert-manager.v2 with chart cert-manager@v1.21.3
|
||||
external-secrets helmrelease.helm.toolkit.fluxcd.io/external-secrets 33d True Helm upgrade succeeded for release external-secrets/external-secrets.v5 with chart external-secrets@2.14.0
|
||||
kube-system helmrelease.helm.toolkit.fluxcd.io/cilium 33d True Helm upgrade succeeded for release kube-system/cilium.v6 with chart cilium@1.15.5
|
||||
kube-system helmrelease.helm.toolkit.fluxcd.io/proxmox-csi-plugin 33d True Helm upgrade succeeded for release kube-system/proxmox-csi-plugin.v4 with chart proxmox-csi-plugin@0.5.12
|
||||
```
|
||||
### Проблемные поды (Non-Running):
|
||||
```text
|
||||
NAMESPACE NAME READY STATUS RESTARTS AGE
|
||||
databases postgres-init-databases-4lk9r 0/1 Completed 0 169m
|
||||
```
|
||||
### Последние события-предупреждения (Warning Events):
|
||||
```text
|
||||
NAMESPACE LAST SEEN TYPE REASON OBJECT MESSAGE
|
||||
traefik 42m Warning FailedToStartServiceHealthcheck service/traefik node talos-worker-1 failed to start healthcheck "traefik/traefik" on port 30366: listen tcp4 10.0.20.11:30366: bind: address already in use
|
||||
traefik 42m Warning FailedToStartServiceHealthcheck service/traefik node talos-1il-vwa failed to start healthcheck "traefik/traefik" on port 30366: listen tcp4 10.0.20.10:30366: bind: address already in use
|
||||
traefik 12m Warning FailedToStartServiceHealthcheck service/traefik node talos-worker-1 failed to start healthcheck "traefik/traefik" on port 30366: listen tcp4 10.0.20.11:30366: bind: address already in use
|
||||
traefik 12m Warning FailedToStartServiceHealthcheck service/traefik node talos-1il-vwa failed to start healthcheck "traefik/traefik" on port 30366: listen tcp4 10.0.20.10:30366: bind: address already in use
|
||||
monitoring 51m Warning FailedCreate daemonset/vector-agent Error creating: pods "vector-agent-7tjsw" is forbidden: violates PodSecurity "baseline:latest": hostPath volumes (volume "var-log-pods")
|
||||
monitoring 34m Warning FailedCreate daemonset/vector-agent Error creating: pods "vector-agent-t6n9v" is forbidden: violates PodSecurity "baseline:latest": hostPath volumes (volume "var-log-pods")
|
||||
monitoring 17m Warning FailedCreate daemonset/vector-agent Error creating: pods "vector-agent-rsbtk" is forbidden: violates PodSecurity "baseline:latest": hostPath volumes (volume "var-log-pods")
|
||||
flux-system 16m Warning UpdateFailed externalsecret/atlas-repo-auth could not get secret data from provider
|
||||
flux-system 3m34s Warning UpdateFailed externalsecret/atlas-repo-auth could not get secret data from provider
|
||||
monitoring 73s Warning FailedCreate daemonset/vector-agent Error creating: pods "vector-agent-xsj4k" is forbidden: violates PodSecurity "baseline:latest": hostPath volumes (volume "var-log-pods")
|
||||
```
|
||||
### Реальный объем данных OpenCloud (/var/lib/opencloud-users):
|
||||
```text
|
||||
331.7G /var/lib/opencloud-users
|
||||
```
|
||||
</file>
|
||||
|
||||
</files>
|
||||
|
|
|
|||
Loading…
Reference in a new issue