Merge branch 'main' of https://github.com/TencentBlueKing/bk-user int…

…o helm-deploy

.github/workflows/bk-login.yml

@@ -26,8 +26,8 @@ jobs:
       - name: Format & Lint with ruff
         run: |
           pip install ruff==0.1.4
-          ruff format src/bk-login --config=src/bk-login/pyproject.toml
-          ruff src/bk-login --config=src/bk-login/pyproject.toml
+          ruff format src/bk-login --config=src/bk-login/pyproject.toml --no-cache
+          ruff src/bk-login --config=src/bk-login/pyproject.toml --no-cache
       - name: Lint with mypy
         run: |
           pip install mypy==1.6.1 types-requests==2.31.0.2 types-setuptools==57.4.18 types-dataclasses==0.1.7 types-redis==3.5.18 types-PyMySQL==1.1.0.1 types-six==0.1.9 types-toml==0.1.5 types-pytz==2023.3.0.0 types-urllib3==1.26.25.14

.github/workflows/bk-user.yml

@@ -26,8 +26,8 @@ jobs:
       - name: Format & Lint with ruff
         run: |
           pip install ruff==0.1.4
-          ruff format src/bk-user --config=src/bk-user/pyproject.toml
-          ruff src/bk-user --config=src/bk-user/pyproject.toml
+          ruff format src/bk-user --config=src/bk-user/pyproject.toml --no-cache
+          ruff src/bk-user --config=src/bk-user/pyproject.toml --no-cache
       - name: Lint with mypy
         run: |
           pip install mypy==1.6.1 types-requests==2.31.0.2 types-setuptools==57.4.18 types-dataclasses==0.1.7 types-redis==3.5.18 types-PyMySQL==1.1.0.1 types-six==0.1.9 types-toml==0.1.5 types-pytz==2023.3.0.0 types-urllib3==1.26.25.14

.github/workflows/idp-plugins.yml

@@ -21,8 +21,8 @@ jobs:
       - name: Format & Lint with ruff
         run: |
           pip install ruff==0.1.4
-          ruff format src/idp-plugins --config=src/idp-plugins/pyproject.toml
-          ruff src/idp-plugins --config=src/idp-plugins/pyproject.toml
+          ruff format src/idp-plugins --config=src/idp-plugins/pyproject.toml --no-cache
+          ruff src/idp-plugins --config=src/idp-plugins/pyproject.toml --no-cache
       - name: Lint with mypy
         run: |
           pip install mypy==1.6.1 types-requests==2.31.0.2 types-setuptools==57.4.18 types-dataclasses==0.1.7 types-redis==3.5.18 types-PyMySQL==1.1.0.1 types-six==0.1.9 types-toml==0.1.5 types-pytz==2023.3.0.0 types-urllib3==1.26.25.14

.pre-commit-config.yaml

@@ -55,13 +55,13 @@ repos:
         name: ruff-formatter
         language: python
         types: [python]
-        entry: ruff format --config=src/bk-user/pyproject.toml --force-exclude
+        entry: ruff format --config=src/bk-user/pyproject.toml --no-cache
         files: src/bk-user/
       - id: ruff
         name: ruff
         language: python
         types: [python]
-        entry: ruff --config=src/bk-user/pyproject.toml --force-exclude --fix
+        entry: ruff --config=src/bk-user/pyproject.toml --fix --no-cache
         files: src/bk-user/
       - id: mypy
         name: mypy
@@ -80,13 +80,13 @@ repos:
         name: ruff-formatter
         language: python
         types: [python]
-        entry: ruff format --config=src/bk-login/pyproject.toml --force-exclude
+        entry: ruff format --config=src/bk-login/pyproject.toml --no-cache
         files: src/bk-login/
       - id: ruff
         name: ruff
         language: python
         types: [python]
-        entry: ruff --config=src/bk-login/pyproject.toml --force-exclude --fix
+        entry: ruff --config=src/bk-login/pyproject.toml --fix --no-cache
         files: src/bk-login/
       - id: mypy
         name: mypy
@@ -105,13 +105,13 @@ repos:
         name: ruff-formatter
         language: python
         types: [python]
-        entry: ruff format --config=src/bk-plugins/pyproject.toml --force-exclude
+        entry: ruff format --config=src/bk-plugins/pyproject.toml --no-cache
         files: src/bk-plugins/
       - id: ruff
         name: ruff
         language: python
         types: [python]
-        entry: ruff --config=src/idp-plugins/pyproject.toml --force-exclude --fix
+        entry: ruff --config=src/idp-plugins/pyproject.toml --fix --no-cache
         files: src/idp-plugins/
       - id: mypy
         name: mypy

src/bk-login/bklogin/authentication/urls.py

@@ -9,6 +9,7 @@
 specific language governing permissions and limitations under the License.
 """
 from django.urls import path
+from django.views.decorators.clickjacking import xframe_options_exempt
 from django.views.generic import TemplateView
 
 from . import api_views, views
@@ -17,7 +18,7 @@
     # 登录入口
     path("", views.LoginView.as_view()),
     # 登录小窗入口
-    path("plain/", views.LoginView.as_view()),
+    path("plain/", xframe_options_exempt(views.LoginView.as_view())),
     # 前端页面（选择登录的用户）
     path("page/users/", TemplateView.as_view(template_name="index.html")),
     # ------------------------------------------ 租户 & 登录方式选择 ------------------------------------------

src/bk-login/bklogin/common/error_codes.py

@@ -45,6 +45,11 @@ class ErrorCodeCategoryEnum(str, StructuredEnum):
 class ErrorCodes:
     # 通用
     INVALID_ARGUMENT = ErrorCode(_("参数非法"))
+    UNAUTHENTICATED = ErrorCode(
+        _("未认证"),
+        code_category=ErrorCodeCategoryEnum.UNAUTHENTICATED,
+        status_code=HTTPStatus.UNAUTHORIZED,
+    )
     NO_PERMISSION = ErrorCode(
         _("无权限"),
         code_category=ErrorCodeCategoryEnum.NO_PERMISSION,

src/bk-login/bklogin/monitoring/healthz/probes.py

@@ -0,0 +1,22 @@
+# -*- coding: utf-8 -*-
+"""
+TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-用户管理(Bk-User) available.
+Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved.
+Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License.
+You may obtain a copy of the License at http://opensource.org/licenses/MIT
+Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+specific language governing permissions and limitations under the License.
+"""
+from blue_krill.monitoring.probe.mysql import MySQLProbe, transfer_django_db_settings
+from django.conf import settings
+from django.utils.module_loading import import_string
+
+
+def get_default_probes():
+    return [import_string(p) for p in settings.HEALTHZ_PROBES]
+
+
+class MysqlProbe(MySQLProbe):
+    name = "bklogin-mysql"
+    config = transfer_django_db_settings(settings.DATABASES["default"])

src/bk-login/bklogin/monitoring/healthz/urls.py

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*-
+"""
+TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-用户管理(Bk-User) available.
+Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved.
+Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License.
+You may obtain a copy of the License at http://opensource.org/licenses/MIT
+Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+specific language governing permissions and limitations under the License.
+"""
+from django.urls import path
+
+from . import views
+
+urlpatterns = [
+    path("ping", views.PingApi.as_view(), name="api.ping"),
+    path("healthz", views.HealthzApi.as_view(), name="api.healthz"),
+]

src/bk-login/bklogin/monitoring/healthz/views.py

@@ -0,0 +1,60 @@
+# -*- coding: utf-8 -*-
+"""
+TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-用户管理(Bk-User) available.
+Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved.
+Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License.
+You may obtain a copy of the License at http://opensource.org/licenses/MIT
+Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+specific language governing permissions and limitations under the License.
+"""
+from blue_krill.monitoring.probe.base import ProbeSet
+from django.conf import settings
+from django.http import HttpResponse
+from django.views.generic import View
+
+from bklogin.common.error_codes import error_codes
+from bklogin.common.response import APISuccessResponse
+
+from .probes import get_default_probes
+
+
+class PingApi(View):
+    """就绪&存活探测 API"""
+
+    def get(self, request, *args, **kwargs):
+        return HttpResponse("pong")
+
+
+class HealthzApi(View):
+    """健康探测 API"""
+
+    def get(self, request, *args, **kwargs):
+        token = request.GET.get("token", "")
+        if not settings.HEALTHZ_TOKEN:
+            raise error_codes.UNAUTHENTICATED.f(
+                "Healthz token was not configured in settings, request denied", replace=True
+            )
+        if not (token and token == settings.HEALTHZ_TOKEN):
+            raise error_codes.UNAUTHENTICATED.f("Please provide valid token", replace=True)
+
+        probe_set = ProbeSet(get_default_probes())
+        diagnosis_list = probe_set.examination()
+
+        if diagnosis_list.is_death:
+            # if something deadly exist, we have to make response non-200 which is easier to be found
+            # by monitor system and make response as a plain text
+            raise error_codes.SYSTEM_ERROR.f("internal server error", replace=True).set_data(
+                diagnosis_list.get_fatal_report()
+            )
+
+        results = [
+            {
+                "system_name": i.system_name,
+                "alive": i.alive,
+                "issues": [{"fatal": j.fatal, "description": j.description} for j in i.issues],
+            }
+            for i in diagnosis_list.items
+        ]
+
+        return APISuccessResponse(data={"results": results})

src/bk-login/bklogin/monitoring/metrics/__init__.py

@@ -0,0 +1,10 @@
+# -*- coding: utf-8 -*-
+"""
+TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-用户管理(Bk-User) available.
+Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved.
+Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License.
+You may obtain a copy of the License at http://opensource.org/licenses/MIT
+Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+specific language governing permissions and limitations under the License.
+"""

src/bk-login/bklogin/monitoring/metrics/urls.py

@@ -0,0 +1,15 @@
+# -*- coding: utf-8 -*-
+"""
+TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-用户管理(Bk-User) available.
+Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved.
+Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License.
+You may obtain a copy of the License at http://opensource.org/licenses/MIT
+Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+specific language governing permissions and limitations under the License.
+"""
+from django.conf.urls import url
+
+from . import views
+
+urlpatterns = [url(r"^metrics$", views.metric_view, name="prometheus-django-metrics")]

src/bk-login/bklogin/monitoring/metrics/views.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*-
+"""
+TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-用户管理(Bk-User) available.
+Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved.
+Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License.
+You may obtain a copy of the License at http://opensource.org/licenses/MIT
+Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+specific language governing permissions and limitations under the License.
+"""
+from django.conf import settings
+from django_prometheus.exports import ExportToDjangoView
+
+from bklogin.common.error_codes import error_codes
+
+
+def metric_view(request):
+    """metric view with basic auth"""
+    token = request.GET.get("token", "")
+    if not settings.METRIC_TOKEN:
+        raise error_codes.UNAUTHENTICATED.f(
+            "Metric token was not configured in settings, request denied", replace=True
+        )
+    if not (token and token == settings.METRIC_TOKEN):
+        raise error_codes.UNAUTHENTICATED.f("Please provide valid token", replace=True)
+
+    return ExportToDjangoView(request)

src/bk-login/bklogin/monitoring/tracing/__init__.py

@@ -0,0 +1,10 @@
+# -*- coding: utf-8 -*-
+"""
+TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-用户管理(Bk-User) available.
+Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved.
+Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License.
+You may obtain a copy of the License at http://opensource.org/licenses/MIT
+Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+specific language governing permissions and limitations under the License.
+"""

src/bk-login/bklogin/monitoring/tracing/apps.py

@@ -0,0 +1,26 @@
+# -*- coding: utf-8 -*-
+"""
+TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-用户管理(Bk-User) available.
+Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved.
+Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License.
+You may obtain a copy of the License at http://opensource.org/licenses/MIT
+Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+specific language governing permissions and limitations under the License.
+"""
+from django.apps import AppConfig
+
+from .otel import setup_by_settings
+from .sentry import init_sentry_sdk
+
+
+class TracingConfig(AppConfig):
+    name = "bklogin.monitoring.tracing"
+
+    def ready(self):
+        setup_by_settings()
+        init_sentry_sdk(
+            django_integrated=True,
+            redis_integrated=False,
+            celery_integrated=False,
+        )