opensource/sealos
3
0
Fork 0
mirror of https://github.com/labring/sealos.git synced 2026-08-28 17:22:42 +08:00
Code Issues Packages Projects Releases Wiki Activity
4,902 Commits 13 Branches 188 Tags
main
Commit Graph

724 Commits

Author SHA1 Message Date
zijiren d859f43238 fix(account): enforce suspended namespace webhook (#7266) 
* fix(account): enforce suspended namespace webhook

* style(account): format webhook tests
 2026-08-28 10:44:37 +08:00
zijiren b3dcab4119 perf(account): reduce controller cache memory usage (#7255) 
* perf(account): reduce controller cache memory usage

* test(account): satisfy cache test lint checks

* perf(account): limit pod informer cache

* perf(account): cache projected pod fields

* style(account): format pod cache test
 2026-08-27 16:51:09 +08:00
zijiren 91c24c7463 perf(resources): reduce controller cache memory (#7257) 
* perf(resources): reduce controller cache memory

* fix(resources): wait for projected cache sync
 2026-08-27 16:27:40 +08:00
zijiren 813b027777 perf(license): reduce controller cache memory (#7263) 2026-08-27 16:25:10 +08:00
zijiren a2a338dbcf perf(user): reduce controller cache memory usage (#7256) 
* perf(user): reduce controller cache memory

* fix(user): resolve GVK for direct-read finalizers

* perf(user): cache projected user fields

* perf(user): project cached metadata fields

* style(user): satisfy cache lint checks
 2026-08-27 16:22:19 +08:00
cuisongliu 8526c3a030 fix(clusterrole): expand permissions for kube-system namespace (#7264) 
Signed-off-by: cuisongliu <cuisongliu@qq.com>
 2026-08-26 22:14:59 +08:00
cuisongliu 7afc77ef3d fix(clusterrole): expand permissions for kube-system namespace (#7261) 
Signed-off-by: cuisongliu <cuisongliu@qq.com>
 2026-08-26 19:51:16 +08:00
Yun Pan beea1e56cb feat(account): expose admin account read APIs (#7220) 
* feat(account): expose admin account read APIs

* fix(account): satisfy golangci-lint

* fix(account): satisfy golines formatting

* fix(account): apply golangci-lint formatting

* fix(account): address review feedback

* feat(account): isolate admin jwt authentication

* test(account): cover property reload admin auth

* fix(account): satisfy context-aware request lint

* fix(account): address admin auth review feedback
 2026-08-21 15:05:38 +08:00
Yun Pan c82addbaa2 fix(user): avoid full User objects in webhook validation (#7240) 
* fix(user): avoid full user lists in webhook validation

* fix(user): satisfy golangci-lint

* fix(user): use informer-backed user count

* style(user): satisfy formatter checks

* fix(user): wait for informer event sync
 2026-08-21 11:18:19 +08:00
jingyang 03425c6a7c fix(costcenter): embed Alipay cashier page via iframe (#7237) 
* fix(costcenter): embed Alipay cashier page via iframe

The Alipay payment URL from TradePagePay is a signed gateway URL over
900 characters long, which cannot be scanned as a QR code. Switch to
qr_pay_mode=4 (order code mode) so Alipay renders the official cashier
page, return its auto-submitting form HTML as the payment code, and
embed it in the frontend via an iframe. QR code rendering remains for
legacy data.

* refactor(pay): restore original alipay comments

* refactor(costcenter): load Alipay cashier page via iframe src
 2026-08-19 17:56:09 +08:00
Yun Pan 95c67c41eb fix(account): wait for all deletion workers (#7232) 2026-08-18 15:21:49 +08:00
Yun Pan a706e3297a fix(account): prevent stale debt deletion after recharge (#7230) 
* fix(account): prevent stale debt deletion after recharge

* style(account): satisfy golangci-lint formatting

* fix(account): improve debt deletion diagnostics
 2026-08-18 11:26:51 +08:00
Phil Su a04e0eb544 feat(desktop): route Stripe returns to declared app (#7208) 
* feat(billing): route Stripe returns to declared app

Signed-off-by: aimeritething <aimeritething@gmail.com>

* fix(billing): persist Stripe callback app

Signed-off-by: aimeritething <aimeritething@gmail.com>

* fix(billing): address review feedback for Stripe payApp routing

- Fix golangci-lint issues: use NewRequestWithContext and
  http.MethodPost in tests, drop a trailing blank line
- Normalize array-valued app query params in the desktop
  Stripe callback resolver and cover it with a test
- Simplify pendingTransactionPromotionCode with strings.SplitN
- Rename the parser test to reflect it only verifies JSON binding
- Refresh the stale callback URL example comment in buildURLs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: aimeritething <aimeritething@gmail.com>

* docs(pay): use placeholder values in callback URL example

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: aimeritething <aimeritething@gmail.com>

---------

Signed-off-by: aimeritething <aimeritething@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
 2026-08-13 16:39:09 +08:00
Yun Pan cc8ebb8743 fix(user): make kube API client rate limit configurable (#7203) 
* fix(user): make kube API client rate limit configurable

* fix(user): add cloudDomain and cloudApiServerPort fallbacks

Signed-off-by: Yun Pan <dinoallo@netc.it>

* fix(user): increase the default kubeAPI.qps and kubeAPI.burst

Signed-off-by: Yun Pan <dinoallo@netc.it>

---------

Signed-off-by: Yun Pan <dinoallo@netc.it>
 2026-08-11 19:07:40 +08:00
Yun Pan 82a30ff42d feat(user): issue kubeconfigs with token requests (#7196) 
* feat(user): issue kubeconfigs with token requests

Use the ServiceAccount TokenRequest subresource instead of manually managed service-account-token Secrets, and request long-lived tokens as a transition for existing kubeconfig consumers.

* fix(user): bind token requests to a secret

* fix(user): restore random token secret names

* fix(user): satisfy golangci-lint

* fix(user): satisfy golines

* fix(user): clean up legacy service account token secrets

* fix(user): satisfy golines

* fix(user): clean up stale bound token secrets

* fix(user): satisfy golines

* fix(user): satisfy golines for token secret cleanup
 2026-08-11 18:58:32 +08:00
xzy 13d3350e5b refactor(objectstorage): remove objectstorage project from monorepo (#7158) 
* refactor: remove objectstorage project from monorepo

* ci(frontends): avoid shell interpolation in matrix step
 2026-08-06 17:50:45 +08:00
zijiren c2dd5ccc40 fix(account): expose billing catch-up setting in user values (#7156) 2026-08-04 15:44:11 +08:00
zijiren 6c28b33cd8 fix(account): make hourly billing reconciliation resumable and idempotent (#7126) 
* fix(account): make hourly billing reconciliation resumable and idempotent

- schedule every ready billing hour from a persisted Mongo checkpoint
- retry failed owner reconciliation and preserve checkpoint progress
- use stable billing IDs with Mongo upsert semantics
- recover stable unsettled billings independently from monitor data
- make Cockroach balance and credits deductions idempotent
- reconstruct historical debt and subscription state using transaction UpdatedAt
- scope subscription history queries to active workspaces in the target hour
- add focused unit and Testcontainers runtime coverage

* perf

* fix(account): restore hourly billing deduction semantics

* feat(account): bound billing checkpoint catch-up window

- add BILLING_MAX_CATCHUP_DURATION with a default of 24h
- limit historical billing replay to the configured duration
- preserve first-start behavior to process only the latest ready hour
- log skipped hours when the persisted checkpoint exceeds the replay window
- expose durable checkpoint lag and windowed pending checkpoint metrics
- wire the setting into the account controller Helm chart
- add bounded catch-up, first-start, validation, and metric tests

* fix: ci

* perf(account): optimize indexed historical billing queries

- replace full DebtStatusRecord loading with per-user LATERAL lookup
- use half-open billing time boundaries for historical debt state
- add composite indexes for debt, subscription, and credits queries
- add Testcontainers runtime and execution-plan coverage for billing paths
- verify Mongo billing indexes and repeated initialization behavior
 2026-08-03 16:52:51 +08:00
Yun Pan d19bd067c7 fix(lint): resolve controller and service issues (#7095) 
* fix(lint): resolve controller and service issues

* fix(lifecycle): add missing test licenses

* fix(account): format debt sync code

* fix(lifecycle): resolve staging lint issues

* ci: update golangci-lint to v2.12.2

* ci: update golangci-lint config

* ci: adjust golangci-lint config

* fix(webhook): resolve admission lint issues

* fix(lint): resolve remaining module issues

* fix(scan): resolve semgrep findings

* fix(ci): remove deleted pay service from matrix
 2026-07-27 14:45:50 +08:00
zijiren 95131f1208 refactor(devbox): Devbox and related gateway services (#7098) 
remove(devbox): Devbox and related gateway services
 2026-07-24 17:56:28 +08:00
Yun Pan b38d2ae17d fix(account): harden PAYG debt recovery (#7089) 
* fix(account): recover debt status after balance normalization

* fix(account): retry debt refresh when user lock is busy

* fix(account): verify workspace subscriptions during debt recovery
 2026-07-24 11:35:58 +08:00
Yun Pan c0034114f5 fix(account): replay final debt namespace cleanup (#7068) 
* fix(account): replay final debt namespace cleanup

* fix(account): wrap debt cleanup lint lines

* fix(account): shorten final debt sync error

* fix(account): bound debt cleanup replay requests

* fix(account): pass debt cleanup context

* fix(account): slow final debt replay interval
 2026-07-24 11:35:01 +08:00
xzy 53c913fbea fix(objectstorage): tighten public read bucket policy (#7066) 
* fix: tighten public read bucket policy

* fix(objectstorage): remove list access from public readwrite

* fix(objectstorage): preserve scaffold markers
 2026-07-20 11:44:33 +08:00
Yun Pan 7431b1264b fix(account): use dns-safe workspace debt notice names (#7063) 2026-07-17 10:58:04 +08:00
Yun Pan 07770769be fix(account): advance workspace debt cleanup status (#7060) 
* fix(account): advance workspace debt cleanup status

* fix(account): clarify debt notification error log
 2026-07-16 16:47:41 +08:00
zijiren e1acf686c0 feat(app): add sealos app position crd filed (#6981) 
* feat: add sealos app position crd filed

* chore: position type
 2026-06-03 10:24:04 +08:00
Sei 34c45c004d fix(account-webhook): block Start OpsRequest in debt-limit0 namespaces (#6901) 
* fix(account-webhook): widen apiVersions from v1 to * in debt webhook

* test(account-webhook): add unit tests for debt webhook handler
 2026-05-25 11:42:59 +08:00
zijiren 6200b08cea feat(terminal): terminal http only mode support (#6937) 
* feat: terminal http only mode support

* feat: add terminal frontend helm charts
 2026-05-07 17:20:25 +08:00
Jiahui 697b1d8e46 feat(account): compat pgsql (#6928) 
* init

* Adapt to gen-uuid()

* init job adapt

* fix

* fix
 2026-04-29 11:24:13 +08:00
cuisongliu 44738b4722 fix(rbac): expand permissions for kube-system namespace to include li… (#6886) 
fix(rbac): expand permissions for kube-system namespace to include list and watch

Signed-off-by: cuisongliu <cuisongliu@qq.com>
 2026-04-13 13:29:16 +08:00
Jiahui 5f3719fabc feat(core): standardized sealos cloud core component deployment (#6722) 
* support core helm refactor:
core/
├── frontend/
│   ├── desktop-frontend
│   ├── costcenter-frontend
│   └── license-frontend
├── controller/
│   ├── user-controller
│   ├── account-controller
│   ├── license-controller
│   └── resources-controller
├── service/
│   └── account-service
└── job / misc
    ├── init-job
    └── init-heartbeat

* rebase
 2026-04-02 11:41:21 +08:00
Jiahui f0afe9efbb fix(account): helm install name (#6843) 
fix helm install name
 2026-03-26 16:35:33 +08:00
cuisongliu 22cf0687ab fix(account-service): add ingress resource adoption and create instal… (#6832) 
* fix(account-service): add ingress resource adoption and create install script

Signed-off-by: cuisongliu <cuisongliu@qq.com>

* fix(config): add support for allowedAllOrigins in configmap and values

Signed-off-by: cuisongliu <cuisongliu@qq.com>

---------

Signed-off-by: cuisongliu <cuisongliu@qq.com>
 2026-03-25 13:29:48 +08:00
Jiahui cf1d385531 fix(user): Fix the concurrent creation restriction exception for user controller (#6801) 
Fix the concurrent creation restriction exception for user controller
 2026-03-21 11:56:31 +08:00
Jiahui ce508c1ef8 fix(account-webhook): remove cache (#6794) 
remove cache
 2026-03-21 11:30:09 +08:00
Jiahui a7d69e009f fix(account): skip the validate webhook for admin account (#6804) 
skip the validate webhook for admin account
 2026-03-18 14:21:05 +08:00
cuisongliu f3d634937e fix(user-controller): update namespace condition to exclude 'ns-admin' (#6799) 
Signed-off-by: cuisongliu <cuisongliu@qq.com>
 2026-03-13 17:17:44 +08:00
Jiahui 9ea30e48cd fix(license): license limit prompt translation (#6795) 
* init

* add crd
 2026-03-13 11:53:24 +08:00
cuisongliu 147c0a8f26 refactor(deploy): remove kube-rbac-proxy configuration from deploy.ya… (#6779) 
* refactor(deploy): remove kube-rbac-proxy configuration from deploy.yaml and templates

Signed-off-by: cuisongliu <cuisongliu@qq.com>

* refactor(webhooks): update conditional checks for image build and registry login

Signed-off-by: cuisongliu <cuisongliu@qq.com>

* refactor(webhooks): update conditional checks for image build and registry login

Signed-off-by: cuisongliu <cuisongliu@qq.com>

---------

Signed-off-by: cuisongliu <cuisongliu@qq.com>
 2026-03-08 17:57:37 +08:00
cuisongliu 3728c811be refactor(node): 🧬️fix node deploy.yaml (#6763) 
Signed-off-by: cuisongliu <cuisongliu@qq.com>
 2026-03-05 11:08:20 +08:00
Jiahui a1484da12f fix(account): indentation for containerPort account in deployment.yaml (#6757) 
Fix indentation for containerPort account in deployment.yaml
 2026-03-03 22:02:19 +08:00
Jiahui 78acbc4d5f fix(resources): resources controller ignore refresh gpu config for init (#6754) 
resources controller ignore refresh gpu config for init
 2026-03-03 21:04:12 +08:00
Jiahui 91cb20a78a feat(resources): support init properties to mongodb (#6745) 
support init properties to mongodb
 2026-03-02 14:47:06 +08:00
cuisongliu 75ae372ee9 feat(deploy): add user values template copying for account and deskto… (#6742) 
* feat(deploy): add user values template copying for account and desktop services

Signed-off-by: cuisongliu <cuisongliu@qq.com>

* feat(helm): add account service values file to helm values documentation

Signed-off-by: cuisongliu <cuisongliu@qq.com>

---------

Signed-off-by: cuisongliu <cuisongliu@qq.com>
 2026-03-02 09:51:07 +08:00
cuisongliu e1b39e1d0d refactor(node): remove gpu-alias ConfigMap and update node-gpu-info C… (#6732) 
* refactor(node): remove gpu-alias ConfigMap and update node-gpu-info ConfigMap

Signed-off-by: cuisongliu <cuisongliu@qq.com>

* refactor(values): remove gpuLabelMapping and gpuAlias entries from values.yaml

Signed-off-by: cuisongliu <cuisongliu@qq.com>

---------

Signed-off-by: cuisongliu <cuisongliu@qq.com>
 2026-02-27 18:30:21 +08:00
Jiahui c68248276b feat(account): add container port for account service (#6730) 
Add container port for account service
 2026-02-27 17:24:49 +08:00
cuisongliu 61bf245464 feat(service): add account service port configuration to service.yaml (#6728) 
Signed-off-by: cuisongliu <cuisongliu@qq.com>
 2026-02-27 17:09:16 +08:00
cuisongliu b58bbcf2cb fix(build): update values.yaml references for new Docker image in build scripts (#6713) 
* fix(build): update values.yaml references for new Docker image in build scripts

Signed-off-by: cuisongliu <cuisongliu@qq.com>

* fix(job-init): retrieve password salt from ConfigMap and improve password display output

Signed-off-by: cuisongliu <cuisongliu@qq.com>

* fix(job-init): retrieve password salt from ConfigMap and improve password display output

Signed-off-by: cuisongliu <cuisongliu@qq.com>

---------

Signed-off-by: cuisongliu <cuisongliu@qq.com>
 2026-02-26 10:05:39 +08:00
cuisongliu a4821a4315 feat(rbac): add RBAC configuration for job initialization with Cluste… (#6711) 
feat(rbac): add RBAC configuration for job initialization with ClusterRole and ServiceAccount

Signed-off-by: cuisongliu <cuisongliu@qq.com>
 2026-02-25 21:37:59 +08:00
Jiahui c620404cbc feat(resources): refactor deployment config to use ConfigMap for all environment variables (#6689) 
- Create new ConfigMap template to replace Secret for non-sensitive configuration
- Migrate MinIO AK/SK from Secret to ConfigMap for unified config management
- Simplify Deployment env injection from 70+ lines to 3 lines using envFrom
- Add all required environment variables identified in code (14 config items)
- Remove secret.yaml template file as all config now uses ConfigMap
- Enhance entrypoint.sh to auto-fetch MinIO credentials from objectstorage-config
- Support environment variable overrides for all configuration parameters

ConfigMap includes:
- Database URIs (MongoDB, Traffic MongoDB)
- MinIO configuration (endpoint, AK/SK, metrics)
- Prometheus URL
- Object storage instance
- Resource quota and monitoring settings

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude <noreply@anthropic.com>
 2026-02-10 20:01:46 +08:00