6351e9a0e9
MCP-2b: prometheus_provider.py
- prometheus_query (PromQL 即時查詢)
- prometheus_query_range (歷史趨勢，預設 15 分鐘)
- prometheus_get_alert_history (告警觸發歷史)
- config: PROMETHEUS_URL + PROMETHEUS_MCP_ENABLED
MCP-2a: ssh_provider.py
- 群組A 9 個只讀診斷工具 (top/disk/memory/logs/status/port/nginx/swap)
- 群組B 6 個安全操作工具 (restart/compose/systemctl/clear-log/ssl/nginx-reload)
- 四層安全守衛 (白名單/allowed_hosts/forbidden_patterns/trust_score)
- config: SSH_MCP_ENABLED + SSH_MCP_ALLOWED_HOSTS
K8s: 04-ssh-mcp-secret.example.yaml (ssh-mcp-key Secret 範本 + 建立步驟)
Alert labels: alerts-unified.yml 補充 mcp_provider/host_type/alert_category
覆蓋: HostHighCpuLoad/HostOutOfMemory/HostOutOfDiskSpace/DockerContainer*
SignOzDown/SentryDown/HarborDown/GiteaDown
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
52 lines
1.8 KiB
YAML
52 lines
1.8 KiB
YAML
# SSH MCP Key Secret — MCP Phase 2a (ADR-071)
|
||
# ============================================
|
||
# 此 Secret 供 SSH MCP Provider 使用，讓 API Pod 可 SSH 到 188/110/111 主機執行診斷和修復指令。
|
||
#
|
||
# 建立步驟:
|
||
# 1. 在 API Pod 宿主機生成 SSH key pair:
|
||
# ssh-keygen -t ed25519 -f /tmp/ssh-mcp-key -N "" -C "awoooi-mcp@k3s"
|
||
#
|
||
# 2. 將公鑰加入允許主機的 authorized_keys:
|
||
# ssh-copy-id -i /tmp/ssh-mcp-key.pub wooo@192.168.0.188
|
||
# ssh-copy-id -i /tmp/ssh-mcp-key.pub wooo@192.168.0.110
|
||
# ssh-copy-id -i /tmp/ssh-mcp-key.pub wooo@192.168.0.111
|
||
#
|
||
# 3. 建立 K8s Secret:
|
||
# kubectl create secret generic ssh-mcp-key \
|
||
# --from-file=ssh_mcp_key=/tmp/ssh-mcp-key \
|
||
# -n awoooi-prod
|
||
#
|
||
# 4. 刪除暫存 key:
|
||
# rm /tmp/ssh-mcp-key /tmp/ssh-mcp-key.pub
|
||
#
|
||
# 5. 在 K8s Deployment 加入 volume mount (參考 apps/api/k8s-deployment.yaml)
|
||
# volumeMounts:
|
||
# - name: ssh-mcp-key
|
||
# mountPath: /run/secrets/ssh_mcp_key
|
||
# subPath: ssh_mcp_key
|
||
# readOnly: true
|
||
# volumes:
|
||
# - name: ssh-mcp-key
|
||
# secret:
|
||
# secretName: ssh-mcp-key
|
||
# defaultMode: 0400
|
||
#
|
||
# 6. 設定環境變數 SSH_MCP_ENABLED=true（在 K8s ConfigMap 或 Deployment env 加入）
|
||
#
|
||
# ⚠️ 此檔案是範本，實際 Secret 由 CI/CD 注入，禁止提交私鑰到 Git
|
||
# ⚠️ 04-ssh-mcp-secret.yaml 已加入 .gitignore
|
||
|
||
apiVersion: v1
|
||
kind: Secret
|
||
metadata:
|
||
name: ssh-mcp-key
|
||
namespace: awoooi-prod
|
||
annotations:
|
||
# MCP Phase 2a (ADR-071, 2026-04-11)
|
||
description: "SSH private key for MCP SSH Provider — allows API pods to diagnose/repair host-layer services"
|
||
type: Opaque
|
||
data:
|
||
# Base64 encoded private key
|
||
# 使用方式: echo "$(cat /tmp/ssh-mcp-key | base64 -w 0)"
|
||
ssh_mcp_key: "CHANGE_ME_BASE64_ENCODED_PRIVATE_KEY"
|