Kubernetes 部署 JumpServer 与钉钉告警集成指南

Tue, 19 Nov 2024 00:00:00 +0000

ingress

需要搭建 ingress（详见13-K8s ingress-nginx 服务证书）并开启 TCP 转发（详见23-K8s ingress TCP 转发）。

jumpserver

“安装”

`1`	`helm install jms-k8s ./jumpserver-v4.6.0 -n jumpserver --create-namespace -f values.yaml`

“更新”

`1`	`helm upgrade jms-k8s ./jumpserver-v4.6.0 -n jumpserver --create-namespace -f values.yaml`

“卸载”
1

helm -n jumpserver delete jms-k8s

core 组件镜像

修改 core 组件，支持钉钉告警

docker pull docker.1ms.run/jumpserver/core:v4.6.0-ce

cd core
docker build -t jumpserver/core:v4.6.1-ce .

“Dockerfile”

1
2
3

FROM docker.1ms.run/jumpserver/core:v4.6.0-ce

COPY ./notifications.py /opt/jumpserver/apps/notifications/notifications.py

“notifications.py”

import textwrap
import time
import traceback
from itertools import chain

from celery import shared_task
from django.utils.translation import gettext_lazy as _
from html2text import HTML2Text

from common.utils import lazyproperty
from common.utils.timezone import local_now
from notifications.backends import BACKEND
from settings.utils import get_login_title
from terminal.const import RiskLevelChoices
from users.models import User
from .models import SystemMsgSubscription, UserMsgSubscription

__all__ = ('SystemMessage', 'UserMessage', 'system_msgs', 'Message')

system_msgs = []
user_msgs = []


class MessageType(type):
	def __new__(cls, name, bases, attrs: dict):
		clz = type.__new__(cls, name, bases, attrs)

		if 'message_type_label' in attrs \
				and 'category' in attrs \
				and 'category_label' in attrs:
			message_type = clz.get_message_type()

			msg = {
				'message_type': message_type,
				'message_type_label': attrs['message_type_label'],
				'category': attrs['category'],
				'category_label': attrs['category_label'],
			}
			if issubclass(clz, SystemMessage):
				system_msgs.append(msg)
			elif issubclass(clz, UserMessage):
				user_msgs.append(msg)

		return clz


@shared_task(
	verbose_name=_('Publish the station message'),
	description=_(
		"""This task needs to be executed for sending internal messages for system alerts, 
		work orders, and other notifications"""
	)
)
def publish_task(receive_user_ids, backends_msg_mapper):
	Message.send_msg(receive_user_ids, backends_msg_mapper)


def send_dingtalk_task(message):
	# 发送到自定义的 Webhook
	import hmac, hashlib, base64, urllib.parse
	timestamp = str(round(time.time() * 1000))
	# JumpServer
	access_token = '<access token>'
	secret = '<secret>'

	# smartvision
	secret_enc = secret.encode('utf-8')
	string_to_sign = '{}\n{}'.format(timestamp, secret)
	string_to_sign_enc = string_to_sign.encode('utf-8')
	hmac_code = hmac.new(secret_enc, string_to_sign_enc, digestmod=hashlib.sha256).digest()
	sign = urllib.parse.quote_plus(base64.b64encode(hmac_code))
	form_data = {
		"msgtype": "markdown",
		"markdown": {
			"title": "JumpServer 监控报警",
			"text": message
		},
		"at": {
			"atMobiles": [
				"<mobile>"
			],
			"isAtAll": False
		}
	}
	import requests
	try:
		res = requests.post(
			url=f'https://oapi.dingtalk.com/robot/send?access_token={access_token}&timestamp={timestamp}&sign={sign}',
			json=form_data)
	except Exception as e:
		with open('/opt/error.log', 'a+') as f:
			f.write(str(e))


class Message(metaclass=MessageType):
	"""
	这里封装了什么？
		封装不同消息的模板，提供统一的发送消息的接口
		- publish 该方法的实现与消息订阅的表结构有关
		- send_msg
	"""
	message_type_label: str
	category: str
	category_label: str
	text_msg_ignore_links = True
	command = None

	@classmethod
	def get_message_type(cls):
		return cls.__name__

	def publish_async(self):
		self.publish(is_async=True)

	@classmethod
	def gen_test_msg(cls):
		raise NotImplementedError

	def publish(self, is_async=False):
		raise NotImplementedError

	def get_backend_msg_mapper(self, backends):
		backends = set(backends)
		backends.add(BACKEND.SITE_MSG)  # 站内信必须发
		backends_msg_mapper = {}
		for backend in backends:
			backend = BACKEND(backend)
			if not backend.is_enable:
				continue
			get_msg_method = getattr(self, f'get_{backend}_msg', self.get_common_msg)
			msg = get_msg_method()
			backends_msg_mapper[backend] = msg
		return backends_msg_mapper

	@staticmethod
	def send_msg(receive_user_ids, backends_msg_mapper):
		for backend, msg in backends_msg_mapper.items():
			try:
				backend = BACKEND(backend)
				client = backend.client()
				users = User.objects.filter(id__in=receive_user_ids).all()
				client.send_msg(users, **msg)
			except NotImplementedError:
				continue
			except:
				traceback.print_exc()

	@classmethod
	def send_test_msg(cls, ding=True, wecom=False):
		msg = cls.gen_test_msg()
		if not msg:
			return

		from users.models import User
		users = User.objects.filter(username='admin')
		backends = []
		if ding:
			backends.append(BACKEND.DINGTALK)
		if wecom:
			backends.append(BACKEND.WECOM)
		msg.send_msg(users, backends)

	@staticmethod
	def get_common_msg() -> dict:
		return {'subject': '', 'message': ''}

	def get_html_msg(self) -> dict:
		return self.get_common_msg()

	@staticmethod
	def html_to_markdown(html_msg):
		h = HTML2Text()
		h.body_width = 0
		content = html_msg['message']
		html_msg['message'] = h.handle(content)
		return html_msg

	def get_markdown_msg(self) -> dict:
		return self.html_to_markdown(self.get_html_msg())

	def get_text_msg(self) -> dict:
		h = HTML2Text()
		h.body_width = 90
		msg = self.get_html_msg()
		content = msg['message']
		h.ignore_links = self.text_msg_ignore_links
		msg['message'] = h.handle(content)
		return msg

	@lazyproperty
	def common_msg(self) -> dict:
		return self.get_common_msg()

	@lazyproperty
	def text_msg(self) -> dict:
		msg = self.get_text_msg()
		return msg

	@lazyproperty
	def markdown_msg(self):
		return self.get_markdown_msg()

	@lazyproperty
	def get_jumpserver_dingtalk_msg(self) -> str:
		date_str = time.strftime("%Y-%m-%d %H:%M:%S", time.localtime())
		msg = f"""## <font color="#FF0000">[JumpServer 监控告警](https://jumpserver.example.com/)</font>🔥
### <font color="#FF0000">告警状态</font>：{RiskLevelChoices.get_label(self.command['risk_level'])}
### <font color="#FF0000">告警主机</font>：{self.command['asset']}
### <font color="#FF0000">目标用户</font>：{self.command['user']}
### <font color="#FF0000">输入命令</font>：`{self.command['input']}`
### <font color="#FF0000">告警详情</font>：用户 {self.command['user']} 在 {self.command['asset']} 上执行了危险命令 `{self.command['input']}`，请及时处理！
### <font color="#FF0000">触发时间</font>：{date_str}"""
		return msg

	@lazyproperty
	def html_msg(self) -> dict:
		msg = self.get_html_msg()
		return msg

	@lazyproperty
	def html_msg_with_sign(self):
		msg = self.get_html_msg()
		msg['message'] = textwrap.dedent("""
		{}
		<small>
		<br />
		—
		<br />
		{}
		</small>
		""").format(msg['message'], self.signature)
		return msg

	@lazyproperty
	def text_msg_with_sign(self):
		msg = self.get_text_msg()
		msg['message'] = textwrap.dedent("""
		{}
		—
		{}
		""").format(msg['message'], self.signature)
		return msg

	@lazyproperty
	def signature(self):
		return get_login_title()

	# --------------------------------------------------------------
	# 支持不同发送消息的方式定义自己的消息内容，比如有些支持 html 标签
	def get_dingtalk_msg(self) -> dict:
		# 钉钉相同的消息一天只能发一次，所以给所有消息添加基于时间的序号，使他们不相同
		message = self.markdown_msg['message']
		time = local_now().strftime('%Y-%m-%d %H:%M:%S')
		suffix = '\n{}: {}'.format(_('Time'), time)

		return {
			'subject': self.markdown_msg['subject'],
			'message': message + suffix
		}

	def get_wecom_msg(self) -> dict:
		return self.markdown_msg

	def get_feishu_msg(self) -> dict:
		return self.markdown_msg

	def get_lark_msg(self) -> dict:
		return self.markdown_msg

	def get_email_msg(self) -> dict:
		return self.html_msg_with_sign

	def get_site_msg_msg(self) -> dict:
		return self.html_msg

	def get_slack_msg(self) -> dict:
		return self.markdown_msg

	def get_sms_msg(self) -> dict:
		return self.text_msg_with_sign

	@classmethod
	def get_all_sub_messages(cls):
		def get_subclasses(cls):
			"""returns all subclasses of argument, cls"""
			if issubclass(cls, type):
				subclasses = cls.__subclasses__(cls)
			else:
				subclasses = cls.__subclasses__()
			for subclass in subclasses:
				subclasses.extend(get_subclasses(subclass))
			return subclasses

		messages_cls = get_subclasses(cls)
		return messages_cls

	@classmethod
	def test_all_messages(cls, ding=True, wecom=False):
		messages_cls = cls.get_all_sub_messages()

		for _cls in messages_cls:
			try:
				_cls.send_test_msg(ding=ding, wecom=wecom)
			except NotImplementedError:
				continue


class SystemMessage(Message):
	def publish(self, is_async=False):
		subscription = SystemMsgSubscription.objects.get(
			message_type=self.get_message_type()
		)

		# 只发送当前有效后端
		receive_backends = subscription.receive_backends
		receive_backends = BACKEND.filter_enable_backends(receive_backends)

		users = [
			*subscription.users.all(),
			*chain(*[g.users.all() for g in subscription.groups.all()])
		]

		receive_user_ids = [u.id for u in users]
		backends_msg_mapper = self.get_backend_msg_mapper(receive_backends)
		if is_async:
			send_dingtalk_task(self.get_jumpserver_dingtalk_msg)
			# publish_task.delay(receive_user_ids, backends_msg_mapper)
		else:
			self.send_msg(receive_user_ids, backends_msg_mapper)

	@classmethod
	def post_insert_to_db(cls, subscription: SystemMsgSubscription):
		pass

	@classmethod
	def gen_test_msg(cls):
		raise NotImplementedError


class UserMessage(Message):
	user: User

	def __init__(self, user):
		self.user = user

	def publish(self, is_async=False):
		"""
		发送消息到每个用户配置的接收方式上
		"""
		sub = UserMsgSubscription.objects.get(user=self.user)
		backends_msg_mapper = self.get_backend_msg_mapper(sub.receive_backends)
		receive_user_ids = [self.user.id]
		if is_async:
			send_dingtalk_task(self.get_jumpserver_dingtalk_msg)
			# publish_task.delay(receive_user_ids, backends_msg_mapper)
		else:
			self.send_msg(receive_user_ids, backends_msg_mapper)

	@classmethod
	def get_test_user(cls):
		from users.models import User
		return User.objects.all().first()

	@classmethod
	def gen_test_msg(cls):
		raise NotImplementedError

values.yaml

```yaml
# Default values for jumpserver.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

nameOverride: ""
fullnameOverride: ""

## @param global.imageRegistry Global Docker image registry
## @param global.imagePullSecrets Global Docker registry secret names as an array
## @param global.storageClass Global StorageClass for Persistent Volume(s)
## @param global.redis.password Global Redis™ password (overrides `externalRedis.password`)
##
global:
imageRegistry: docker.1ms.run
imageOwner: jumpserver
## E.g.
#  imagePullSecrets:
#  - myRegistryKeySecretName
##
imagePullSecrets: []
storageClass: ""

## Please configure your PostgreSQL server first
## Jumpserver will not start the external PostgreSQL server.
##
externalDatabase:
engine: postgresql
host: postgresql-svc.middleware.svc.cluster.local
port: 5432
user: postgres
password: "uLwHDyYr"
database: jumpserver

## Please configure your Redis server first
## Jumpserver will not start the external Redis server.
##
externalSentinel:
{}
# hosts: mymaster/localhost:26379,localhost:26380,localhost:26381
# password: ""
# socketTimeout: 5

## Sentinel or Redis one of them must be configured.

externalRedis:
host: redis-svc.middleware.svc.cluster.local
port: 6379
password: "******"

serviceAccount:
## Specifies whether a service account should be created
create: false
## The name of the service account to use.
## If not set and create is true, a name is generated using the fullname template
name:

ingress:
enabled: true
annotations:
	cert-manager.io/cluster-issuer: sencrypt-prod
	# nginx.ingress.kubernetes.io/enable-cors: "true"
	# nginx.ingress.kubernetes.io/cors-allow-methods: "GET, POST, OPTIONS, PUT, DELETE"
	# nginx.ingress.kubernetes.io/cors-allow-headers: "Authorization, Content-Type"
	# nginx.ingress.kubernetes.io/cors-allow-credentials: "true"
	# nginx.ingress.kubernetes.io/cors-allow-origin: "*"
	# kubernetes.io/tls-acme: "true"
	kubernetes.io/ingress.class: nginx
	nginx.ingress.kubernetes.io/proxy-body-size: "4096m"
	nginx.ingress.kubernetes.io/server-snippets: |
	proxy_set_header Upgrade "websocket";
	proxy_set_header Connection "Upgrade";

hosts:
	- "jumpserver.example.com"
tls:
	- hosts:
		- jumpserver.example.com
	secretName: jumpserver.example.com

core:
enabled: true

labels:
	app.jumpserver.org/name: jms-core

config:
	## Generate a new random secret key by execute `cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 50`
	secretKey: "TAcm23tDmN9n7cVCbgkDo6ln62qTuXYDKfLFYPFLd1y7DL5cS9"
	## Generate a new random bootstrap token by execute `cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 24`
	bootstrapToken: "KX8k37hBbQjmKgRDR17QF7EB"
	## Enabled it for debug
	debug: false
	log:
	level: ERROR

replicaCount: 1

image:
	registry: docker.1ms.run
	pullPolicy: IfNotPresent

env:
	## See: https://docs.jumpserver.org/zh/master/admin-guide/env/#core
	SESSION_EXPIRE_AT_BROWSER_CLOSE: true
	# SESSION_COOKIE_AGE: 86400
	# SECURITY_VIEW_AUTH_NEED_MFA: true
	## Django CSRF_TRUSTED_ORIGINS need to be set to the domain name of the jumpserver (https://docs.jumpserver.org/zh/v3/installation/upgrade_notice/)
	DOMAINS: "192.168.142.56:33380"

livenessProbe:
	initialDelaySeconds: 90
	failureThreshold: 3
	timeoutSeconds: 5
	httpGet:
	path: /api/health/
	port: web

podSecurityContext:
	{}
	# fsGroup: 2000

securityContext:
	{}
	# capabilities:
	#   drop:
	#   - ALL
	# readOnlyRootFilesystem: true
	# runAsNonRoot: true
	# runAsUser: 1000

service:
	type: ClusterIP
	web:
	port: 8080

resources:
	{}
	## We usually recommend not to specify default resources and to leave this as a conscious
	## choice for the user. This also increases chances charts run on environments with little
	## resources, such as Minikube. If you do want to specify resources, uncomment the following
	## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
	# limits:
	#   cpu: 1000m
	#   memory: 2048Mi
	# requests:
	#   cpu: 500m
	#   memory: 1024Mi

persistence:
	storageClassName: storage
	accessModes:
	- ReadWriteMany
	size: 100Gi
	annotations:
	"helm.sh/resource-policy": keep
	finalizers:
	- kubernetes.io/pvc-protection
	# subPath: ""
	# existingClaim: ""

volumeMounts: []

volumes: []

nodeSelector: {}

tolerations: []

affinity: {}

koko:
enabled: true

labels:
	app.jumpserver.org/name: jms-koko

config:
	log:
	level: ERROR

replicaCount: 1

image:
	registry: docker.1ms.run
	pullPolicy: IfNotPresent

env:
	[]
	## See: https://docs.jumpserver.org/zh/master/admin-guide/env/#koko
	# LANGUAGE_CODE: zh
	# REUSE_CONNECTION: true
	# ENABLE_LOCAL_PORT_FORWARD: true
	# ENABLE_VSCODE_SUPPORT: true

livenessProbe:
	initialDelaySeconds: 10
	failureThreshold: 3
	timeoutSeconds: 5
	httpGet:
	path: /koko/health/
	port: web

podSecurityContext:
	{}
	# fsGroup: 2000

securityContext:
	privileged: true
	# capabilities:
	#   drop:
	#   - ALL
	# readOnlyRootFilesystem: true
	# runAsNonRoot: true
	# runAsUser: 1000

service:
	type: ClusterIP
	web:
	port: 5000
	ssh:
	port: 2222

resources:
	{}
	## We usually recommend not to specify default resources and to leave this as a conscious
	## choice for the user. This also increases chances charts run on environments with little
	## resources, such as Minikube. If you do want to specify resources, uncomment the following
	## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
	# limits:
	#   cpu: 100m
	#   memory: 128Mi
	# requests:
	#   cpu: 100m
	#   memory: 128Mi

persistence:
	storageClassName: storage
	accessModes:
	- ReadWriteMany
	size: 10Gi
	annotations:
	"helm.sh/resource-policy": keep
	finalizers:
	- kubernetes.io/pvc-protection
	# subPath: ""
	# existingClaim: ""

volumeMounts: []

volumes: []

nodeSelector: {}

tolerations: []

affinity: {}

lion:
enabled: true

labels:
	app.jumpserver.org/name: jms-lion

config:
	log:
	level: ERROR

replicaCount: 1

image:
	registry: docker.1ms.run
	pullPolicy: IfNotPresent

env:
	## See: https://docs.jumpserver.org/zh/master/admin-guide/env/#lion
	JUMPSERVER_ENABLE_FONT_SMOOTHING: true
	# JUMPSERVER_COLOR_DEPTH: 32
	# JUMPSERVER_ENABLE_WALLPAPER: true
	# JUMPSERVER_ENABLE_THEMING: true
	# JUMPSERVER_ENABLE_FULL_WINDOW_DRAG: true
	# JUMPSERVER_ENABLE_DESKTOP_COMPOSITION: true
	# JUMPSERVER_ENABLE_MENU_ANIMATIONS: true

livenessProbe:
	initialDelaySeconds: 90
	failureThreshold: 3
	timeoutSeconds: 5
	httpGet:
	path: /lion/health/
	port: web

podSecurityContext:
	{}
	# fsGroup: 2000

securityContext:
	{}
	# capabilities:
	#   drop:
	#   - ALL
	# readOnlyRootFilesystem: true
	# runAsNonRoot: true
	# runAsUser: 1000

service:
	type: ClusterIP
	web:
	port: 8081

resources:
	{}
	## We usually recommend not to specify default resources and to leave this as a conscious
	## choice for the user. This also increases chances charts run on environments with little
	## resources, such as Minikube. If you do want to specify resources, uncomment the following
	## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
	# limits:
	#   cpu: 100m
	#   memory: 512Mi
	# requests:
	#   cpu: 100m
	#   memory: 512Mi

persistence:
	storageClassName: storage
	accessModes:
	- ReadWriteMany
	size: 50Gi
	annotations:
	"helm.sh/resource-policy": keep
	finalizers:
	- kubernetes.io/pvc-protection
	# subPath: ""
	# existingClaim: ""

volumeMounts: []

volumes: []

nodeSelector: {}

tolerations: []

affinity: {}

chen:
enabled: true

labels:
	app.jumpserver.org/name: jms-chen

config:
	log:
	level: ERROR

replicaCount: 1

image:
	registry: docker.1ms.run
	pullPolicy: IfNotPresent

env: []

livenessProbe:
	initialDelaySeconds: 60
	failureThreshold: 3
	timeoutSeconds: 5
	httpGet:
	path: /chen
	port: web

podSecurityContext:
	{}
	# fsGroup: 2000

securityContext:
	{}
	# capabilities:
	#   drop:
	#   - ALL
	# readOnlyRootFilesystem: true
	# runAsNonRoot: true
	# runAsUser: 1000

service:
	type: ClusterIP
	web:
	port: 8082

resources:
	{}
	## We usually recommend not to specify default resources and to leave this as a conscious
	## choice for the user. This also increases chances charts run on environments with little
	## resources, such as Minikube. If you do want to specify resources, uncomment the following
	## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
	# limits:
	#   cpu: 100m
	#   memory: 128Mi
	# requests:
	#   cpu: 100m
	#   memory: 128Mi

persistence:
	storageClassName: storage
	accessModes:
	- ReadWriteMany
	size: 10Gi
	annotations:
	"helm.sh/resource-policy": keep
	finalizers:
	- kubernetes.io/pvc-protection
	# subPath: ""
	# existingClaim: ""

volumeMounts: []

volumes: []

nodeSelector: {}

tolerations: []

affinity: {}

xpack:
enabled: false

magnus:
labels:
	app.jumpserver.org/name: jms-magnus

config:
	log:
	level: ERROR

replicaCount: 1

image:
	registry: docker.1ms.run
	pullPolicy: IfNotPresent

env: []

livenessProbe:
	initialDelaySeconds: 10
	failureThreshold: 3
	timeoutSeconds: 5
	httpGet:
	path: /health
	port: web

podSecurityContext:
	{}
	# fsGroup: 2000

securityContext:
	{}
	# capabilities:
	#   drop:
	#   - ALL
	# readOnlyRootFilesystem: true
	# runAsNonRoot: true
	# runAsUser: 1000

service:
	type: ClusterIP
	web:
	port: 8088
	mysql:
	port: 33061
	mariadb:
	port: 33062
	redis:
	port: 63790
	postgresql:
	port: 54320
	sqlserver:
	port: 14330
	oracle:
	ports: 30000-30100

resources:
	{}
	## We usually recommend not to specify default resources and to leave this as a conscious
	## choice for the user. This also increases chances charts run on environments with little
	## resources, such as Minikube. If you do want to specify resources, uncomment the following
	## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
	# limits:
	#   cpu: 100m
	#   memory: 512Mi
	# requests:
	#   cpu: 100m
	#   memory: 512Mi

persistence:
	storageClassName: storage
	accessModes:
	- ReadWriteMany
	size: 10Gi
	annotations:
	"helm.sh/resource-policy": keep
	finalizers:
	- kubernetes.io/pvc-protection
	# subPath: ""
	# existingClaim: ""

volumeMounts: []

volumes: []

nodeSelector: {}

tolerations: []

affinity: {}

xrdp:
labels:
	app.jumpserver.org/name: jms-xrdp

config:
	log:
	level: ERROR

replicaCount: 1

image:
	registry: registry.fit2cloud.com
	pullPolicy: IfNotPresent

env: []

livenessProbe:
	initialDelaySeconds: 10
	failureThreshold: 3
	timeoutSeconds: 5
	tcpSocket:
	port: rdp

podSecurityContext:
	{}
	# fsGroup: 2000

securityContext:
	{}
	# capabilities:
	#   drop:
	#   - ALL
	# readOnlyRootFilesystem: true
	# runAsNonRoot: true
	# runAsUser: 1000

service:
	type: ClusterIP
	rdp:
	port: 3390

resources:
	{}
	## We usually recommend not to specify default resources and to leave this as a conscious
	## choice for the user. This also increases chances charts run on environments with little
	## resources, such as Minikube. If you do want to specify resources, uncomment the following
	## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
	# limits:
	#   cpu: 100m
	#   memory: 128Mi
	# requests:
	#   cpu: 100m
	#   memory: 128Mi

persistence:
	storageClassName: storage
	accessModes:
	- ReadWriteMany
	size: 50Gi
	annotations:
	"helm.sh/resource-policy": keep
	finalizers:
	- kubernetes.io/pvc-protection
	# subPath: ""
	# existingClaim: ""

volumeMounts: []

volumes: []

nodeSelector: {}

tolerations: []

affinity: {}

razor:
labels:
	app.jumpserver.org/name: jms-razor

config:
	log:
	level: ERROR

replicaCount: 1

image:
	registry: registry.fit2cloud.com
	pullPolicy: IfNotPresent

env: []

livenessProbe:
	initialDelaySeconds: 10
	failureThreshold: 3
	timeoutSeconds: 5
	httpGet:
	path: /razor/health/
	port: web

podSecurityContext:
	{}
	# fsGroup: 2000

securityContext:
	{}
	# capabilities:
	#   drop:
	#   - ALL
	# readOnlyRootFilesystem: true
	# runAsNonRoot: true
	# runAsUser: 1000

service:
	type: ClusterIP
	web:
	port: 8084
	rdp:
	port: 3389

resources:
	{}
	## We usually recommend not to specify default resources and to leave this as a conscious
	## choice for the user. This also increases chances charts run on environments with little
	## resources, such as Minikube. If you do want to specify resources, uncomment the following
	## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
	# limits:
	#   cpu: 100m
	#   memory: 128Mi
	# requests:
	#   cpu: 100m
	#   memory: 128Mi

persistence:
	storageClassName: storage
	accessModes:
	- ReadWriteMany
	size: 50Gi
	annotations:
	"helm.sh/resource-policy": keep
	finalizers:
	- kubernetes.io/pvc-protection
	# subPath: ""
	# existingClaim: ""

volumeMounts: []

volumes: []

nodeSelector: {}

tolerations: []

affinity: {}

video:
labels:
	app.jumpserver.org/name: jms-video

config:
	log:
	level: ERROR

replicaCount: 1

image:
	registry: registry.fit2cloud.com
	pullPolicy: IfNotPresent

env: []

livenessProbe:
	initialDelaySeconds: 10
	failureThreshold: 3
	timeoutSeconds: 5
	httpGet:
	path: /video-worker/health/
	port: web

podSecurityContext:
	{}
	# fsGroup: 2000

securityContext:
	{}
	# capabilities:
	#   drop:
	#   - ALL
	# readOnlyRootFilesystem: true
	# runAsNonRoot: true
	# runAsUser: 1000

service:
	service:
	type: ClusterIP
	web:
	port: 9000

resources:
	{}
	## We usually recommend not to specify default resources and to leave this as a conscious
	## choice for the user. This also increases chances charts run on environments with little
	## resources, such as Minikube. If you do want to specify resources, uncomment the following
	## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
	# limits:
	#   cpu: 100m
	#   memory: 128Mi
	# requests:
	#   cpu: 100m
	#   memory: 128Mi

persistence:
	storageClassName: storage
	accessModes:
	- ReadWriteMany
	size: 50Gi
	annotations:
	"helm.sh/resource-policy": keep
	finalizers:
	- kubernetes.io/pvc-protection
	# subPath: ""
	# existingClaim: ""

volumeMounts: []

volumes: []

nodeSelector: {}

tolerations: []

affinity: {}

web:
enabled: true

labels:
	app.jumpserver.org/name: jms-web

replicaCount: 1

image:
	registry: docker.1ms.run
	pullPolicy: IfNotPresent

env:
	# nginx client_max_body_size, default 4G
	CLIENT_MAX_BODY_SIZE: 4096m
	## See: https://github.com/jumpserver/docker-web/blob/master/init.sh#L37
	# USE_LB: 1, then nginx use 'proxy_set_header X-Forwarded-For $remote_addr'
	# USE_LB: 0, then nginx use 'proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for'
	USE_LB: 0

livenessProbe:
	initialDelaySeconds: 10
	failureThreshold: 3
	timeoutSeconds: 5
	httpGet:
	path: /api/health/
	port: web

podSecurityContext:
	{}
	# fsGroup: 2000

securityContext:
	{}
	# capabilities:
	#   drop:
	#   - ALL
	# readOnlyRootFilesystem: true
	# runAsNonRoot: true
	# runAsUser: 1000

service:
	type: ClusterIP
	web:
	port: 80

resources:
	{}
	## We usually recommend not to specify default resources and to leave this as a conscious
	## choice for the user. This also increases chances charts run on environments with little
	## resources, such as Minikube. If you do want to specify resources, uncomment the following
	## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
	# limits:
	#   cpu: 100m
	#   memory: 128Mi
	# requests:
	#   cpu: 100m
	#   memory: 128Mi

persistence:
	storageClassName: storage
	accessModes:
	- ReadWriteMany
	size: 1Gi
	annotations:
	"helm.sh/resource-policy": keep
	finalizers:
	- kubernetes.io/pvc-protection
	# subPath: ""
	# existingClaim: ""

volumeMounts: []

volumes: []

nodeSelector: {}

tolerations: []

affinity: {}

```

修改 core 模块

1
2
3

kubectl -n jumpserver edit deployments.apps jms-k8s-jumpserver-jms-core

# 将 image 镜像名称修改为 jumpserver/core:v4.6.1-ce

Ingress on Kang's Blog

Kubernetes 部署 JumpServer 与钉钉告警集成指南

ingress

jumpserver

core 组件镜像

values.yaml

修改 core 模块