Parham Monfared
1262690276
The single-file stdlib server became the limit: no way to track what had been done about an alert, no accounts, and a UI that had to be hand-rolled in template strings. This restructures it into something deployable. Backend (FastAPI) - app/ holds config, database, auth, delivery and the routers; triagelib keeps the triage engine unchanged, so the validated screening and runbook logic is untouched. - Cases persist per alert fingerprint with a status workflow (investigating, customer contacted, escalated to Infra, waiting, remediated, resolved, won't fix, false positive), an assignee, notes and an append-only history. An alert that stops and re-fires lands back on the same case and counts as a reopen. - Suppression rules move from a JSON file into the database. Auth - Signed session cookies over PBKDF2 local accounts, plus an OIDC flow ready for Authentik: users are created on first login and admin follows a group claim. Local login can be switched off entirely once SSO is live. Zendesk and Jira - Delivery is now implemented, behind three gates: the integration must be configured, its feature flag on, and CX_FEATURE_SEND_ENABLED on. A demo instance leaves the last off and cannot mail anyone. Both search before creating, so re-diagnosing an alert updates one ticket rather than opening several, and a rolling daily cap stops a loop mailing everybody. Deployment - Multi-stage Dockerfile builds the bundle and serves it from the API origin. - docker-compose for local and single-host use; Gitea Actions runs the tests, builds the image and renders deploy/k8s with envsubst. Two fixes found while testing: assigning a case returned a null assignee, and add_event could leave an already-loaded history collection stale. Known gap: the engine reaches OpenStack via `docker exec <region>-osc`, which does not work in a pod without the CX-Tools containers alongside it. docs/DEPLOYMENT.md sets out the three ways to close that. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
52 lines
1.6 KiB
YAML
52 lines
1.6 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: cx-triage
|
|
namespace: ${NAMESPACE}
|
|
labels: { app: cx-triage }
|
|
spec:
|
|
replicas: ${REPLICAS}
|
|
strategy: { type: RollingUpdate }
|
|
selector:
|
|
matchLabels: { app: cx-triage }
|
|
template:
|
|
metadata:
|
|
labels: { app: cx-triage }
|
|
spec:
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 10001
|
|
fsGroup: 10001
|
|
containers:
|
|
- name: app
|
|
image: ${IMAGE_REF}
|
|
imagePullPolicy: IfNotPresent
|
|
ports: [{ containerPort: 8080, name: http }]
|
|
envFrom:
|
|
- configMapRef: { name: cx-triage-config }
|
|
- secretRef: { name: cx-triage }
|
|
readinessProbe:
|
|
httpGet: { path: /api/health, port: http }
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
httpGet: { path: /api/health, port: http }
|
|
# Startup warms a week of alert history, so allow a slow first start.
|
|
initialDelaySeconds: 60
|
|
periodSeconds: 30
|
|
resources:
|
|
requests: { cpu: 100m, memory: 256Mi }
|
|
limits: { cpu: "1", memory: 1Gi }
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities: { drop: ["ALL"] }
|
|
volumeMounts:
|
|
- { name: tmp, mountPath: /tmp }
|
|
- { name: data, mountPath: /data }
|
|
volumes:
|
|
- name: tmp
|
|
emptyDir: {}
|
|
- name: data
|
|
emptyDir: {} # state lives in Postgres; this is scratch only
|