[pull] main from labring:main - #193
Open
pull[bot] wants to merge 3511 commits into
Open
Conversation
…6620) Fix kubeconfig lookup in buildKubeClient to properly handle systemd environments where HOME environment variable may not be set. Changes: - Add fallback to /root as default home directory when HOME is empty - This ensures kubeconfig can be found at /root/.kube/config in systemd services Resolves issue where image-cri-shim managed by systemd could not locate kubeconfig file due to missing HOME environment variable. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude <noreply@anthropic.com>
* init * init * remove kube-proxy-rbac * remove useless yaml # Conflicts: # controllers/account/deploy/manifests/account-manager-config.yaml.tmpl * adopt resources helm charts deploy * adopt resources/account helm charts deploy * remove the useless configmap
add gpu monitor.
feat: impl new docker image build method and makefile
remove source sealos.env
Add support for monitoring and charging ephemeral storage usage beyond a configurable threshold. Pods with ephemeral storage exceeding the threshold (default 10Gi) will be charged for the excess amount. Changes: - Add EPHEMERAL_STORAGE_CHARGE_THRESHOLD environment variable (default: 10Gi) - Track ephemeral storage usage per pod from container limits/requests - Apply threshold deduction and charge only for excess usage - Aggregate ephemeral storage charges into Storage resource metrics 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> # Conflicts: # controllers/resources/controllers/monitor_controller.go
…6629) fix the processing logic for downgraded invoices webhook
#6631) Signed-off-by: Nixieboluo <me@sagirii.me>
… api (#6443) Signed-off-by: Nixieboluo <me@sagirii.me>
…6567) * feat(template): add new config schema Signed-off-by: Nixieboluo <me@sagirii.me> * feat(shared): add config loader utils Signed-off-by: Nixieboluo <me@sagirii.me> * feat(template): try loading config file in instrumentation hook Signed-off-by: Nixieboluo <me@sagirii.me> * docs(shared): config loader docs Signed-off-by: Nixieboluo <me@sagirii.me> * feat(shared): client app config utils Signed-off-by: Nixieboluo <me@sagirii.me> * feat(template): setup client app config Signed-off-by: Nixieboluo <me@sagirii.me> * fix(shared): ensure client app config is fetched before loading other parts Signed-off-by: Nixieboluo <me@sagirii.me> * refactor(template): remove next public env vars Signed-off-by: Nixieboluo <me@sagirii.me> * feat(template): remove env var usages Signed-off-by: Nixieboluo <me@sagirii.me> * feat(template): remove system config (slide data) usages Signed-off-by: Nixieboluo <me@sagirii.me> * feat(template): remove system env store usage Signed-off-by: Nixieboluo <me@sagirii.me> * refactor(template): remove sidebar store Signed-off-by: Nixieboluo <me@sagirii.me> * feat(template): provide schema enforced config example Signed-off-by: Nixieboluo <me@sagirii.me> * fix(template): ignore log rules in instrumentation hook Signed-off-by: Nixieboluo <me@sagirii.me> --------- Signed-off-by: Nixieboluo <me@sagirii.me>
Signed-off-by: Nixieboluo <me@sagirii.me>
* add job helm charts for sealos deploy * add resource readme * save admin passwd to configmap & default generate random password
Refactor terminal controller deployment to use Helm charts for better manageability, following the pattern established by account controller. Major changes: - Replace manifests with Helm chart structure - Add terminal-controller-entrypoint.sh for automated deployment - Remove kube-rbac-proxy sidecar container - Remove kube-proxy-rbac (metrics-reader and proxy-role) - Metrics now bind to 127.0.0.1:8080 (internal only) - Update values.yaml with full image name format - Namespace created via helm --create-namespace flag - Support resource backup, adopt, and auto-configuration 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude <noreply@anthropic.com>
- Replace manifest-based deployment with Helm chart structure - Add Helm chart with standard templates (deployment, service, configmap) - Create account-service-entrypoint.sh for Helm installation - Update Kubefile to use Helm chart instead of manifests - Simplify deployment by reusing account-controller-manager service account - Remove unnecessary components (no webhook, RBAC, metrics, certificates) - Use compatible selector labels for seamless migration from manifests - Add comprehensive README.md with configuration examples and troubleshooting guide 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude <noreply@anthropic.com>
…#6590) * feat(desktop): share auth cookie across .sealos.io * update * tmp * fix update fix global token update update add brain update brain url update fix i18n?.changeLanguage?.(targetLang); delete log * fix openapp url * update cookie * fix template api * add toast * delete log
…LM_OPTIONS (#6652) * init * refactor(desktop): simplify entrypoint and unify configuration via HELM_OPTIONS - Simplify desktop-frontend-entrypoint.sh from 319 to 141 lines (56% reduction) - Remove all environment variable to Helm value conversion logic - Remove CURRENCY environment variable, use direct Helm values instead - Update all documentation to use correct sealos run syntax (-e flag only) - Add HELM_OPTIONS support for passing Helm --set parameters - Make all config.yaml values configurable via Helm values (60+ parameters) - Update README and HELM_VALUES_GUIDE documentation - Remove workorder and invite from allowedOrigins All configuration now unified through HELM_OPTIONS environment variable. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * refactor(desktop): auto-configure language and currency from version - Simplify configuration by removing forcedLanguage and currencySymbol - Auto-configure forcedLanguage based on version: cn→zh, en→en - Auto-configure currencySymbol based on version: cn→shellCoin, en→usd - Auto-configure discordInviteLink based on version: shown for en, empty for cn - Update all documentation to reflect simplified configuration - Reduce configuration parameters from 3 to 1 for language/currency settings Users now only need to set desktopConfig.version to cn or en. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>
feat(template): add owner ref to deployments Signed-off-by: Nixieboluo <me@sagirii.me>
Signed-off-by: Nixieboluo <me@sagirii.me>
* feat(devbox): add devbox condition, fix reconcile logic
fix(desktop): implement adaptive clipboard strategy for Safari compatibility
chore: add openclaw icon
* feat(applaunchpad): optimiaze doc's servers url * feat(applaunchpad): update get production server url
…#6675) Signed-off-by: Nixieboluo <me@sagirii.me>
* feat: basic feat * feat: test * feat: perf code to full feat * chore: update readme.md * feat: optional namespace * perf: podName logic adjust * chore: Prometheus->Metrics * chore: test adjust * chore: test logResult * chore: readme.zh-CN.md * chore: remove minio type * chore: adjust launchpad storage to disk * chore: transform enum to type * fix: try to fix ts bug * feat: devbox metrics support * feat: adjust other route * fix: whitelistKubernetesHosts sdk transform bug * feat: cache
…7167) Signed-off-by: cuisongliu <cuisongliu@qq.com>
…7158) * refactor: remove objectstorage project from monorepo * ci(frontends): avoid shell interpolation in matrix step
* feat(user): issue kubeconfigs with token requests Use the ServiceAccount TokenRequest subresource instead of manually managed service-account-token Secrets, and request long-lived tokens as a transition for existing kubeconfig consumers. * fix(user): bind token requests to a secret * fix(user): restore random token secret names * fix(user): satisfy golangci-lint * fix(user): satisfy golines * fix(user): clean up legacy service account token secrets * fix(user): satisfy golines * fix(user): clean up stale bound token secrets * fix(user): satisfy golines * fix(user): satisfy golines for token secret cleanup
* fix(user): make kube API client rate limit configurable * fix(user): add cloudDomain and cloudApiServerPort fallbacks Signed-off-by: Yun Pan <dinoallo@netc.it> * fix(user): increase the default kubeAPI.qps and kubeAPI.burst Signed-off-by: Yun Pan <dinoallo@netc.it> --------- Signed-off-by: Yun Pan <dinoallo@netc.it>
* feat(billing): route Stripe returns to declared app Signed-off-by: aimeritething <aimeritething@gmail.com> * fix(billing): persist Stripe callback app Signed-off-by: aimeritething <aimeritething@gmail.com> * fix(billing): address review feedback for Stripe payApp routing - Fix golangci-lint issues: use NewRequestWithContext and http.MethodPost in tests, drop a trailing blank line - Normalize array-valued app query params in the desktop Stripe callback resolver and cover it with a test - Simplify pendingTransactionPromotionCode with strings.SplitN - Rename the parser test to reflect it only verifies JSON binding - Refresh the stale callback URL example comment in buildURLs Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: aimeritething <aimeritething@gmail.com> * docs(pay): use placeholder values in callback URL example Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: aimeritething <aimeritething@gmail.com> --------- Signed-off-by: aimeritething <aimeritething@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix(account): prevent stale debt deletion after recharge * style(account): satisfy golangci-lint formatting * fix(account): improve debt deletion diagnostics
* feat(marketing): propagate attribution through desktop auth * fix(desktop): complete attribution handoff * fix(desktop): support persisted attribution sessions * fix(desktop): close attribution lifecycle gaps * fix(analytics): remove duplicate login success events
* fix(costcenter): embed Alipay cashier page via iframe The Alipay payment URL from TradePagePay is a signed gateway URL over 900 characters long, which cannot be scanned as a QR code. Switch to qr_pay_mode=4 (order code mode) so Alipay renders the official cashier page, return its auto-submitting form HTML as the payment code, and embed it in the frontend via an iframe. QR code rendering remains for legacy data. * refactor(pay): restore original alipay comments * refactor(costcenter): load Alipay cashier page via iframe src
* fix(desktop): expose pod workspace quota * fix(providers): support pod quota in provider quota boxes Adapt dbprovider, template and applaunchpad QuotaBoxes to render the new pod workspace quota item: add sourceMap color / icon entries and missing i18n keys, aligning zh label with the shared quota-dialog.
#7231) * feat(frontend): add Rybbit analytics integration with event forwarding Integrate self-hosted Rybbit analytics as an additional sink alongside the existing GTM pipeline, which remains fully unchanged: - Add RybbitScript component to @sealos/gtm, driven by the NEXT_PUBLIC_RYBBIT_HOST / NEXT_PUBLIC_RYBBIT_SITE_ID env vars; loads nothing when unset - Forward all track() events to window.rybbit.event() in addition to dataLayer; object props are JSON-serialized and truncated at 512 chars per value (Rybbit caps properties at 2KB, primitives only) - Mount RybbitScript in desktop / applaunchpad / dbprovider / template; dbprovider and template get an analytics script for the first time (their track() events previously had no consumer) - Document the env vars in desktop/.env.template Verified: @sealos/gtm, desktop, dbprovider and template production builds pass. The applaunchpad build failure is a pre-existing echarts SSR issue on main, confirmed unrelated via a stash control test. * refactor(frontend): drive Rybbit config from runtime backend config Address review feedback: replace build-time NEXT_PUBLIC_* env vars with runtime configuration delivered by each app's existing config channel, symmetric with how gtmId flows today. Config changes no longer require a rebuild and can be toggled per environment at deploy time. - RybbitScript is now props-driven (host / siteId); empty host or siteId disables it. No process.env reads remain - desktop: add layoutConfig.rybbitHost / rybbitSiteId (type, client defaults, Helm values + configmap), passed through at the mount point - applaunchpad: add analytics.rybbit.{host,siteId} to the config schemas (server + client), example yaml and chart configmap; read in getInitialProps alongside the existing gtm fields - dbprovider / template: add optional analytics.rybbit section to the config schemas, example yamls, chart configmaps and values; read in getInitialProps and pass to the mount point - New analytics sections are optional in the zod schemas so existing deployments keep working when only the image is upgraded - Drop the NEXT_PUBLIC_RYBBIT_* entries from desktop/.env.template; document rybbitHost/rybbitSiteId in the Helm values guides Verified: @sealos/gtm builds; desktop production build passes; dbprovider / template / applaunchpad compile successfully (applaunchpad still stops at the pre-existing echarts SSR issue on /app/detail/monitor, unchanged from main). * chore(desktop): restore .env.template to drop unrelated diff * fix(frontend): buffer early Rybbit events and allowlist host in provider CSP Review follow-up for the Rybbit integration: - Queue events fired before the Rybbit script finishes loading and flush them from RybbitScript onLoad, mirroring the dataLayer buffer the GTM path already has - Append the configured rybbitHost to script-src in both CSP annotations (nginx snippet + higress) of the dbprovider/template/ applaunchpad ingresses, so /api/script.js is not blocked when the integration is enabled; unset values render the CSP unchanged - Wire applaunchpad rybbitHost/rybbitSiteId through values instead of hardcoded empty strings in the configmap, matching dbprovider and template (the config channel was previously broken)
* fix(user): avoid full user lists in webhook validation * fix(user): satisfy golangci-lint * fix(user): use informer-backed user count * style(user): satisfy formatter checks * fix(user): wait for informer event sync
…plates (#7244) The official template one-click deploy lands in Brain via the OAuth page's openBrainTemplateDeploy branch: `/oauth?login=github&openapp=system-brain& templateName=...&templateForm=...` becomes an autolaunch for the Brain `/deploy` route. GitHub one-click deploy (Brain #283) needs the same entry point, but githubRepo/autoDeploy were silently ignored. Add the symmetric openBrainGithubDeploy branch: when openapp is system-brain and githubRepo is present, autolaunch Brain `/deploy?githubRepo=...& autoDeploy=1` so the Brain GitHub deployer opens with the repo pre-filled and auto-deploys once when autoDeploy=1. Works for both the token-login and already-logged-in paths; anything malformed falls through to normal openapp handling.
* feat(account): expose admin account read APIs * fix(account): satisfy golangci-lint * fix(account): satisfy golines formatting * fix(account): apply golangci-lint formatting * fix(account): address review feedback * feat(account): isolate admin jwt authentication * test(account): cover property reload admin auth * fix(account): satisfy context-aware request lint * fix(account): address admin auth review feedback
Signed-off-by: cuisongliu <cuisongliu@qq.com>
Signed-off-by: cuisongliu <cuisongliu@qq.com>
* perf(user): reduce controller cache memory * fix(user): resolve GVK for direct-read finalizers * perf(user): cache projected user fields * perf(user): project cached metadata fields * style(user): satisfy cache lint checks
* perf(resources): reduce controller cache memory * fix(resources): wait for projected cache sync
* perf(account): reduce controller cache memory usage * test(account): satisfy cache test lint checks * perf(account): limit pod informer cache * perf(account): cache projected pod fields * style(account): format pod cache test
* fix(account): enforce suspended namespace webhook * style(account): format webhook tests
…7267) While Brain (system-brain) is the topmost non-minimized window, AppDock (collapse pill included, zIndex 1000) no longer renders, so nothing overlays the Brain iframe. The dock returns as soon as Brain loses the top layer, is minimized, or is closed. Other apps and the floating-button shape are unaffected. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix(frontend): guard unknown workspace quota types Ignore quota resources that an older frontend bundle does not recognize and make quota formatting resilient to new SDK fields. Add a regression test for pod and unknown quota types. * build(client-sdk): bump package version to 0.1.22
* fix(client-sdk): target direct parent frame * build(client-sdk): bump package version to 0.1.21 * build(client-sdk): bump package version to 0.1.23
#7273) * fix(user): make admin namespace privilege configurable * fix(user): enforce PSA for orphan namespaces * fix(user): clean up disabled admin privilege * refactor(user): simplify startup reconciliation * fix(user): preserve legacy bound secret type * fix(user): skip kubeconfig refresh for legacy status * fix(user): retry failed kubeconfig sync * fix(user): persist kubeconfig sync condition * fix(user): retry failed resource synchronization * refactor(user): reduce startup cache memory * fix(user): wait for user count cache before reconcile * refactor(user): compact RBAC cache projections * perf(user): avoid copying cached kubeconfig * fix(user): schedule kubeconfig refresh by persisted deadline * refactor(user): expose queue priority to event handler * fix(user): harden controller lifecycle and requests * fix(user): cancel service account sync on shutdown * perf(user): filter pre-start child create events * docs(user): note streaming watch optimization * fix(user): harden event-driven reconciliation * chore(user): configure admin cluster admin setting * docs(user): clarify effective expiration minimum
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot]
Can you help keep this open source service alive? 💖 Please sponsor : )