seon
a500c3d40c
- Alloy 설정 3종: rule 블록을 한 줄 쉼표 나열에서 줄바꿈 속성으로 수정(실측: k8s DaemonSet
CrashLoopBackOff, db-replica alloy.service "expected TERMINATOR, got ,"). alloy fmt로 3종 파싱 확인.
- vm/postgres-common/alloy.sh: apt에 DPkg::Lock::Timeout=600(db-primary에서 unattended-upgrades 잠금으로 100 종료).
- vm/ai-env/compose.yaml: hitl 8081을 127.0.0.1에만 바인딩(agent는 compose 네트워크로 접근).
- workloads/rbac/ai-reader.yaml: nodes get/list/watch ClusterRole 추가(agent get_k8s(nodes) selfcheck 거부 해소).
- vm/harness/image.tag: f30af2a(POST /proposals/{token}/approve·reject 포함 러너).
43 lines
2.6 KiB
Bash
Executable File
43 lines
2.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Alloy on the PostgreSQL VMs (WP-15, experiment design 4.1 / 4.3). Called by vm/postgres-{primary,replica}/apply.sh.
|
|
# The harness role password is read from Secret Manager (selfheal-db-password) through the VM service account. Installs Alloy from the Grafana apt repository (systemd service `alloy`,
|
|
# config /etc/alloy/config.alloy, environment /etc/default/alloy; https://grafana.com/docs/alloy/latest/configure/linux/),
|
|
# exposes the built-in postgres exporter (pg_replication_lag_seconds) plus a custom query for pg_is_wal_replay_paused
|
|
# (not in the upstream replication collector), and ships /var/log/postgresql to Loki. Idempotent.
|
|
set -euo pipefail
|
|
HERE="$(cd "$(dirname "$0")" && pwd)"
|
|
if ! command -v alloy >/dev/null; then
|
|
mkdir -p /etc/apt/keyrings
|
|
wget -qO /etc/apt/keyrings/grafana.asc https://apt.grafana.com/gpg-full.key
|
|
chmod 644 /etc/apt/keyrings/grafana.asc
|
|
echo "deb [signed-by=/etc/apt/keyrings/grafana.asc] https://apt.grafana.com stable main" > /etc/apt/sources.list.d/grafana.list
|
|
# wait for unattended-upgrades instead of failing on the dpkg lock (db-primary 2026-10-08: "Could not get lock /var/lib/dpkg/lock-frontend")
|
|
apt-get -o DPkg::Lock::Timeout=600 update -qq
|
|
apt-get -o DPkg::Lock::Timeout=600 install -y -qq alloy >/dev/null
|
|
fi
|
|
usermod -aG adm alloy # /var/log/postgresql/*.log is postgres:adm 0640
|
|
install -d -m 755 /etc/alloy
|
|
install -m 644 "$HERE/config.alloy" /etc/alloy/config.alloy
|
|
install -m 644 "$HERE/queries.yaml" /etc/alloy/queries.yaml
|
|
PROJECT="$(curl -sf -H 'Metadata-Flavor: Google' http://metadata.google.internal/computeMetadata/v1/project/project-id)"
|
|
TOKEN="$(curl -sf -H 'Metadata-Flavor: Google' 'http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token' | jq -r .access_token)"
|
|
PGPASSWORD="$(curl -sf -H "Authorization: Bearer ${TOKEN}" "https://secretmanager.googleapis.com/v1/projects/${PROJECT}/secrets/selfheal-db-password/versions/latest:access" | jq -r .payload.data | base64 -d)"
|
|
unset TOKEN
|
|
[ -n "$PGPASSWORD" ] || { echo "empty DB password" >&2; exit 1; }
|
|
IP="$(hostname -I | awk '{print $1}')"
|
|
umask 077
|
|
cat > /etc/default/alloy <<ENV
|
|
CONFIG_FILE="/etc/alloy/config.alloy"
|
|
CUSTOM_ARGS="--server.http.listen-addr=127.0.0.1:12345 --storage.path=/var/lib/alloy/data"
|
|
INSTANCE="$(hostname)"
|
|
PG_DSN="postgresql://harness:${PGPASSWORD}@${IP}:5432/app?sslmode=require"
|
|
ENV
|
|
unset PGPASSWORD
|
|
systemctl enable alloy >/dev/null 2>&1 || true
|
|
systemctl restart alloy
|
|
for i in $(seq 1 20); do
|
|
c=$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:12345/-/ready || true)
|
|
[ "$c" = "200" ] && break; sleep 3
|
|
done
|
|
echo "alloy ready=$c"
|